ofz#20456 Null-dereference READ

Caolán McNamara · Caolán McNamara · commit 0754e581b0d8 · 2020-02-01T18:04:35.000+01:00
this is the first honggfuzz (honggfuzz_asan_libreoffice) report I've seen to date Change-Id: Iac733aa63c7c94d9454b9c8596340dc2286393c0 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/87803 Tested-by: Jenkins Reviewed-by: Caolán McNamara <caolanm@redhat.com>
diff --git a/lotuswordpro/source/filter/lwprowlayout.cxx b/lotuswordpro/source/filter/lwprowlayout.cxx
@@ -283,14 +283,15 @@ void LwpRowLayout::RegisterCurRowStyle(XFRow* pXFRow,sal_uInt16 nRowMark)
         {
             pRowStyle = static_cast<XFRowStyle*>(
                 pXFStyleManager->FindStyle(pTableLayout->GetDefaultRowStyleName()));
-            fHeight += pRowStyle->GetRowHeight();
         }
         else
         {
             pRowStyle = static_cast<XFRowStyle*>(
                 pXFStyleManager->FindStyle(iter->second->GetStyleName()));
-            fHeight+=pRowStyle->GetRowHeight();
         }
+        if (!pRowStyle)
+            throw std::runtime_error("missing RowStyle");
+        fHeight += pRowStyle->GetRowHeight();
     }
 
     if (m_nDirection & 0x0030)

Original file line number	Diff line number	Diff line change
`@@ -283,14 +283,15 @@ void LwpRowLayout::RegisterCurRowStyle(XFRow* pXFRow,sal_uInt16 nRowMark)`
`283`	`283`	`{`
`284`	`284`	`pRowStyle = static_cast<XFRowStyle*>(`
`285`	`285`	`pXFStyleManager->FindStyle(pTableLayout->GetDefaultRowStyleName()));`
`286`		`- fHeight += pRowStyle->GetRowHeight();`
`287`	`286`	`}`
`288`	`287`	`else`
`289`	`288`	`{`
`290`	`289`	`pRowStyle = static_cast<XFRowStyle*>(`
`291`	`290`	`pXFStyleManager->FindStyle(iter->second->GetStyleName()));`
`292`		`- fHeight+=pRowStyle->GetRowHeight();`
`293`	`291`	`}`
	`292`	`+ if (!pRowStyle)`
	`293`	`+ throw std::runtime_error("missing RowStyle");`
	`294`	`+ fHeight += pRowStyle->GetRowHeight();`
`294`	`295`	`}`
`295`	`296`
`296`	`297`	`if (m_nDirection & 0x0030)`