Date: prev next · Thread: first prev next last
2019 Archives by date, by thread · List index


Hi,

Please find the latest report on new defect(s) introduced to LibreOffice found with Coverity Scan.

20 new defect(s) introduced to LibreOffice found with Coverity Scan.
81 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by 
Coverity Scan.

New defect(s) Reported-by: Coverity Scan
Showing 20 of 20 defect(s)


** CID 1451643:  Uninitialized members  (UNINIT_CTOR)
/cui/source/dialogs/SpellDialog.cxx: 1117 in 
svx::SentenceEditWindow_Impl::SentenceEditWindow_Impl()()


________________________________________________________________________________________________________
*** CID 1451643:  Uninitialized members  (UNINIT_CTOR)
/cui/source/dialogs/SpellDialog.cxx: 1117 in 
svx::SentenceEditWindow_Impl::SentenceEditWindow_Impl()()
1111     
1112     SentenceEditWindow_Impl::SentenceEditWindow_Impl()
1113         : m_nErrorStart(0)
1114         , m_nErrorEnd(0)
1115         , m_bIsUndoEditMode(false)
1116     {
    CID 1451643:  Uninitialized members  (UNINIT_CTOR)
    Non-static class member "m_pToolbar" is not initialized in this constructor nor in any 
functions that it calls.
1117     }
1118     
1119     void SentenceEditWindow_Impl::SetDrawingArea(weld::DrawingArea* pDrawingArea)
1120     {
1121         Size aSize(pDrawingArea->get_approximate_digit_width() * 60,
1122                    pDrawingArea->get_text_height() * 6);

** CID 1451642:  Integer handling issues  (DIVIDE_BY_ZERO)


________________________________________________________________________________________________________
*** CID 1451642:  Integer handling issues  (DIVIDE_BY_ZERO)
/sd/source/ui/unoidl/UnoDocumentSettings.cxx: 706 in sd::DocumentSettings::_setPropertyValues(const 
comphelper::PropertyMapEntry **, const com::sun::star::uno::Any *)()
700                 case HANDLE_SCALE_DOM:
701                     {
702                         sal_Int32 nValue = 0;
703                         if( *pValues >>= nValue )
704                         {
705                             Fraction aFract( pDoc->GetUIScale().GetNumerator(), nValue );
    CID 1451642:  Integer handling issues  (DIVIDE_BY_ZERO)
    In function call "SetUIScale", modulo by expression "aFract.mnNumerator" which may be zero 
has undefined behavior.
706                             pDoc->SetUIScale( aFract );
707                             bOk = true;
708                             bChanged = true;
709                         }
710                     }
711                     break;

** CID 1451641:  Error handling issues  (CHECKED_RETURN)
/vcl/source/gdi/virdev.cxx: 482 in VirtualDevice::ImplSetReferenceDevice(VirtualDevice::RefDevMode, 
int, int)()


________________________________________________________________________________________________________
*** CID 1451641:  Error handling issues  (CHECKED_RETURN)
/vcl/source/gdi/virdev.cxx: 482 in VirtualDevice::ImplSetReferenceDevice(VirtualDevice::RefDevMode, 
int, int)()
476         // preserve global font lists
477         ImplSVData* pSVData = ImplGetSVData();
478         mxFontCollection.reset();
479         mxFontCache.reset();
480     
481         // get font list with scalable fonts only
    CID 1451641:  Error handling issues  (CHECKED_RETURN)
    Calling "AcquireGraphics" without checking return value (as is done elsewhere 4 out of 5 
times).
482         AcquireGraphics();
483         mxFontCollection = pSVData->maGDIData.mxScreenFontList->Clone();
484     
485         // prepare to use new font lists
486         mxFontCache.reset(new ImplFontCache);
487     }

** CID 1451640:    (DIVIDE_BY_ZERO)
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 91 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 80 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 55 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 66 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 117 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 109 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()


