Each file in this commit has a problem where it is possible to dereference

a pointer without that pointer being valid. This commit fixes each instance
of that.

6 files changed, 62 insertions, 29 deletions

diff --git a/core/multimedia/opieplayer/modplug/sndfile.cpp b/core/multimedia/opieplayer/modplug/sndfile.cpp
index 1d0d610..799555c 100644
--- a/core/multimedia/opieplayer/modplug/sndfile.cpp
+++ b/core/multimedia/opieplayer/modplug/sndfile.cpp
@@ -1694,97 +1694,100 @@ void CSoundFile::FrequencyToTranspose(MODINSTRUMENT *psmp)
         int ftune = f2t & 0x7F;
         if (ftune > 80)
         {
                 transp++;
                 ftune -= 128;
         }
         if (transp > 127) transp = 127;
         if (transp < -127) transp = -127;
         psmp->RelativeTone = transp;
         psmp->nFineTune = ftune;
 }
 
 
 void CSoundFile::CheckCPUUsage(UINT nCPU)
 //---------------------------------------
 {
         if (nCPU > 100) nCPU = 100;
         gnCPUUsage = nCPU;
         if (nCPU < 90)
         {
                 m_dwSongFlags &= ~SONG_CPUVERYHIGH;
         } else
         if ((m_dwSongFlags & SONG_CPUVERYHIGH) && (nCPU >= 94))
         {
                 UINT i=MAX_CHANNELS;
                 while (i >= 8)
                 {
                         i--;
                         if (Chn[i].nLength)
                         {
                                 Chn[i].nLength = Chn[i].nPos = 0;
                                 nCPU -= 2;
                                 if (nCPU < 94) break;
                         }
                 }
         } else
         if (nCPU > 90)
         {
                 m_dwSongFlags |= SONG_CPUVERYHIGH;
         }
 }
 
 
 BOOL CSoundFile::SetPatternName(UINT nPat, LPCSTR lpszName)
 //---------------------------------------------------------
 {
         char szName[MAX_PATTERNNAME] = "";   // changed from CHAR
         if (nPat >= MAX_PATTERNS) return FALSE;
-        if (lpszName) lstrcpyn(szName, lpszName, MAX_PATTERNNAME);
+        if (lpszName)
+                lstrcpyn(szName, lpszName, MAX_PATTERNNAME);
+        else
+                return FALSE;
         szName[MAX_PATTERNNAME-1] = 0;
         if (!m_lpszPatternNames) m_nPatternNames = 0;
         if (nPat >= m_nPatternNames)
         {
                 if (!lpszName[0]) return TRUE;
                 UINT len = (nPat+1)*MAX_PATTERNNAME;
                 char *p = new char[len];   // changed from CHAR
                 if (!p) return FALSE;
                 memset(p, 0, len);
                 if (m_lpszPatternNames)
                 {
                         memcpy(p, m_lpszPatternNames, m_nPatternNames * MAX_PATTERNNAME);
                         delete m_lpszPatternNames;
                         m_lpszPatternNames = NULL;
                 }
                 m_lpszPatternNames = p;
                 m_nPatternNames = nPat + 1;
         }
         memcpy(m_lpszPatternNames + nPat * MAX_PATTERNNAME, szName, MAX_PATTERNNAME);
         return TRUE;
 }
 
 
 BOOL CSoundFile::GetPatternName(UINT nPat, LPSTR lpszName, UINT cbSize) const
 //---------------------------------------------------------------------------
 {
         if ((!lpszName) || (!cbSize)) return FALSE;
         lpszName[0] = 0;
         if (cbSize > MAX_PATTERNNAME) cbSize = MAX_PATTERNNAME;
         if ((m_lpszPatternNames) && (nPat < m_nPatternNames))
         {
                 memcpy(lpszName, m_lpszPatternNames + nPat * MAX_PATTERNNAME, cbSize);
                 lpszName[cbSize-1] = 0;
                 return TRUE;
         }
         return FALSE;
 }
 
 
 #ifndef FASTSOUNDLIB
 
 UINT CSoundFile::DetectUnusedSamples(BOOL *pbIns)
 //-----------------------------------------------
 {
         UINT nExt = 0;
 
         if (!pbIns) return 0;
         if (m_nInstruments)
diff --git a/core/multimedia/opieplayer/vorbis/tremor/block.c b/core/multimedia/opieplayer/vorbis/tremor/block.c
index 8949253..7b5531b 100644
--- a/core/multimedia/opieplayer/vorbis/tremor/block.c
+++ b/core/multimedia/opieplayer/vorbis/tremor/block.c
@@ -181,98 +181,100 @@ static int _vds_init(vorbis_dsp_state *v,vorbis_info *vi){
   v->W=0;  /* current window size */
 
