From 049297f3e3e0d6b52eff81c489effc70e34be704 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Sat, 25 Aug 2018 19:08:35 +0100
Subject: ofz#10056 Null deref

Change-Id: I9ea0f272d0a8b13fb51fec55ac57adca47cafc77
Reviewed-on: https://gerrit.libreoffice.org/59601
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>
(cherry picked from commit 48c677d55330ac6caf0065fa1776c985b876eead)
---
 writerfilter/source/ooxml/OOXMLStreamImpl.cxx | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/writerfilter/source/ooxml/OOXMLStreamImpl.cxx b/writerfilter/source/ooxml/OOXMLStreamImpl.cxx
index 3d3a6a0b268e..3398c216093f 100644
--- a/writerfilter/source/ooxml/OOXMLStreamImpl.cxx
+++ b/writerfilter/source/ooxml/OOXMLStreamImpl.cxx
@@ -319,12 +319,20 @@ bool OOXMLStreamImpl::lcl_getTarget(const uno::Reference<embed::XRelationshipAcc
                     // simple string concatination here to handle that.
                     uno::Reference<uri::XUriReference> xPart = xFac->parse(sMyTarget);
                     uno::Reference<uri::XUriReference> xAbs = xFac->makeAbsolute(xBase, xPart, true, uri::RelativeUriExcessParentSegments_RETAIN);
-                    rDocumentTarget = xAbs->getPath();
-                    // path will start with the fragment separator. need to
-                    // remove that
-                    rDocumentTarget = rDocumentTarget.copy( 1 );
-                    if(sStreamType == sEmbeddingsType)
-                        embeddingsTarget = rDocumentTarget;
+                    if (!xAbs)
+                    {
+                        //it was invalid gibberish
+                        bFound = false;
+                    }
+                    else
+                    {
+                        rDocumentTarget = xAbs->getPath();
+                        // path will start with the fragment separator. need to
+                        // remove that
+                        rDocumentTarget = rDocumentTarget.copy( 1 );
+                        if(sStreamType == sEmbeddingsType)
+                            embeddingsTarget = rDocumentTarget;
+                    }
                 }
 
                 break;
-- 
cgit