________________________________________________________________________________________________________
*** CID 1451640:    (DIVIDE_BY_ZERO)
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 91 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
85     
86             aRelativeSize.Primary =
87                 static_cast< double >( aObjectRect.getWidth()) /
88                 static_cast< double >( aPageRect.getWidth() );
89             if (aRelativeSize.Primary > 1.0)
90                 aRelativeSize.Primary = 1.0;
    CID 1451640:    (DIVIDE_BY_ZERO)
    In expression "static_cast<double>(aObjectRect.getHeight()) / 
static_cast<double>(aPageRect.getHeight())", division by expression "aPageRect.getHeight()" 
which may be zero has undefined behavior.
91             aRelativeSize.Secondary =
92                 static_cast< double >( aObjectRect.getHeight()) /
93                 static_cast< double >( aPageRect.getHeight());
94             if (aRelativeSize.Secondary > 1.0)
95                 aRelativeSize.Secondary = 1.0;
96     
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 80 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
74             chart2::RelativeSize aRelativeSize;
75             Point aAnchor = aObjectRect.TopLeft();
76     
77             aRelativePosition.Primary =
78                 static_cast< double >( aAnchor.X()) /
79                 static_cast< double >( aPageRect.getWidth() );
    CID 1451640:    (DIVIDE_BY_ZERO)
    In expression "static_cast<double>(aAnchor.Y()) / 
static_cast<double>(aPageRect.getHeight())", division by expression "aPageRect.getHeight()" 
which may be zero has undefined behavior.
80             aRelativePosition.Secondary =
81                 static_cast< double >( aAnchor.Y()) /
82                 static_cast< double >( aPageRect.getHeight());
83     
84             xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
85     
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 55 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
49             //@todo decide whether x is primary or secondary
50             chart2::RelativePosition aRelativePosition;
51             aRelativePosition.Anchor = drawing::Alignment_CENTER;
52             //the anchor point at the title object is top/middle
53             Point aPos = aObjectRect.TopLeft();
54             aRelativePosition.Primary = 
(double(aPos.X())+double(aObjectRect.getWidth())/2.0)/double(aPageRect.getWidth());
    CID 1451640:    (DIVIDE_BY_ZERO)
    In expression "((double)aPos.Y() + (double)aObjectRect.getHeight() / 2.) / 
(double)aPageRect.getHeight()", division by expression "aPageRect.getHeight()" which may be 
zero has undefined behavior.
55             aRelativePosition.Secondary = 
(double(aPos.Y())+double(aObjectRect.getHeight())/2.0)/double(aPageRect.getHeight());
56             xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
57         }
58         else if( eObjectType==OBJECTTYPE_DATA_CURVE_EQUATION )
59         {
60             //@todo decide whether x is primary or secondary
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 66 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
60             //@todo decide whether x is primary or secondary
61             chart2::RelativePosition aRelativePosition;
62             aRelativePosition.Anchor = drawing::Alignment_TOP_LEFT;
63             //the anchor point at the title object is top/middle
64             Point aPos = aObjectRect.TopLeft();
65             aRelativePosition.Primary = double(aPos.X())/double(aPageRect.getWidth());
    CID 1451640:    (DIVIDE_BY_ZERO)
    In expression "(double)aPos.Y() / (double)aPageRect.getHeight()", division by expression 
"aPageRect.getHeight()" which may be zero has undefined behavior.
66             aRelativePosition.Secondary = double(aPos.Y())/double(aPageRect.getHeight());
67             xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
68         }
69         else if(eObjectType==OBJECTTYPE_LEGEND)
70         {
71             xObjectProp->setPropertyValue( "AnchorPosition", uno::Any(LegendPosition_CUSTOM));
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 117 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
111     
112             //set size:
113             RelativeSize aRelativeSize;
114             //the anchor points for the diagram are in the middle of the diagram
115             //and in the middle of the page
116             aRelativeSize.Primary = double(aObjectRect.getWidth())/double(aPageRect.getWidth());
    CID 1451640:    (DIVIDE_BY_ZERO)
    In expression "(double)aObjectRect.getHeight() / (double)aPageRect.getHeight()", division 
by expression "aPageRect.getHeight()" which may be zero has undefined behavior.
117             aRelativeSize.Secondary = 
double(aObjectRect.getHeight())/double(aPageRect.getHeight());
118             xObjectProp->setPropertyValue( "RelativeSize", uno::Any(aRelativeSize) );
119         }
120         else
121             return false;
122         return true;
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 109 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
103             //set position:
104             chart2::RelativePosition aRelativePosition;
105             aRelativePosition.Anchor = drawing::Alignment_CENTER;
106     
107             Point aPos = aObjectRect.Center();
108             aRelativePosition.Primary = double(aPos.X())/double(aPageRect.getWidth());
    CID 1451640:    (DIVIDE_BY_ZERO)
    In expression "(double)aPos.Y() / (double)aPageRect.getHeight()", division by expression 
"aPageRect.getHeight()" which may be zero has undefined behavior.
109             aRelativePosition.Secondary = double(aPos.Y())/double(aPageRect.getHeight());
110             xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
111     
112             //set size:
113             RelativeSize aRelativeSize;
114             //the anchor points for the diagram are in the middle of the diagram

** CID 1451639:  Memory - illegal accesses  (USE_AFTER_FREE)


________________________________________________________________________________________________________
*** CID 1451639:  Memory - illegal accesses  (USE_AFTER_FREE)
/sw/source/core/layout/paintfrm.cxx: 4163 in SwTabFrame::PaintSwFrame(OutputDevice &, const SwRect 
&, const SwPrintData *) const()
4157             SwRect aTabRect( getFramePrintArea() );
4158             aTabRect.Pos() += getFrameArea().Pos();
4159             SwRect aTabOutRect( rRect );
4160             aTabOutRect.Intersection( aTabRect );
4161             SwViewOption::DrawRect( &rRenderContext, aTabOutRect, COL_LIGHTGRAY );
4162         }
    CID 1451639:  Memory - illegal accesses  (USE_AFTER_FREE)
    Calling "ResetComplete" dereferences freed pointer "const_cast<SwTabFrame *>(this)".
4163         const_cast<SwTabFrame*>(this)->ResetComplete();
4164     }
4165     
4166     /**
4167      * Paint border shadow
4168      *