   /* initialize all the mapping/backend lookups */
   b->mode=(vorbis_look_mapping **)_ogg_calloc(ci->modes,sizeof(*b->mode));
   for(i=0;i<ci->modes;i++){
     int mapnum=ci->mode_param[i]->mapping;
     int maptype=ci->map_type[mapnum];
     b->mode[i]=_mapping_P[maptype]->look(v,ci->mode_param[i],
                                          ci->map_param[mapnum]);
   }
   return(0);
 }
 
 int vorbis_synthesis_restart(vorbis_dsp_state *v){
   vorbis_info *vi=v->vi;
   codec_setup_info *ci;
 
   if(!v->backend_state)return -1;
   if(!vi)return -1;
   ci=vi->codec_setup;
   if(!ci)return -1;
 
   v->centerW=ci->blocksizes[1]/2;
   v->pcm_current=v->centerW;
   
   v->pcm_returned=-1;
   v->granulepos=-1;
   v->sequence=-1;
   ((private_state *)(v->backend_state))->sample_count=-1;
 
   return(0);
 }
 
 int vorbis_synthesis_init(vorbis_dsp_state *v,vorbis_info *vi){
   _vds_init(v,vi);
   vorbis_synthesis_restart(v);
 
   return(0);
 }
 
 void vorbis_dsp_clear(vorbis_dsp_state *v){
   int i;
   if(v){
     vorbis_info *vi=v->vi;
     codec_setup_info *ci=(codec_setup_info *)(vi?vi->codec_setup:NULL);
     private_state *b=(private_state *)v->backend_state;
 
     if(v->pcm){
-      for(i=0;i<vi->channels;i++)
-        if(v->pcm[i])_ogg_free(v->pcm[i]);
+      if (vi) {
+        for(i=0;i<vi->channels;i++)
+          if(v->pcm[i])_ogg_free(v->pcm[i]);
+      }
       _ogg_free(v->pcm);
       if(v->pcmret)_ogg_free(v->pcmret);
     }
 
     /* free mode lookups; these are actually vorbis_look_mapping structs */
     if(ci){
       for(i=0;i<ci->modes;i++){
         int mapnum=ci->mode_param[i]->mapping;
         int maptype=ci->map_type[mapnum];
         if(b && b->mode)_mapping_P[maptype]->free_look(b->mode[i]);
       }
     }
 
     if(b){
       if(b->mode)_ogg_free(b->mode);    
       _ogg_free(b);
     }
     
     memset(v,0,sizeof(*v));
   }
 }
 
 /* Unlike in analysis, the window is only partially applied for each
    block.  The time domain envelope is not yet handled at the point of
    calling (as it relies on the previous block). */
 
 int vorbis_synthesis_blockin(vorbis_dsp_state *v,vorbis_block *vb){
   vorbis_info *vi=v->vi;
   codec_setup_info *ci=(codec_setup_info *)vi->codec_setup;
   private_state *b=v->backend_state;
   int i,j;
 
   if(v->pcm_current>v->pcm_returned  && v->pcm_returned!=-1)return(OV_EINVAL);
 
   v->lW=v->W;
   v->W=vb->W;
   v->nW=-1;
 
   if((v->sequence==-1)||
      (v->sequence+1 != vb->sequence)){
     v->granulepos=-1; /* out of sequence; lose count */
     b->sample_count=-1;
   }
 
   v->sequence=vb->sequence;
   
   if(vb->pcm){  /* no pcm to process if vorbis_synthesis_trackonly 
                    was called on block */
diff --git a/core/multimedia/opieplayer/vorbis/tremor/info.c b/core/multimedia/opieplayer/vorbis/tremor/info.c
index 941695e..3499ae4 100644
--- a/core/multimedia/opieplayer/vorbis/tremor/info.c
+++ b/core/multimedia/opieplayer/vorbis/tremor/info.c
@@ -52,98 +52,98 @@ static int tagcompare(const char *s1, const char *s2, int n){
   }
   return 0;
 }
 
 char *vorbis_comment_query(vorbis_comment *vc, char *tag, int count){
   long i;
   int found = 0;
   int taglen = strlen(tag)+1; /* +1 for the = we append */
   char *fulltag = (char *)alloca(taglen+ 1);
 
   strcpy(fulltag, tag);
   strcat(fulltag, "=");
   
   for(i=0;i<vc->comments;i++){
     if(!tagcompare(vc->user_comments[i], fulltag, taglen)){
       if(count == found)
         /* We return a pointer to the data, not a copy */
               return vc->user_comments[i] + taglen;
       else
         found++;
     }
   }
   return NULL; /* didn't find anything */
 }
 
 int vorbis_comment_query_count(vorbis_comment *vc, char *tag){
   int i,count=0;
   int taglen = strlen(tag)+1; /* +1 for the = we append */
   char *fulltag = (char *)alloca(taglen+1);
   strcpy(fulltag,tag);
   strcat(fulltag, "=");
 
   for(i=0;i<vc->comments;i++){
     if(!tagcompare(vc->user_comments[i], fulltag, taglen))
       count++;
   }
 
   return count;
 }
 
 void vorbis_comment_clear(vorbis_comment *vc){
   if(vc){
     long i;
     for(i=0;i<vc->comments;i++)
       if(vc->user_comments[i])_ogg_free(vc->user_comments[i]);
     if(vc->user_comments)_ogg_free(vc->user_comments);
         if(vc->comment_lengths)_ogg_free(vc->comment_lengths);
     if(vc->vendor)_ogg_free(vc->vendor);
+    memset(vc,0,sizeof(*vc));
   }
-  memset(vc,0,sizeof(*vc));
 }
 
