Each file in this commit has a problem where it is possible to dereference

a pointer without that pointer being valid. This commit fixes each instance
of that.

1 files changed, 32 insertions, 9 deletions

diff --git a/noncore/apps/opie-write/qrichtext.cpp b/noncore/apps/opie-write/qrichtext.cpp
index f040f1e..768da44 100644
--- a/noncore/apps/opie-write/qrichtext.cpp
+++ b/noncore/apps/opie-write/qrichtext.cpp
@@ -144,140 +144,149 @@ QTextCursor *QTextCommandHistory::redo( QTextCursor *c )
         }
     }
     return 0;
 }
 
 bool QTextCommandHistory::isUndoAvailable()
 {
     return current > -1;
 }
 
 bool QTextCommandHistory::isRedoAvailable()
 {
    return current > -1 && current < (int)history.count() - 1 || current == -1 && history.count() > 0;
 }
 
 // +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 
 QTextDeleteCommand::QTextDeleteCommand( QTextDocument *d, int i, int idx, const QMemArray<QTextStringChar> &str,
                                         const QByteArray& oldStyleInfo )
     : QTextCommand( d ), id( i ), index( idx ), parag( 0 ), text( str ), styleInformation( oldStyleInfo )
 {
     for ( int j = 0; j < (int)text.size(); ++j ) {
         if ( text[ j ].format() )
             text[ j ].format()->addRef();
     }
 }
 
 QTextDeleteCommand::QTextDeleteCommand( QTextParagraph *p, int idx, const QMemArray<QTextStringChar> &str )
     : QTextCommand( 0 ), id( -1 ), index( idx ), parag( p ), text( str )
 {
     for ( int i = 0; i < (int)text.size(); ++i ) {
         if ( text[ i ].format() )
             text[ i ].format()->addRef();
     }
 }
 
 QTextDeleteCommand::~QTextDeleteCommand()
 {
     for ( int i = 0; i < (int)text.size(); ++i ) {
         if ( text[ i ].format() )
             text[ i ].format()->removeRef();
     }
     text.resize( 0 );
 }
 
 QTextCursor *QTextDeleteCommand::execute( QTextCursor *c )
 {
     QTextParagraph *s = doc ? doc->paragAt( id ) : parag;
-    if ( !s ) {
+    if ( !s && doc ) {
         owarn << "can't locate parag at " << id << ", last parag: " << doc->lastParagraph()->paragId() << "" << oendl; 
         return 0;
+    } else if ( !doc ) {
+        owarn << "No valid doc" << oendl;
+        return 0;
     }
 
     cursor.setParagraph( s );
     cursor.setIndex( index );
     int len = text.size();
     if ( c )
         *c = cursor;
     if ( doc ) {
         doc->setSelectionStart( QTextDocument::Temp, cursor );
         for ( int i = 0; i < len; ++i )
             cursor.gotoNextLetter();
         doc->setSelectionEnd( QTextDocument::Temp, cursor );
         doc->removeSelectedText( QTextDocument::Temp, &cursor );
         if ( c )
             *c = cursor;
     } else {
         s->remove( index, len );
     }
 
     return c;
 }
 
 QTextCursor *QTextDeleteCommand::unexecute( QTextCursor *c )
 {
     QTextParagraph *s = doc ? doc->paragAt( id ) : parag;
-    if ( !s ) {
+    if ( !s && doc ) {
         owarn << "can't locate parag at " << id << ", last parag: " << doc->lastParagraph()->paragId() << "" << oendl; 
         return 0;
+    } else if ( !doc ) {
+        owarn << "No valid doc" << oendl;
+        return 0;
     }
 
     cursor.setParagraph( s );
     cursor.setIndex( index );
     QString str = QTextString::toString( text );
     cursor.insert( str, TRUE, &text );
     cursor.setParagraph( s );
     cursor.setIndex( index );
     if ( c ) {
         c->setParagraph( s );
         c->setIndex( index );
         for ( int i = 0; i < (int)text.size(); ++i )
             c->gotoNextLetter();
+    } else {
+        owarn << "No valid cursor" << oendl;
+        return 0;
     }
 