** CID 1451638:  Null pointer dereferences  (FORWARD_NULL)
/sw/source/core/doc/docbm.cxx: 1350 in sw::mark::MarkManager::NotifyCursorUpdate(const 
SwCursorShell &)()


________________________________________________________________________________________________________
*** CID 1451638:  Null pointer dereferences  (FORWARD_NULL)
/sw/source/core/doc/docbm.cxx: 1350 in sw::mark::MarkManager::NotifyCursorUpdate(const 
SwCursorShell &)()
1344             if ( pFieldBM && (pFieldBM->GetFieldname() == ODF_FORMDROPDOWN ||
1345                               pFieldBM->GetFieldname() == ODF_FORMDATE))
1346             {
1347                 if (m_pLastActiveFieldmark != pFieldBM)
1348                 {
1349                     auto pFormField = dynamic_cast<FieldmarkWithDropDownButton*>(pFieldBM);
    CID 1451638:  Null pointer dereferences  (FORWARD_NULL)
    Passing null pointer "pFormField" to "ShowButton", which dereferences it. (The dereference 
happens because this is a virtual function call.)
1350                     pFormField->ShowButton(&rEditWin);
1351                     pNewActiveFieldmark = pFormField;
1352                 }
1353                 else
1354                 {
1355                     pNewActiveFieldmark = m_pLastActiveFieldmark;

** CID 1451637:    (FORWARD_NULL)


________________________________________________________________________________________________________
*** CID 1451637:    (FORWARD_NULL)
/editeng/source/editeng/impedit3.cxx: 1320 in ImpEditEngine::CreateLines(int, unsigned int)()
1314                 }
1315             }
1316             else
1317             {
1318                 bEOL = true;
1319                 bEOC = true;
    CID 1451637:    (FORWARD_NULL)
    Passing null pointer "pLine" to "SetEnd", which dereferences it.
1320                 pLine->SetEnd( nPortionEnd );
1321                 DBG_ASSERT( pParaPortion->GetTextPortions().Count(), "No TextPortions?" );
1322                 pLine->SetEndPortion( pParaPortion->GetTextPortions().Count() - 1 );
1323             }
1324     
1325             if ( aStatus.OneCharPerLine() )
/editeng/source/editeng/impedit3.cxx: 1327 in ImpEditEngine::CreateLines(int, unsigned int)()
1321                 DBG_ASSERT( pParaPortion->GetTextPortions().Count(), "No TextPortions?" );
1322                 pLine->SetEndPortion( pParaPortion->GetTextPortions().Count() - 1 );
1323             }
1324     
1325             if ( aStatus.OneCharPerLine() )
1326             {
    CID 1451637:    (FORWARD_NULL)
    Passing null pointer "pLine" to "SetEnd", which dereferences it.
1327                 pLine->SetEnd( nPortionEnd );
1328                 pLine->SetEndPortion( nTmpPortion-1 );
1329             }
1330             else if ( bFixedEnd )
1331             {
1332                 pLine->SetEnd( nPortionStart );

** CID 1451636:    (DIVIDE_BY_ZERO)


________________________________________________________________________________________________________
*** CID 1451636:    (DIVIDE_BY_ZERO)
/sc/source/ui/unoobj/docuno.cxx: 2068 in ScModelObj::render(int, const com::sun::star::uno::Any &, 
const com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> &)()
2062                                 // to get the target rectangle in pixels.
2063     
2064                                 Fraction aScaleX( aLocationPixel.GetWidth(), 
aLocationMM.GetWidth() );
2065                                 Fraction aScaleY( aLocationPixel.GetHeight(), 
aLocationMM.GetHeight() );
2066     
2067                                 long nX1 = aLocationPixel.Left() + static_cast<long>( 
Fraction( aTargetRect.Left() - aLocationMM.Left(), 1 ) * aScaleX );
    CID 1451636:    (DIVIDE_BY_ZERO)
    In function call "operator *", modulo by expression "aScaleX.mnNumerator" which may be zero 
has undefined behavior.
2068                                 long nX2 = aLocationPixel.Left() + static_cast<long>( 
Fraction( aTargetRect.Right() - aLocationMM.Left(), 1 ) * aScaleX );
2069                                 long nY1 = aLocationPixel.Top() + static_cast<long>( Fraction( 
aTargetRect.Top() - aLocationMM.Top(), 1 ) * aScaleY );
2070                                 long nY2 = aLocationPixel.Top() + static_cast<long>( Fraction( 
aTargetRect.Bottom() - aLocationMM.Top(), 1 ) * aScaleY );
2071     
2072                                 if ( nX1 > aLocationPixel.Right() ) nX1 = 
aLocationPixel.Right();
2073                                 if ( nX2 > aLocationPixel.Right() ) nX2 = 
aLocationPixel.Right();
/sc/source/ui/unoobj/docuno.cxx: 2067 in ScModelObj::render(int, const com::sun::star::uno::Any &, 
const com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> &)()
2061                                 // Scale and move the target rectangle from aLocationMM to 
aLocationPixel,
2062                                 // to get the target rectangle in pixels.
2063     
2064                                 Fraction aScaleX( aLocationPixel.GetWidth(), 
aLocationMM.GetWidth() );
2065                                 Fraction aScaleY( aLocationPixel.GetHeight(), 
aLocationMM.GetHeight() );
2066     
    CID 1451636:    (DIVIDE_BY_ZERO)
    In function call "operator *", modulo by expression "aScaleX.mnNumerator" which may be zero 
has undefined behavior.
2067                                 long nX1 = aLocationPixel.Left() + static_cast<long>( 
Fraction( aTargetRect.Left() - aLocationMM.Left(), 1 ) * aScaleX );
2068                                 long nX2 = aLocationPixel.Left() + static_cast<long>( 
Fraction( aTargetRect.Right() - aLocationMM.Left(), 1 ) * aScaleX );
2069                                 long nY1 = aLocationPixel.Top() + static_cast<long>( Fraction( 
aTargetRect.Top() - aLocationMM.Top(), 1 ) * aScaleY );
2070                                 long nY2 = aLocationPixel.Top() + static_cast<long>( Fraction( 
aTargetRect.Bottom() - aLocationMM.Top(), 1 ) * aScaleY );
2071     
2072                                 if ( nX1 > aLocationPixel.Right() ) nX1 = 
aLocationPixel.Right();