 /* blocksize 0 is guaranteed to be short, 1 is guarantted to be long.
    They may be equal, but short will never ge greater than long */
 int vorbis_info_blocksize(vorbis_info *vi,int zo){
   codec_setup_info *ci = (codec_setup_info *)vi->codec_setup;
   return ci ? ci->blocksizes[zo] : -1;
 }
 
 /* used by synthesis, which has a full, alloced vi */
 void vorbis_info_init(vorbis_info *vi){
   memset(vi,0,sizeof(*vi));
   vi->codec_setup=(codec_setup_info *)_ogg_calloc(1,sizeof(codec_setup_info));
 }
 
 void vorbis_info_clear(vorbis_info *vi){
   codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
   int i;
 
   if(ci){
 
     for(i=0;i<ci->modes;i++)
       if(ci->mode_param[i])_ogg_free(ci->mode_param[i]);
 
     for(i=0;i<ci->maps;i++) /* unpack does the range checking */
       _mapping_P[ci->map_type[i]]->free_info(ci->map_param[i]);
 
     for(i=0;i<ci->floors;i++) /* unpack does the range checking */
       _floor_P[ci->floor_type[i]]->free_info(ci->floor_param[i]);
     
     for(i=0;i<ci->residues;i++) /* unpack does the range checking */
       _residue_P[ci->residue_type[i]]->free_info(ci->residue_param[i]);
 
     for(i=0;i<ci->books;i++){
       if(ci->book_param[i]){
         /* knows if the book was not alloced */
         vorbis_staticbook_destroy(ci->book_param[i]);
       }
       if(ci->fullbooks)
         vorbis_book_clear(ci->fullbooks+i);
     }
     if(ci->fullbooks)
         _ogg_free(ci->fullbooks);
     
     _ogg_free(ci);
   }
 
   memset(vi,0,sizeof(*vi));
diff --git a/noncore/apps/opie-write/qrichtext.cpp b/noncore/apps/opie-write/qrichtext.cpp
index f040f1e..768da44 100644
--- a/noncore/apps/opie-write/qrichtext.cpp
+++ b/noncore/apps/opie-write/qrichtext.cpp
@@ -144,140 +144,149 @@ QTextCursor *QTextCommandHistory::redo( QTextCursor *c )
         }
     }
     return 0;
 }
 
 bool QTextCommandHistory::isUndoAvailable()
 {
     return current > -1;
 }
 
 bool QTextCommandHistory::isRedoAvailable()
 {
    return current > -1 && current < (int)history.count() - 1 || current == -1 && history.count() > 0;
 }
 
 // +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 
 QTextDeleteCommand::QTextDeleteCommand( QTextDocument *d, int i, int idx, const QMemArray<QTextStringChar> &str,
                                         const QByteArray& oldStyleInfo )
     : QTextCommand( d ), id( i ), index( idx ), parag( 0 ), text( str ), styleInformation( oldStyleInfo )
 {
     for ( int j = 0; j < (int)text.size(); ++j ) {
         if ( text[ j ].format() )
             text[ j ].format()->addRef();
     }
 }
 
 QTextDeleteCommand::QTextDeleteCommand( QTextParagraph *p, int idx, const QMemArray<QTextStringChar> &str )
     : QTextCommand( 0 ), id( -1 ), index( idx ), parag( p ), text( str )
 {
     for ( int i = 0; i < (int)text.size(); ++i ) {
         if ( text[ i ].format() )
             text[ i ].format()->addRef();
     }
 }
 
 QTextDeleteCommand::~QTextDeleteCommand()
 {
     for ( int i = 0; i < (int)text.size(); ++i ) {
         if ( text[ i ].format() )
             text[ i ].format()->removeRef();
     }
     text.resize( 0 );
 }
 
 QTextCursor *QTextDeleteCommand::execute( QTextCursor *c )
 {
     QTextParagraph *s = doc ? doc->paragAt( id ) : parag;
-    if ( !s ) {
+    if ( !s && doc ) {
         owarn << "can't locate parag at " << id << ", last parag: " << doc->lastParagraph()->paragId() << "" << oendl; 
         return 0;
+    } else if ( !doc ) {
+        owarn << "No valid doc" << oendl;
+        return 0;
     }
 
     cursor.setParagraph( s );
     cursor.setIndex( index );
     int len = text.size();
     if ( c )
         *c = cursor;
     if ( doc ) {
         doc->setSelectionStart( QTextDocument::Temp, cursor );
         for ( int i = 0; i < len; ++i )
             cursor.gotoNextLetter();
         doc->setSelectionEnd( QTextDocument::Temp, cursor );
         doc->removeSelectedText( QTextDocument::Temp, &cursor );
         if ( c )
             *c = cursor;
     } else {
         s->remove( index, len );
     }
 
