From c3e02879e2e879f01c5a654bb6e50994ca5abfd2 Mon Sep 17 00:00:00 2001
From: Bryce Harrington <bryce@bryceharrington.org>
Date: Sun, 14 Apr 2019 10:04:45 -0700
Subject: Fix nullptr deref after connector delete

When a connector has been deleted, its _connRef will be set to NULL.
Some logic should be bypassed in this case, other should check NULL
status as a pre-condition.

Fixes: https://gitlab.com/inkscape/inbox/issues/313
---
 src/object/sp-conn-end-pair.cpp | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/object/sp-conn-end-pair.cpp b/src/object/sp-conn-end-pair.cpp
index 899a4f12d..29aa87be7 100644
--- a/src/object/sp-conn-end-pair.cpp
+++ b/src/object/sp-conn-end-pair.cpp
@@ -257,6 +257,8 @@ bool SPConnEndPair::isAutoRoutingConn()
 
 void SPConnEndPair::makePathInvalid()
 {
+    g_assert(_connRef != nullptr);
+
     _connRef->makePathInvalid();
 }
 
@@ -265,6 +267,8 @@ void SPConnEndPair::makePathInvalid()
 // Straight or curved
 void recreateCurve(SPCurve *curve, Avoid::ConnRef *connRef, const gdouble curvature)
 {
+    g_assert(connRef != nullptr);
+
     bool straight = curvature<1e-3;
 
     Avoid::PolyLine route = connRef->displayRoute();
@@ -301,7 +305,7 @@ void recreateCurve(SPCurve *curve, Avoid::ConnRef *connRef, const gdouble curvat
 
 void SPConnEndPair::tellLibavoidNewEndpoints(bool const processTransaction)
 {
-    if (!isAutoRoutingConn()) {
+    if (_connRef == nullptr || !isAutoRoutingConn()) {
         // Do nothing
         return;
     }
@@ -317,7 +321,7 @@ void SPConnEndPair::tellLibavoidNewEndpoints(bool const processTransaction)
 
 bool SPConnEndPair::reroutePathFromLibavoid()
 {
-    if (!isAutoRoutingConn()) {
+    if (_connRef == nullptr || !isAutoRoutingConn()) {
         // Do nothing
         return false;
     }
-- 
cgit v1.2.3