** CID 1451635:  Null pointer dereferences  (FORWARD_NULL)
/cui/source/dialogs/SpellDialog.cxx: 1484 in svx::SentenceEditWindow_Impl::KeyInput(const KeyEvent 
&)()


________________________________________________________________________________________________________
*** CID 1451635:  Null pointer dereferences  (FORWARD_NULL)
/cui/source/dialogs/SpellDialog.cxx: 1484 in svx::SentenceEditWindow_Impl::KeyInput(const KeyEvent 
&)()
1478                 {
1479                     m_nErrorStart = pFontColor->nStart;
1480                     m_nErrorEnd = pFontColor->nEnd;
1481                     if (pErrorAttrib->nStart != m_nErrorStart || pErrorAttrib->nEnd != 
m_nErrorEnd)
1482                     {
1483                         std::unique_ptr<SfxPoolItem> xNewError(pErrorAttrib->pAttr->Clone());
    CID 1451635:  Null pointer dereferences  (FORWARD_NULL)
    Dereferencing null pointer "pErrorAttr".
1484                         m_xEditEngine->RemoveAttribs(ESelection(0, pErrorAttr->nStart, 0, 
pErrorAttr->nEnd), false, EE_CHAR_GRABBAG);
1485                         SetAttrib(*xNewError, m_nErrorStart, m_nErrorEnd);
1486                     }
1487                 }
1488             }
1489             //this is not a modification anymore

** CID 1451634:    (DIVIDE_BY_ZERO)


________________________________________________________________________________________________________
*** CID 1451634:    (DIVIDE_BY_ZERO)
/sc/source/ui/unoobj/docuno.cxx: 2069 in ScModelObj::render(int, const com::sun::star::uno::Any &, 
const com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> &)()
2063     
2064                                 Fraction aScaleX( aLocationPixel.GetWidth(), 
aLocationMM.GetWidth() );
2065                                 Fraction aScaleY( aLocationPixel.GetHeight(), 
aLocationMM.GetHeight() );
2066     
2067                                 long nX1 = aLocationPixel.Left() + static_cast<long>( 
Fraction( aTargetRect.Left() - aLocationMM.Left(), 1 ) * aScaleX );
2068                                 long nX2 = aLocationPixel.Left() + static_cast<long>( 
Fraction( aTargetRect.Right() - aLocationMM.Left(), 1 ) * aScaleX );
    CID 1451634:    (DIVIDE_BY_ZERO)
    In function call "operator *", modulo by expression "aScaleY.mnNumerator" which may be zero 
has undefined behavior.
2069                                 long nY1 = aLocationPixel.Top() + static_cast<long>( Fraction( 
aTargetRect.Top() - aLocationMM.Top(), 1 ) * aScaleY );
2070                                 long nY2 = aLocationPixel.Top() + static_cast<long>( Fraction( 
aTargetRect.Bottom() - aLocationMM.Top(), 1 ) * aScaleY );
2071     
2072                                 if ( nX1 > aLocationPixel.Right() ) nX1 = 
aLocationPixel.Right();
2073                                 if ( nX2 > aLocationPixel.Right() ) nX2 = 
aLocationPixel.Right();
2074                                 if ( nY1 > aLocationPixel.Bottom() ) nY1 = 
aLocationPixel.Bottom();
/sc/source/ui/unoobj/docuno.cxx: 2070 in ScModelObj::render(int, const com::sun::star::uno::Any &, 
const com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> &)()
2064                                 Fraction aScaleX( aLocationPixel.GetWidth(), 
aLocationMM.GetWidth() );
2065                                 Fraction aScaleY( aLocationPixel.GetHeight(), 
aLocationMM.GetHeight() );
2066     
2067                                 long nX1 = aLocationPixel.Left() + static_cast<long>( 
Fraction( aTargetRect.Left() - aLocationMM.Left(), 1 ) * aScaleX );
2068                                 long nX2 = aLocationPixel.Left() + static_cast<long>( 
Fraction( aTargetRect.Right() - aLocationMM.Left(), 1 ) * aScaleX );
2069                                 long nY1 = aLocationPixel.Top() + static_cast<long>( Fraction( 
aTargetRect.Top() - aLocationMM.Top(), 1 ) * aScaleY );
    CID 1451634:    (DIVIDE_BY_ZERO)
    In function call "operator *", modulo by expression "aScaleY.mnNumerator" which may be zero 
has undefined behavior.
2070                                 long nY2 = aLocationPixel.Top() + static_cast<long>( Fraction( 
aTargetRect.Bottom() - aLocationMM.Top(), 1 ) * aScaleY );
2071     
2072                                 if ( nX1 > aLocationPixel.Right() ) nX1 = 
aLocationPixel.Right();
2073                                 if ( nX2 > aLocationPixel.Right() ) nX2 = 
aLocationPixel.Right();
2074                                 if ( nY1 > aLocationPixel.Bottom() ) nY1 = 
aLocationPixel.Bottom();
2075                                 if ( nY2 > aLocationPixel.Bottom() ) nY2 = 
aLocationPixel.Bottom();