     return c;
 }
 
 QTextCursor *QTextDeleteCommand::unexecute( QTextCursor *c )
 {
     QTextParagraph *s = doc ? doc->paragAt( id ) : parag;
-    if ( !s ) {
+    if ( !s && doc ) {
         owarn << "can't locate parag at " << id << ", last parag: " << doc->lastParagraph()->paragId() << "" << oendl; 
         return 0;
+    } else if ( !doc ) {
+        owarn << "No valid doc" << oendl;
+        return 0;
     }
 
     cursor.setParagraph( s );
     cursor.setIndex( index );
     QString str = QTextString::toString( text );
     cursor.insert( str, TRUE, &text );
     cursor.setParagraph( s );
     cursor.setIndex( index );
     if ( c ) {
         c->setParagraph( s );
         c->setIndex( index );
         for ( int i = 0; i < (int)text.size(); ++i )
             c->gotoNextLetter();
+    } else {
+        owarn << "No valid cursor" << oendl;
+        return 0;
     }
 
     if ( !styleInformation.isEmpty() ) {
         QDataStream styleStream( styleInformation, IO_ReadOnly );
         int num;
         styleStream >> num;
         QTextParagraph *p = s;
         while ( num-- && p ) {
             p->readStyleInformation( styleStream );
             p = p->next();
         }
     }
     s = cursor.paragraph();
     while ( s ) {
         s->format();
         s->setChanged( TRUE );
         if ( s == c->paragraph() )
             break;
         s = s->next();
     }
 
     return &cursor;
 }
 
 QTextFormatCommand::QTextFormatCommand( QTextDocument *d, int sid, int sidx, int eid, int eidx,
                                         const QMemArray<QTextStringChar> &old, QTextFormat *f, int fl )
     : QTextCommand( d ), startId( sid ), startIndex( sidx ), endId( eid ), endIndex( eidx ), format( f ), oldFormats( old ), flags( fl )
 {
     format = d->formatCollection()->format( f );
     for ( int j = 0; j < (int)oldFormats.size(); ++j ) {
         if ( oldFormats[ j ].format() )
             oldFormats[ j ].format()->addRef();
     }
 }
 
 QTextFormatCommand::~QTextFormatCommand()
 {
     format->removeRef();
     for ( int j = 0; j < (int)oldFormats.size(); ++j ) {
         if ( oldFormats[ j ].format() )
             oldFormats[ j ].format()->removeRef();
     }
 }
 
 QTextCursor *QTextFormatCommand::execute( QTextCursor *c )
 {
     QTextParagraph *sp = doc->paragAt( startId );
     QTextParagraph *ep = doc->paragAt( endId );
@@ -1347,114 +1356,125 @@ void QTextDocument::setPlainText( const QString &text )
     }
     if ( !lParag )
         lParag = fParag = createParagraph( this, 0, 0 );
 }
 
 struct Q_EXPORT QTextDocumentTag {
     QTextDocumentTag(){}
     QTextDocumentTag( const QString&n, const QStyleSheetItem* s, const QTextFormat& f )
         :name(n),style(s), format(f), alignment(Qt3::AlignAuto), direction(QChar::DirON),liststyle(QStyleSheetItem::ListDisc) {
             wsm = QStyleSheetItem::WhiteSpaceNormal;
     }
     QString name;
     const QStyleSheetItem* style;
     QString anchorHref;
     QStyleSheetItem::WhiteSpaceMode wsm;
     QTextFormat format;
     int alignment : 16;
     int direction : 5;
     QStyleSheetItem::ListStyle liststyle;
 
     QTextDocumentTag(  const QTextDocumentTag& t ) {
         name = t.name;
         style = t.style;
         anchorHref = t.anchorHref;
         wsm = t.wsm;
         format = t.format;
         alignment = t.alignment;
         direction = t.direction;
         liststyle = t.liststyle;
     }
     QTextDocumentTag& operator=(const QTextDocumentTag& t) {
         name = t.name;
         style = t.style;
         anchorHref = t.anchorHref;
         wsm = t.wsm;
         format = t.format;
         alignment = t.alignment;
         direction = t.direction;
         liststyle = t.liststyle;
         return *this;
     }
 
 #if defined(Q_FULL_TEMPLATE_INSTANTIATION)
     bool operator==( const QTextDocumentTag& ) const { return FALSE; }
 #endif
 };
 