     if ( !styleInformation.isEmpty() ) {
         QDataStream styleStream( styleInformation, IO_ReadOnly );
         int num;
         styleStream >> num;
         QTextParagraph *p = s;
         while ( num-- && p ) {
             p->readStyleInformation( styleStream );
             p = p->next();
         }
     }
     s = cursor.paragraph();
     while ( s ) {
         s->format();
         s->setChanged( TRUE );
         if ( s == c->paragraph() )
             break;
         s = s->next();
     }
 
     return &cursor;
 }
 
 QTextFormatCommand::QTextFormatCommand( QTextDocument *d, int sid, int sidx, int eid, int eidx,
                                         const QMemArray<QTextStringChar> &old, QTextFormat *f, int fl )
     : QTextCommand( d ), startId( sid ), startIndex( sidx ), endId( eid ), endIndex( eidx ), format( f ), oldFormats( old ), flags( fl )
 {
     format = d->formatCollection()->format( f );
     for ( int j = 0; j < (int)oldFormats.size(); ++j ) {
         if ( oldFormats[ j ].format() )
             oldFormats[ j ].format()->addRef();
     }
 }
 
 QTextFormatCommand::~QTextFormatCommand()
 {
     format->removeRef();
     for ( int j = 0; j < (int)oldFormats.size(); ++j ) {
         if ( oldFormats[ j ].format() )
             oldFormats[ j ].format()->removeRef();
     }
 }
 
 QTextCursor *QTextFormatCommand::execute( QTextCursor *c )
 {
     QTextParagraph *sp = doc->paragAt( startId );
     QTextParagraph *ep = doc->paragAt( endId );
@@ -1347,115 +1356,126 @@ void QTextDocument::setPlainText( const QString &text )
     }
     if ( !lParag )
         lParag = fParag = createParagraph( this, 0, 0 );
 }
 
 struct Q_EXPORT QTextDocumentTag {
     QTextDocumentTag(){}
     QTextDocumentTag( const QString&n, const QStyleSheetItem* s, const QTextFormat& f )
         :name(n),style(s), format(f), alignment(Qt3::AlignAuto), direction(QChar::DirON),liststyle(QStyleSheetItem::ListDisc) {
             wsm = QStyleSheetItem::WhiteSpaceNormal;
     }
     QString name;
     const QStyleSheetItem* style;
     QString anchorHref;
     QStyleSheetItem::WhiteSpaceMode wsm;
     QTextFormat format;
     int alignment : 16;
     int direction : 5;
     QStyleSheetItem::ListStyle liststyle;
 
     QTextDocumentTag(  const QTextDocumentTag& t ) {
         name = t.name;
         style = t.style;
         anchorHref = t.anchorHref;
         wsm = t.wsm;
         format = t.format;
         alignment = t.alignment;
         direction = t.direction;
         liststyle = t.liststyle;
     }
     QTextDocumentTag& operator=(const QTextDocumentTag& t) {
         name = t.name;
         style = t.style;
         anchorHref = t.anchorHref;
         wsm = t.wsm;
         format = t.format;
         alignment = t.alignment;
         direction = t.direction;
         liststyle = t.liststyle;
         return *this;
     }
 
 #if defined(Q_FULL_TEMPLATE_INSTANTIATION)
     bool operator==( const QTextDocumentTag& ) const { return FALSE; }
 #endif
 };
 