** CID 1451633:  Memory - illegal accesses  (USE_AFTER_FREE)


________________________________________________________________________________________________________
*** CID 1451633:  Memory - illegal accesses  (USE_AFTER_FREE)
/sw/source/core/layout/paintfrm.cxx: 4101 in SwFlyFrame::PaintSwFrame(OutputDevice &, const SwRect 
&, const SwPrintData *) const()
4095                 gProp.pSSpecSubsLines.reset();
4096             }
4097         }
4098     
4099         SwLayoutFrame::PaintSwFrame( rRenderContext, aRect );
4100     
    CID 1451633:  Memory - illegal accesses  (USE_AFTER_FREE)
    Calling "Validate" dereferences freed pointer "this".
4101         Validate();
4102     
4103         // OD 19.12.2002 #106318# - first paint lines added by fly frame paint
4104         // and then unlock other lines.
4105         gProp.pSLines->PaintLines( &rRenderContext, gProp );
4106         gProp.pSLines->LockLines( false );

** CID 1451632:  Null pointer dereferences  (FORWARD_NULL)


________________________________________________________________________________________________________
*** CID 1451632:  Null pointer dereferences  (FORWARD_NULL)
/sd/source/ui/view/sdwindow.cxx: 271 in sd::Window::Command(const CommandEvent &)()
265         //pass at least alt press/release to parent impl
266         if (rCEvt.GetCommand() == CommandEventId::ModKeyChange)
267             vcl::Window::Command(rCEvt);
268         //show the text edit outliner view cursor
269         else if (!HasFocus() && rCEvt.GetCommand() == CommandEventId::CursorPos)
270         {
    CID 1451632:  Null pointer dereferences  (FORWARD_NULL)
    Passing null pointer "this->mpViewShell" to "GetView", which dereferences it.
271             OutlinerView* pOLV = mpViewShell->GetView()->GetTextEditOutlinerView();
272             if (pOLV && this == pOLV->GetWindow())
273             {
274                 GrabFocus();
275                 pOLV->ShowCursor();
276             }

** CID 1451630:  Integer handling issues  (DIVIDE_BY_ZERO)
/vcl/source/bitmap/BitmapScaleConvolutionFilter.cxx: 153 in 
vcl::<unnamed>::ImplScaleConvolutionHor(Bitmap &, Bitmap &, const double &, const vcl::Kernel &)()


________________________________________________________________________________________________________
*** CID 1451630:  Integer handling issues  (DIVIDE_BY_ZERO)
/vcl/source/bitmap/BitmapScaleConvolutionFilter.cxx: 153 in 
vcl::<unnamed>::ImplScaleConvolutionHor(Bitmap &, Bitmap &, const double &, const vcl::Kernel &)()
147     
148                             aValueRed += aWeight * aColor.GetRed();
149                             aValueGreen += aWeight * aColor.GetGreen();
150                             aValueBlue += aWeight * aColor.GetBlue();
151                         }
152     
    CID 1451630:  Integer handling issues  (DIVIDE_BY_ZERO)
    In expression "aValueRed / aSum", division by expression "aSum" which may be zero has 
undefined behavior.
153                         const BitmapColor aResultColor(
154                             static_cast< sal_uInt8 >(MinMax(static_cast< sal_Int32 >(aValueRed 
/ aSum), 0, 255)),
155                             static_cast< sal_uInt8 >(MinMax(static_cast< sal_Int32 
(aValueGreen / aSum), 0, 255)),
156                             static_cast< sal_uInt8 >(MinMax(static_cast< sal_Int32 >(aValueBlue 
/ aSum), 0, 255)));
157     
158                         pWriteAcc->SetPixelOnData(pScanline, x, aResultColor);

** CID 1451629:  Integer handling issues  (DIVIDE_BY_ZERO)
/vcl/source/bitmap/BitmapScaleConvolutionFilter.cxx: 234 in 
vcl::<unnamed>::ImplScaleConvolutionVer(Bitmap &, Bitmap &, const double &, const vcl::Kernel &)()