 
-#define NEWPAR       do{ if ( !hasNewPar) { \
-                    if ( !textEditMode && curpar && curpar->length()>1 && curpar->at( curpar->length()-2)->c == QChar_linesep ) \
-                        curpar->remove( curpar->length()-2, 1 ); \
-                    curpar = createParagraph( this, curpar, curpar->next() ); styles.append( vec ); vec = 0;} \
-                    hasNewPar = TRUE; \
-                    curpar->rtext = TRUE;  \
-                    curpar->align = curtag.alignment; \
-                    curpar->lstyle = curtag.liststyle; \
-                    curpar->litem = ( curtag.style->displayMode() == QStyleSheetItem::DisplayListItem ); \
-                    curpar->str->setDirection( (QChar::Direction)curtag.direction ); \
-                    space = TRUE; \
-                    delete vec; vec = new QPtrVector<QStyleSheetItem>( (uint)tags.count() + 1); \
-                    int i = 0; \
-                    for ( QValueStack<QTextDocumentTag>::Iterator it = tags.begin(); it != tags.end(); ++it ) \
-                        vec->insert( i++, (*it).style ); \
-                    vec->insert( i, curtag.style ); \
-                    }while(FALSE)
-
+#define NEWPAR do { \
+                   if ( !hasNewPar) { \
+                       if ( !curpar ) { \
+                           owarn << "no current paragraph" << oendl; \
+                           return; \
+                       } \
+                       if ( !textEditMode && curpar && curpar->length()>1 && curpar->at( curpar->length()-2)->c == QChar_linesep ) \
+                           curpar->remove( curpar->length()-2, 1 ); \
+                       curpar = createParagraph( this, curpar, curpar->next() ); styles.append( vec ); \
+                       if ( !curpar ) { \
+                           owarn << "failed in creating a new paragraph" << oendl; \
+                           return; \
+                       } \
+                       vec = 0; \
+                   } \
+                   hasNewPar = TRUE; \
+                   curpar->rtext = TRUE;  \
+                   curpar->align = curtag.alignment; \
+                   curpar->lstyle = curtag.liststyle; \
+                   curpar->litem = ( curtag.style->displayMode() == QStyleSheetItem::DisplayListItem ); \
+                   curpar->str->setDirection( (QChar::Direction)curtag.direction ); \
+                   space = TRUE; \
+                   delete vec; \
+                   vec = new QPtrVector<QStyleSheetItem>( (uint)tags.count() + 1); \
+                   int i = 0; \
+                   for ( QValueStack<QTextDocumentTag>::Iterator it = tags.begin(); it != tags.end(); ++it ) \
+                       vec->insert( i++, (*it).style ); \
+                   vec->insert( i, curtag.style ); \
+               } while ( FALSE )
 
 void QTextDocument::setRichText( const QString &text, const QString &context )
 {
     if ( !context.isEmpty() )
         setContext( context );
     clear();
     fParag = lParag = createParagraph( this );
     oTextValid = TRUE;
     oText = text;
     setRichTextInternal( text );
     fParag->rtext = TRUE;
 }
 
 void QTextDocument::setRichTextInternal( const QString &text, QTextCursor* cursor )
 {
     QTextParagraph* curpar = lParag;
     int pos = 0;
     QValueStack<QTextDocumentTag> tags;
     QTextDocumentTag initag( "", sheet_->item(""), *formatCollection()->defaultFormat() );
     QTextDocumentTag curtag = initag;
     bool space = TRUE;
     bool canMergeLi = FALSE;
 
     bool textEditMode = FALSE;
 
     const QChar* doc = text.unicode();
     int length = text.length();
     bool hasNewPar = curpar->length() <= 1;
     QString anchorName;
 
     // style sheet handling for margin and line spacing calculation below
     QTextParagraph* stylesPar = curpar;
     QPtrVector<QStyleSheetItem>* vec = 0;
     QPtrList< QPtrVector<QStyleSheetItem> > styles;
     styles.setAutoDelete( TRUE );
 
     if ( cursor ) {
         cursor->splitAndInsertEmptyParagraph();
         QTextCursor tmp = *cursor;
         tmp.gotoPreviousLetter();
         stylesPar = curpar = tmp.paragraph();
         hasNewPar = TRUE;
         textEditMode = TRUE;
     } else {
         NEWPAR;
     }
 
     // set rtext spacing to FALSE for the initial paragraph.
@@ -1850,98 +1870,101 @@ void QTextDocument::setRichTextInternal( const QString &text, QTextCursor* curso
                 f->ref += s.length() -1; // that what friends are for...
                 if ( !curtag.anchorHref.isEmpty() ) {
                     for ( int i = 0; i < int(s.length()); i++ )
                         curpar->at(index + i)->setAnchor( QString::null, curtag.anchorHref );
                 }
                 if ( !anchorName.isEmpty()  ) {
                     curpar->at(index)->setAnchor( anchorName, curpar->at(index)->anchorHref() );
                     anchorName = QString::null;
                 }
             }
         }
     }
     if ( hasNewPar && curpar != fParag && !cursor ) {
         // cleanup unused last paragraphs
         curpar = curpar->p;
         delete curpar->n;
     }
     if ( !anchorName.isEmpty()  ) {
         curpar->at(curpar->length() - 1)->setAnchor( anchorName, curpar->at( curpar->length() - 1 )->anchorHref() );
         anchorName = QString::null;
     }
 
 
     setRichTextMarginsInternal( styles, stylesPar );
 
     if ( cursor ) {
          cursor->gotoPreviousLetter();
           cursor->remove();
      }
 
