basic/source/comp/loops.cxx | 5 +++++
1 file changed, 5 insertions(+)
New commits:
commit 8bbfbe92c01bff38ed2241da56560b84f7954beb
Author: Mike Kaganski <[email protected]>
AuthorDate: Tue Feb 27 13:44:37 2024 +0600
Commit: Mike Kaganski <[email protected]>
CommitDate: Tue Feb 27 10:33:52 2024 +0100
tdf#159908: return early to avoid nullptr dereference
When aLvalue is not a variable, its GetRealVar() returns nullptr.
That was dereferenced unconditionally later in the check of the
variable after NEXT.
Change-Id: Ia46f23a7e720431bf62ace998848b684aa8449e8
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/164002
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <[email protected]>
diff --git a/basic/source/comp/loops.cxx b/basic/source/comp/loops.cxx
index 07aac44943a6..f903f650a2bf 100644
--- a/basic/source/comp/loops.cxx
+++ b/basic/source/comp/loops.cxx
@@ -210,6 +210,11 @@ void SbiParser::For()
if( bForEach )
Next();
SbiExpression aLvalue( this, SbOPERAND );
+ if (!aLvalue.IsVariable())
+ {
+ bAbort = true;
+ return; // the error is alredy set in SbiExpression ctor
+ }
aLvalue.Gen(); // variable on the Stack
if( bForEach )