________________________________________________________________________________________________________
*** CID 1451629:  Integer handling issues  (DIVIDE_BY_ZERO)
/vcl/source/bitmap/BitmapScaleConvolutionFilter.cxx: 234 in 
vcl::<unnamed>::ImplScaleConvolutionVer(Bitmap &, Bitmap &, const double &, const vcl::Kernel &)()
228                             const BitmapColor & aColor = aScanline[aPixels[aIndex]];
229                             aValueRed += aWeight * aColor.GetRed();
230                             aValueGreen += aWeight * aColor.GetGreen();
231                             aValueBlue += aWeight * aColor.GetBlue();
232                         }
233     
    CID 1451629:  Integer handling issues  (DIVIDE_BY_ZERO)
    In expression "aValueRed / aSum", division by expression "aSum" which may be zero has 
undefined behavior.
234                         const BitmapColor aResultColor(
235                             static_cast< sal_uInt8 >(MinMax(static_cast< sal_Int32 >(aValueRed 
/ aSum), 0, 255)),
236                             static_cast< sal_uInt8 >(MinMax(static_cast< sal_Int32 
(aValueGreen / aSum), 0, 255)),
237                             static_cast< sal_uInt8 >(MinMax(static_cast< sal_Int32 >(aValueBlue 
/ aSum), 0, 255)));
238     
239                         if(pWriteAcc->HasPalette())

** CID 1451628:  Null pointer dereferences  (FORWARD_NULL)


________________________________________________________________________________________________________
*** CID 1451628:  Null pointer dereferences  (FORWARD_NULL)
/sc/source/ui/Accessibility/AccessibleDocument.cxx: 300 in 
ScChildrenShapes::ScChildrenShapes(ScAccessibleDocument *, ScTabViewShell *, ScSplitPos)()
294                 }
295             }
296         }
297     
298         maZOrderedShapes.push_back(nullptr); // add an element which represents the table
299     
    CID 1451628:  Null pointer dereferences  (FORWARD_NULL)
    "GetCount" dereferences null "this->mpAccessibleDocument".
300         GetCount(); // fill list with filtered shapes (no internal shapes)
301     
302         if (mnShapesSelected)
303         {
304             //set flag on every selected shape
305             if (!xSelectionSupplier.is())

** CID 1451627:    (DIVIDE_BY_ZERO)
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 86 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 116 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 77 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 54 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 65 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 108 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()