 }
 
 void QTextDocument::setRichTextMarginsInternal( QPtrList< QPtrVector<QStyleSheetItem> >& styles, QTextParagraph* stylesPar )
 {
     // margin and line spacing calculation
     QPtrVector<QStyleSheetItem>* prevStyle = 0;
     QPtrVector<QStyleSheetItem>* curStyle = styles.first();
     QPtrVector<QStyleSheetItem>* nextStyle = styles.next();
     while ( stylesPar ) {
         if ( !curStyle ) {
             stylesPar = stylesPar->next();
             prevStyle = curStyle;
             curStyle = nextStyle;
             nextStyle = styles.next();
             continue;
         }
 
         int i, mar;
-        QStyleSheetItem* mainStyle = curStyle->size() ? (*curStyle)[curStyle->size()-1] : 0;
-        if ( mainStyle && mainStyle->displayMode() == QStyleSheetItem::DisplayListItem )
+        QStyleSheetItem* mainStyle = (*curStyle)[curStyle->size()-1];
+        if ( !mainStyle )
+            return;
+
+        if ( mainStyle->displayMode() == QStyleSheetItem::DisplayListItem )
             stylesPar->setListItem( TRUE );
         int numLists = 0;
         for ( i = 0; i < (int)curStyle->size(); ++i ) {
             if ( (*curStyle)[ i ]->displayMode() == QStyleSheetItem::DisplayBlock
                  && int((*curStyle)[ i ]->listStyle()) != QStyleSheetItem::Undefined )
                 numLists++;
         }
         stylesPar->ldepth = numLists;
         if ( stylesPar->next() && nextStyle ) {
             // also set the depth of the next paragraph, required for the margin calculation
             numLists = 0;
             for ( i = 0; i < (int)nextStyle->size(); ++i ) {
                 if ( (*nextStyle)[ i ]->displayMode() == QStyleSheetItem::DisplayBlock
                      && int((*nextStyle)[ i ]->listStyle()) != QStyleSheetItem::Undefined )
                     numLists++;
             }
             stylesPar->next()->ldepth = numLists;
         }
 
         // do the top margin
         QStyleSheetItem* item = mainStyle;
         int m;
         if (stylesPar->utm > 0 ) {
             m = stylesPar->utm-1;
             stylesPar->utm = 0;
         } else {
             m = QMAX(0, item->margin( QStyleSheetItem::MarginTop ) );
             if ( item->displayMode() == QStyleSheetItem::DisplayListItem
                  && stylesPar->ldepth )
               m /= stylesPar->ldepth;
         }
         for ( i = (int)curStyle->size() - 2 ; i >= 0; --i ) {
             item = (*curStyle)[ i ];
             if ( prevStyle && i < (int) prevStyle->size() &&
                  (  item->displayMode() == QStyleSheetItem::DisplayBlock &&
                     (*prevStyle)[ i ] == item ) )
                 break;
             // emulate CSS2' standard 0 vertical margin for multiple ul or ol tags
              if ( int(item->listStyle()) != QStyleSheetItem::Undefined  &&
                  ( (  i> 0 && (*curStyle)[ i-1 ] == item ) || (*curStyle)[i+1] == item ) )
                 continue;
             mar = QMAX( 0, item->margin( QStyleSheetItem::MarginTop ) );
             m = QMAX( m, mar );
         }
         stylesPar->utm = m - stylesPar->topMargin();
 
         // do the bottom margin
         item = mainStyle;
@@ -5296,97 +5319,97 @@ int QTextFormatterBreakWords::format( QTextDocument *doc, QTextParagraph *parag,
     QTextStringChar *firstChar = 0;
     QTextString *string = parag->string();
     int left = doc ? parag->leftMargin() + doc->leftMargin() : 0;
     int x = left + ( doc ? parag->firstLineMargin() : 0 );
     int y = parag->prev() ? QMAX(parag->prev()->bottomMargin(),parag->topMargin()) / 2: 0;
     int h = y;
     int len = parag->length();
     if ( doc )
         x = doc->flow()->adjustLMargin( y + parag->rect().y(), parag->rect().height(), x, 0 );
     int dw = parag->documentVisibleWidth() - ( doc ? ( left != x ? 0 : doc->rightMargin() ) : 0 );
 
     int curLeft = x;
     int rm = parag->rightMargin();
     int rdiff = doc ? doc->flow()->adjustRMargin( y + parag->rect().y(), parag->rect().height(), rm, 0 ) : 0;
     int w = dw - rdiff;
     bool fullWidth = TRUE;
     int marg = left + rdiff;
     int minw = 0;
     int wused = 0;
     int tminw = marg;
     int linespacing = doc ? parag->lineSpacing() : 0;
     bool wrapEnabled = isWrapEnabled( parag );
 
     start = 0;
     if ( start == 0 )
         c = &parag->string()->at( 0 );
 
     int i = start;
     QTextLineStart *lineStart = new QTextLineStart( y, y, 0 );
     insertLineStart( parag, 0, lineStart );
     int lastBreak = -1;
     int tmpBaseLine = 0, tmph = 0;
     bool lastWasNonInlineCustom = FALSE;
 
     int align = parag->alignment();
     if ( align == Qt3::AlignAuto && doc && doc->alignment() != Qt3::AlignAuto )
         align = doc->alignment();
 
     align &= Qt3::AlignHorizontal_Mask;
 