 
-#define NEWPAR       do{ if ( !hasNewPar) { \
+#define NEWPAR do { \
+                   if ( !hasNewPar) { \
+                       if ( !curpar ) { \
+                           owarn << "no current paragraph" << oendl; \
+                           return; \
+                       } \
                     if ( !textEditMode && curpar && curpar->length()>1 && curpar->at( curpar->length()-2)->c == QChar_linesep ) \
                         curpar->remove( curpar->length()-2, 1 ); \
-                    curpar = createParagraph( this, curpar, curpar->next() ); styles.append( vec ); vec = 0;} \
+                       curpar = createParagraph( this, curpar, curpar->next() ); styles.append( vec ); \
+                       if ( !curpar ) { \
+                           owarn << "failed in creating a new paragraph" << oendl; \
+                           return; \
+                       } \
+                       vec = 0; \
+                   } \
                     hasNewPar = TRUE; \
                     curpar->rtext = TRUE;  \
                     curpar->align = curtag.alignment; \
                     curpar->lstyle = curtag.liststyle; \
                     curpar->litem = ( curtag.style->displayMode() == QStyleSheetItem::DisplayListItem ); \
                     curpar->str->setDirection( (QChar::Direction)curtag.direction ); \
                     space = TRUE; \
-                    delete vec; vec = new QPtrVector<QStyleSheetItem>( (uint)tags.count() + 1); \
+                   delete vec; \
+                   vec = new QPtrVector<QStyleSheetItem>( (uint)tags.count() + 1); \
                     int i = 0; \
                     for ( QValueStack<QTextDocumentTag>::Iterator it = tags.begin(); it != tags.end(); ++it ) \
                         vec->insert( i++, (*it).style ); \
                     vec->insert( i, curtag.style ); \
                     }while(FALSE)
 
-
 void QTextDocument::setRichText( const QString &text, const QString &context )
 {
     if ( !context.isEmpty() )
         setContext( context );
     clear();
     fParag = lParag = createParagraph( this );
     oTextValid = TRUE;
     oText = text;
     setRichTextInternal( text );
     fParag->rtext = TRUE;
 }
 
 void QTextDocument::setRichTextInternal( const QString &text, QTextCursor* cursor )
 {
     QTextParagraph* curpar = lParag;
     int pos = 0;
     QValueStack<QTextDocumentTag> tags;
     QTextDocumentTag initag( "", sheet_->item(""), *formatCollection()->defaultFormat() );
     QTextDocumentTag curtag = initag;
     bool space = TRUE;
     bool canMergeLi = FALSE;
 
     bool textEditMode = FALSE;
 
     const QChar* doc = text.unicode();
     int length = text.length();
     bool hasNewPar = curpar->length() <= 1;
     QString anchorName;
 
     // style sheet handling for margin and line spacing calculation below
     QTextParagraph* stylesPar = curpar;
     QPtrVector<QStyleSheetItem>* vec = 0;
     QPtrList< QPtrVector<QStyleSheetItem> > styles;
     styles.setAutoDelete( TRUE );
 
     if ( cursor ) {
         cursor->splitAndInsertEmptyParagraph();
         QTextCursor tmp = *cursor;
         tmp.gotoPreviousLetter();
         stylesPar = curpar = tmp.paragraph();
         hasNewPar = TRUE;
         textEditMode = TRUE;
     } else {
         NEWPAR;
     }
 
     // set rtext spacing to FALSE for the initial paragraph.
     curpar->rtext = FALSE;
@@ -1850,98 +1870,101 @@ void QTextDocument::setRichTextInternal( const QString &text, QTextCursor* curso
                 f->ref += s.length() -1; // that what friends are for...
                 if ( !curtag.anchorHref.isEmpty() ) {
                     for ( int i = 0; i < int(s.length()); i++ )
                         curpar->at(index + i)->setAnchor( QString::null, curtag.anchorHref );
                 }
                 if ( !anchorName.isEmpty()  ) {
                     curpar->at(index)->setAnchor( anchorName, curpar->at(index)->anchorHref() );
                     anchorName = QString::null;
                 }
             }
         }
     }
     if ( hasNewPar && curpar != fParag && !cursor ) {
         // cleanup unused last paragraphs
         curpar = curpar->p;
         delete curpar->n;
     }
     if ( !anchorName.isEmpty()  ) {
         curpar->at(curpar->length() - 1)->setAnchor( anchorName, curpar->at( curpar->length() - 1 )->anchorHref() );
         anchorName = QString::null;
     }
 
 
     setRichTextMarginsInternal( styles, stylesPar );
 
     if ( cursor ) {
          cursor->gotoPreviousLetter();
           cursor->remove();
      }
 