________________________________________________________________________________________________________
*** CID 1451627:    (DIVIDE_BY_ZERO)
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 86 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
80             aRelativePosition.Secondary =
81                 static_cast< double >( aAnchor.Y()) /
82                 static_cast< double >( aPageRect.getHeight());
83     
84             xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
85     
    CID 1451627:    (DIVIDE_BY_ZERO)
    In expression "static_cast<double>(aObjectRect.getWidth()) / 
static_cast<double>(aPageRect.getWidth())", division by expression "aPageRect.getWidth()" which 
may be zero has undefined behavior.
86             aRelativeSize.Primary =
87                 static_cast< double >( aObjectRect.getWidth()) /
88                 static_cast< double >( aPageRect.getWidth() );
89             if (aRelativeSize.Primary > 1.0)
90                 aRelativeSize.Primary = 1.0;
91             aRelativeSize.Secondary =
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 116 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
110             xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
111     
112             //set size:
113             RelativeSize aRelativeSize;
114             //the anchor points for the diagram are in the middle of the diagram
115             //and in the middle of the page
    CID 1451627:    (DIVIDE_BY_ZERO)
    In expression "(double)aObjectRect.getWidth() / (double)aPageRect.getWidth()", division by 
expression "aPageRect.getWidth()" which may be zero has undefined behavior.
116             aRelativeSize.Primary = double(aObjectRect.getWidth())/double(aPageRect.getWidth());
117             aRelativeSize.Secondary = 
double(aObjectRect.getHeight())/double(aPageRect.getHeight());
118             xObjectProp->setPropertyValue( "RelativeSize", uno::Any(aRelativeSize) );
119         }
120         else
121             return false;
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 77 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
71             xObjectProp->setPropertyValue( "AnchorPosition", uno::Any(LegendPosition_CUSTOM));
72             xObjectProp->setPropertyValue( "Expansion", 
uno::Any(css::chart::ChartLegendExpansion_CUSTOM));
73             chart2::RelativePosition aRelativePosition;
74             chart2::RelativeSize aRelativeSize;
75             Point aAnchor = aObjectRect.TopLeft();
76     
    CID 1451627:    (DIVIDE_BY_ZERO)
    In expression "static_cast<double>(aAnchor.X()) / 
static_cast<double>(aPageRect.getWidth())", division by expression "aPageRect.getWidth()" which 
may be zero has undefined behavior.
77             aRelativePosition.Primary =
78                 static_cast< double >( aAnchor.X()) /
79                 static_cast< double >( aPageRect.getWidth() );
80             aRelativePosition.Secondary =
81                 static_cast< double >( aAnchor.Y()) /
82                 static_cast< double >( aPageRect.getHeight());
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 54 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
48         {
49             //@todo decide whether x is primary or secondary
50             chart2::RelativePosition aRelativePosition;
51             aRelativePosition.Anchor = drawing::Alignment_CENTER;
52             //the anchor point at the title object is top/middle
53             Point aPos = aObjectRect.TopLeft();
    CID 1451627:    (DIVIDE_BY_ZERO)
    In expression "((double)aPos.X() + (double)aObjectRect.getWidth() / 2.) / 
(double)aPageRect.getWidth()", division by expression "aPageRect.getWidth()" which may be zero 
has undefined behavior.
54             aRelativePosition.Primary = 
(double(aPos.X())+double(aObjectRect.getWidth())/2.0)/double(aPageRect.getWidth());
55             aRelativePosition.Secondary = 
(double(aPos.Y())+double(aObjectRect.getHeight())/2.0)/double(aPageRect.getHeight());
56             xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
57         }
58         else if( eObjectType==OBJECTTYPE_DATA_CURVE_EQUATION )
59         {
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 65 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
59         {
60             //@todo decide whether x is primary or secondary
61             chart2::RelativePosition aRelativePosition;
62             aRelativePosition.Anchor = drawing::Alignment_TOP_LEFT;
63             //the anchor point at the title object is top/middle
64             Point aPos = aObjectRect.TopLeft();
    CID 1451627:    (DIVIDE_BY_ZERO)
    In expression "(double)aPos.X() / (double)aPageRect.getWidth()", division by expression 
"aPageRect.getWidth()" which may be zero has undefined behavior.
65             aRelativePosition.Primary = double(aPos.X())/double(aPageRect.getWidth());
66             aRelativePosition.Secondary = double(aPos.Y())/double(aPageRect.getHeight());
67             xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
68         }
69         else if(eObjectType==OBJECTTYPE_LEGEND)
70         {
/chart2/source/controller/main/PositionAndSizeHelper.cxx: 108 in 
chart::PositionAndSizeHelper::moveObject(chart::ObjectType, const 
com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> &, const 
com::sun::star::awt::Rectangle &, const com::sun::star::awt::Rectangle &)()
102     
103             //set position:
104             chart2::RelativePosition aRelativePosition;
105             aRelativePosition.Anchor = drawing::Alignment_CENTER;
106     
107             Point aPos = aObjectRect.Center();
    CID 1451627:    (DIVIDE_BY_ZERO)
    In expression "(double)aPos.X() / (double)aPageRect.getWidth()", division by expression 
"aPageRect.getWidth()" which may be zero has undefined behavior.
108             aRelativePosition.Primary = double(aPos.X())/double(aPageRect.getWidth());
109             aRelativePosition.Secondary = double(aPos.Y())/double(aPageRect.getHeight());
110             xObjectProp->setPropertyValue( "RelativePosition", uno::Any(aRelativePosition) );
111     
112             //set size:
113             RelativeSize aRelativeSize;

** CID 1451626:    (UNCAUGHT_EXCEPT)
/sw/source/core/layout/atrfrm.cxx: 3293 in SwHandleAnchorNodeChg::~SwHandleAnchorNodeChg()()
/sw/source/core/layout/atrfrm.cxx: 3293 in SwHandleAnchorNodeChg::~SwHandleAnchorNodeChg()()


________________________________________________________________________________________________________
*** CID 1451626:    (UNCAUGHT_EXCEPT)
/sw/source/core/layout/atrfrm.cxx: 3293 in SwHandleAnchorNodeChg::~SwHandleAnchorNodeChg()()
3287         {
3288             SwViewShell* pViewShell = _pKeepThisFlyFrame->getRootFrame()->GetCurrShell();
3289             mpWrtShell = dynamic_cast<SwWrtShell*>(pViewShell);
3290         }
3291     }
3292     
    CID 1451626:    (UNCAUGHT_EXCEPT)
    An exception of type "com::sun::star::uno::DeploymentException" is thrown but the throw 
list "noexcept" doesn't allow it to be thrown. This will cause a call to unexpected() which 
usually calls terminate().
3293     SwHandleAnchorNodeChg::~SwHandleAnchorNodeChg()
3294     {
3295         if ( mbAnchorNodeChanged )
3296         {
3297             mrFlyFrameFormat.MakeFrames();
3298         }
/sw/source/core/layout/atrfrm.cxx: 3293 in SwHandleAnchorNodeChg::~SwHandleAnchorNodeChg()()
3287         {
3288             SwViewShell* pViewShell = _pKeepThisFlyFrame->getRootFrame()->GetCurrShell();
3289             mpWrtShell = dynamic_cast<SwWrtShell*>(pViewShell);
3290         }
3291     }
3292     
    CID 1451626:    (UNCAUGHT_EXCEPT)
    An exception of type "com::sun::star::uno::DeploymentException" is thrown but the throw 
list "noexcept" doesn't allow it to be thrown. This will cause a call to unexpected() which 
usually calls terminate().
3293     SwHandleAnchorNodeChg::~SwHandleAnchorNodeChg()
3294     {
3295         if ( mbAnchorNodeChanged )
3296         {
3297             mrFlyFrameFormat.MakeFrames();
3298         }