     QPainter *painter = QTextFormat::painter();
     int col = 0;
     int ww = 0;
     QChar lastChr;
     for ( ; i < len; ++i, ++col ) {
         if ( c )
             lastChr = c->c;
         // ### next line should not be needed
-        if ( painter )
+        if ( c && painter )
             c->format()->setPainter( painter );
         c = &string->at( i );
         c->rightToLeft = FALSE;
         if ( i > 0 && (x > curLeft || ww == 0) || lastWasNonInlineCustom ) {
             c->lineStart = 0;
         } else {
             c->lineStart = 1;
             firstChar = c;
         }
 
         if ( c->isCustom() && c->customItem()->placement() != QTextCustomItem::PlaceInline )
             lastWasNonInlineCustom = TRUE;
         else
             lastWasNonInlineCustom = FALSE;
 
         if ( c->c.unicode() >= 32 || c->isCustom() ) {
             ww = string->width( i );
         } else if ( c->c == '\t' ) {
             int nx = parag->nextTab( i, x - left ) + left;
             if ( nx < x )
                 ww = w - x;
             else
                 ww = nx - x;
         } else {
             ww = c->format()->width( ' ' );
         }
 
         // last character ("invisible" space) has no width
         if ( i == len - 1 )
             ww = 0;
 
         QTextCustomItem* ci = c->customItem();
         if ( c->isCustom() && ci->ownLine() ) {
             x = doc ? doc->flow()->adjustLMargin( y + parag->rect().y(), parag->rect().height(), left, 4 ) : left;
             w = dw - ( doc ? doc->flow()->adjustRMargin( y + parag->rect().y(), parag->rect().height(), rm, 4 ) : 0 );
             QTextLineStart *lineStart2 = formatLine( parag, string, lineStart, firstChar, c-1, align, SPACE(w - x) );
             ci->resize( w - x);
             if ( ci->width < w - x ) {
                 if ( align & Qt::AlignHCenter )
                     x = ( w - ci->width ) / 2;
                 else if ( align & Qt::AlignRight ) {
                     x = w - ci->width;
                 }
             }
             c->x = x;
             curLeft = x;
             if ( i == 0 || !isBreakable( string, i - 1 ) || string->at( i - 1 ).lineStart == 0 ) {
                 y += QMAX( h, QMAX( tmph, linespacing ) );
diff --git a/noncore/settings/networksettings2/opietooth2/OTSDPAttribute.cpp b/noncore/settings/networksettings2/opietooth2/OTSDPAttribute.cpp
index 9069c09..3fd877f 100644
--- a/noncore/settings/networksettings2/opietooth2/OTSDPAttribute.cpp
+++ b/noncore/settings/networksettings2/opietooth2/OTSDPAttribute.cpp
@@ -250,80 +250,83 @@ QString OTSDPAttribute::getURL() {
 
 const OTSDPAttribute::int128_t & OTSDPAttribute::getInt() {
     assert(type == INT);
     return *Value.intVal;
 }
 
 
 const OTSDPAttribute::uint128_t & OTSDPAttribute::getUInt() {
     assert(type == UINT);
     return *Value.uintVal;
 }
 
 const OTUUID & OTSDPAttribute::getUUID() {
     assert(type == UUID);
     return *Value.uuidVal;
 }
 
 bool OTSDPAttribute::getBool() {
     assert(type == BOOLEAN);
     return Value.boolVal;
 }
 
 AttributeVector * OTSDPAttribute::getSequence() {
     assert(type == SEQUENCE);
     return Value.sequenceVal;
 }
 
 AttributeVector * OTSDPAttribute::getAlternative() {
     assert(type == ALTERNATIVE);
     return Value.sequenceVal;
 }
 
 UUIDVector OTSDPAttribute::getAllUUIDs() {
 
     UUIDVector uuids;
 
     if (getType() == UUID) {
       uuids.resize( uuids.size()+1 );
       uuids[uuids.size()-1] = getUUID();
     } else {
       AttributeVector * subAttributes = 0 ;
 
       if (getType() == SEQUENCE) {
           subAttributes = getSequence();
       } else if (getType() == ALTERNATIVE) {
           subAttributes = getAlternative();
       }
 