** CID 1451625:  Null pointer dereferences  (FORWARD_NULL)
/sw/source/filter/ww8/docxattributeoutput.cxx: 1936 in DocxAttributeOutput::StartField_Impl(const 
SwTextNode *, int, const FieldInfos &, bool)()


________________________________________________________________________________________________________
*** CID 1451625:  Null pointer dereferences  (FORWARD_NULL)
/sw/source/filter/ww8/docxattributeoutput.cxx: 1936 in DocxAttributeOutput::StartField_Impl(const 
SwTextNode *, int, const FieldInfos &, bool)()
1930             if(!sCurrentDate.isEmpty())
1931             {
1932                 sFullDate = sCurrentDate + "T00:00:00Z";
1933             }
1934             else
1935             {
    CID 1451625:  Null pointer dereferences  (FORWARD_NULL)
    Passing null pointer "pFieldmark" to "GetCurrentDate", which dereferences it. (The 
dereference happens because this is a virtual function call.)
1936                 std::pair<bool, double> aResult = pFieldmark->GetCurrentDate();
1937                 if(aResult.first)
1938                 {
1939                     sFullDate = pFieldmark->GetDateInStandardDateFormat(aResult.second) + 
"T00:00:00Z";
1940                 }
1941             }

** CID 1424266:  Error handling issues  (UNCAUGHT_EXCEPT)
/usr/include/c++/8/bits/unique_ptr.h: 270 in 
std::unique_ptr<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext, 
std::default_delete<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext>>::~unique_ptr()()


________________________________________________________________________________________________________
*** CID 1424266:  Error handling issues  (UNCAUGHT_EXCEPT)
/usr/include/c++/8/bits/unique_ptr.h: 270 in 
std::unique_ptr<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext, 
std::default_delete<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext>>::~unique_ptr()()
264                    is_convertible<_Up*, _Tp*>, is_same<_Dp, default_delete<_Tp>>>>
265             unique_ptr(auto_ptr<_Up>&& __u) noexcept;
266     #pragma GCC diagnostic pop
267     #endif
268     
269           /// Destructor, invokes the deleter if the stored pointer is not null.
    CID 1424266:  Error handling issues  (UNCAUGHT_EXCEPT)
    An exception of type "std::bad_weak_ptr" is thrown but the throw list "noexcept" doesn't 
allow it to be thrown. This will cause a call to unexpected() which usually calls terminate().
270           ~unique_ptr() noexcept
271           {
272             auto& __ptr = _M_t._M_ptr();
273             if (__ptr != nullptr)
274               get_deleter()(__ptr);
275             __ptr = pointer();

** CID 1424263:  Error handling issues  (UNCAUGHT_EXCEPT)
/usr/include/c++/8/bits/unique_ptr.h: 377 in 
std::unique_ptr<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext, 
std::default_delete<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext>>::reset(sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext
 *)()


________________________________________________________________________________________________________
*** CID 1424263:  Error handling issues  (UNCAUGHT_EXCEPT)
/usr/include/c++/8/bits/unique_ptr.h: 377 in 
std::unique_ptr<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext, 
std::default_delete<sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext>>::reset(sd::slidesorter::controller::InsertionIndicatorHandler::ForceShowContext
 *)()
371            *
372            * @param __p  The new pointer to store.
373            *
374            * The deleter will be invoked if a pointer is already owned.
375            */
376           void
    CID 1424263:  Error handling issues  (UNCAUGHT_EXCEPT)
    An exception of type "std::bad_weak_ptr" is thrown but the throw list "noexcept" doesn't 
allow it to be thrown. This will cause a call to unexpected() which usually calls terminate().
377           reset(pointer __p = pointer()) noexcept
378           {
379             using std::swap;
380             swap(_M_t._M_ptr(), __p);
381             if (__p != pointer())
382               get_deleter()(__p);


________________________________________________________________________________________________________
To view the defects in Coverity Scan visit, 
https://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRZBnDJeNb0HijxaS4JNJPxk3kpyAm2AYqo71yXmnOxB73RtgzoPcQtNNP5dkHLuV1E-3D_g-2BrHdvqzaBa155F-2F8AmPhpJzY63UzWDisJV95WUBpGhqFw1ICExHG8aMaV2EoFpytTbOCofUyNuZQRI0eDeAdRCgPqu5DpWTM655rfs5CQwrGncXSn-2B5ueJXbaY-2BycpYrUIk8kL94p0feydPrgc0oOLLuMHsvzwg56DfD-2Fm4kz8ENew5w-2Fz6Xy2LDn7v8ITk-2B-2FcJ9DzOFtUvi05B97DzuEVER3pXltGNySi0KKNMn5k-3D


Context


Privacy Policy | Impressum (Legal Info) | Copyright information: Unless otherwise specified, all text and images on this website are licensed under the Creative Commons Attribution-Share Alike 3.0 License. This does not include the source code of LibreOffice, which is licensed under the Mozilla Public License (MPLv2). "LibreOffice" and "The Document Foundation" are registered trademarks of their corresponding registered owners or are in actual use as trademarks in one or more countries. Their respective logos and icons are also subject to international copyright laws. Use thereof is explained in our trademark policy.