+      if (!subAttributes)
+          return 0;
+
       int os;
       for( unsigned int i = 0; i < subAttributes->count(); i++ ) {
         UUIDVector subUUIDs = (*subAttributes)[i]->getAllUUIDs();
 
         os = uuids.size();
         uuids.resize( uuids.size()+subUUIDs.count() );
 
         for( unsigned int k = 0; k < subUUIDs.count(); k++ ) {
           uuids[os + k] = subUUIDs[k];
         }
       }
     }
     return uuids;
 }
 
 static char * Attr2String[] = {
         "Invalid",
         "Nil",
         "UInt",
         "int",
         "UUID",
         "Boolean",
         "String",
         "Sequence",
         "Alternative",
         "URL",
         "Unknown"
 };
 
 const char * OTSDPAttribute::getTypeString() {
     return Attr2String[type];
 }
diff --git a/noncore/settings/packagemanager/oipkgconfigdlg.cpp b/noncore/settings/packagemanager/oipkgconfigdlg.cpp
index d014378..78a18f7 100644
--- a/noncore/settings/packagemanager/oipkgconfigdlg.cpp
+++ b/noncore/settings/packagemanager/oipkgconfigdlg.cpp
@@ -391,111 +391,113 @@ void OIpkgConfigDlg::initData()
             {
                 OConfItem *config = configIt.current();
 
                 // Add configuration item to the appropriate dialog controls
                 if ( config )
                 {
                     switch ( config->type() )
                     {
                         case OConfItem::Source :  m_serverList->insertItem( config->name() ); break;
                         case OConfItem::Destination : m_destList->insertItem( config->name() ); break;
                         case OConfItem::Option :
                             {
                                 if ( config->name() == "http_proxy" )
                                 {
                                     m_proxyHttpServer->setText( config->value() );
                                     m_proxyHttpActive->setChecked( config->active() );
                                 }
                                 else if ( config->name() == "ftp_proxy" )
                                 {
                                     m_proxyFtpServer->setText( config->value() );
                                     m_proxyFtpActive->setChecked( config->active() );
                                 }
                                 else if ( config->name() == "proxy_username" )
                                 {
                                     m_proxyUsername->setText( config->value() );
                                 }
                                 else if ( config->name() == "proxy_password" )
                                 {
                                     m_proxyPassword->setText( config->value() );
                                 }
                             }
                             break;
                         case OConfItem::Other :
                             {
                                 if ( config->name() == "lists_dir" )
                                     m_optSourceLists->setText( config->value() );
                                 else // TODO - use proper libipkg define
                                     m_optSourceLists->setText( "/usr/lib/ipkg/lists" );
                             }
                             break;
                         default : break;
                     };
                 }
             }
         }
     }
 
     // Get Ipkg execution options
-    int options = m_ipkg->ipkgExecOptions();
+    int options = 0;
+    if ( m_ipkg )
+        options = m_ipkg->ipkgExecOptions();
     if ( options & FORCE_DEPENDS )
         m_optForceDepends->setChecked( true );
     if ( options & FORCE_REINSTALL )
         m_optForceReinstall->setChecked( true );
     if ( options & FORCE_REMOVE )
         m_optForceRemove->setChecked( true );
     if ( options & FORCE_OVERWRITE )
         m_optForceOverwrite->setChecked( true );
     if ( options & FORCE_RECURSIVE )
         m_optForceRecursive->setChecked( true );
     if ( options & FORCE_VERBOSE_WGET )
         m_optVerboseWget->setChecked( true );
 
-    m_optVerboseIpkg->setCurrentItem( m_ipkg->ipkgExecVerbosity() );
+    m_optVerboseIpkg->setCurrentItem( ( m_ipkg ? m_ipkg->ipkgExecVerbosity() : 0 ) );
 }
 
 void OIpkgConfigDlg::slotServerSelected( int index )
 {
     m_serverCurrent = index;
 
     // Enable Edit and Delete buttons
     m_serverEditBtn->setEnabled( true );
     m_serverDeleteBtn->setEnabled( true );
 }
 
 void OIpkgConfigDlg::slotServerNew()
 {
     OConfItem *server = new OConfItem( OConfItem::Source );
 
     OIpkgServerDlg dlg( server, this );
     if ( QPEApplication::execDialog( &dlg ) == QDialog::Accepted )
     {
         // Add to configuration option list
         m_configs->append( server );
         m_configs->sort();
 
         // Add to server list
         m_serverList->insertItem( server->name() );
         m_serverList->setCurrentItem( m_serverList->count() );
     }
     else
         delete server;
 }
 
 void OIpkgConfigDlg::slotServerEdit()
 {
     // Find selected server in list
     OConfItem *server = m_ipkg->findConfItem( OConfItem::Source, m_serverList->currentText() );
 
     // Edit server
     if ( server )
     {
         QString origName = server->name();
         OIpkgServerDlg dlg( server, this );
         if ( QPEApplication::execDialog( &dlg ) == QDialog::Accepted )
         {
             // Check to see if name has changed, if so update the server list
             if ( server->name() != origName )
                 m_serverList->changeItem( server->name(), m_serverCurrent );
         }
     }
 }