 }
 
 void QTextDocument::setRichTextMarginsInternal( QPtrList< QPtrVector<QStyleSheetItem> >& styles, QTextParagraph* stylesPar )
 {
     // margin and line spacing calculation
     QPtrVector<QStyleSheetItem>* prevStyle = 0;
     QPtrVector<QStyleSheetItem>* curStyle = styles.first();
     QPtrVector<QStyleSheetItem>* nextStyle = styles.next();
     while ( stylesPar ) {
         if ( !curStyle ) {
             stylesPar = stylesPar->next();
             prevStyle = curStyle;
             curStyle = nextStyle;
             nextStyle = styles.next();
             continue;
         }
 
         int i, mar;
-        QStyleSheetItem* mainStyle = curStyle->size() ? (*curStyle)[curStyle->size()-1] : 0;
-        if ( mainStyle && mainStyle->displayMode() == QStyleSheetItem::DisplayListItem )
+        QStyleSheetItem* mainStyle = (*curStyle)[curStyle->size()-1];
+        if ( !mainStyle )
+            return;
+
+        if ( mainStyle->displayMode() == QStyleSheetItem::DisplayListItem )
             stylesPar->setListItem( TRUE );
         int numLists = 0;
         for ( i = 0; i < (int)curStyle->size(); ++i ) {
             if ( (*curStyle)[ i ]->displayMode() == QStyleSheetItem::DisplayBlock
                  && int((*curStyle)[ i ]->listStyle()) != QStyleSheetItem::Undefined )
                 numLists++;
         }
         stylesPar->ldepth = numLists;
         if ( stylesPar->next() && nextStyle ) {
             // also set the depth of the next paragraph, required for the margin calculation
             numLists = 0;
             for ( i = 0; i < (int)nextStyle->size(); ++i ) {
                 if ( (*nextStyle)[ i ]->displayMode() == QStyleSheetItem::DisplayBlock
                      && int((*nextStyle)[ i ]->listStyle()) != QStyleSheetItem::Undefined )
                     numLists++;
             }
             stylesPar->next()->ldepth = numLists;
         }
 
         // do the top margin
         QStyleSheetItem* item = mainStyle;
         int m;
         if (stylesPar->utm > 0 ) {
             m = stylesPar->utm-1;
             stylesPar->utm = 0;
         } else {
             m = QMAX(0, item->margin( QStyleSheetItem::MarginTop ) );
             if ( item->displayMode() == QStyleSheetItem::DisplayListItem
                  && stylesPar->ldepth )
               m /= stylesPar->ldepth;
         }
         for ( i = (int)curStyle->size() - 2 ; i >= 0; --i ) {
             item = (*curStyle)[ i ];
             if ( prevStyle && i < (int) prevStyle->size() &&
                  (  item->displayMode() == QStyleSheetItem::DisplayBlock &&
                     (*prevStyle)[ i ] == item ) )
                 break;
             // emulate CSS2' standard 0 vertical margin for multiple ul or ol tags
              if ( int(item->listStyle()) != QStyleSheetItem::Undefined  &&
                  ( (  i> 0 && (*curStyle)[ i-1 ] == item ) || (*curStyle)[i+1] == item ) )
                 continue;
             mar = QMAX( 0, item->margin( QStyleSheetItem::MarginTop ) );
             m = QMAX( m, mar );
         }
         stylesPar->utm = m - stylesPar->topMargin();
 
         // do the bottom margin
         item = mainStyle;
@@ -5296,97 +5319,97 @@ int QTextFormatterBreakWords::format( QTextDocument *doc, QTextParagraph *parag,
     QTextStringChar *firstChar = 0;
     QTextString *string = parag->string();
     int left = doc ? parag->leftMargin() + doc->leftMargin() : 0;
     int x = left + ( doc ? parag->firstLineMargin() : 0 );
     int y = parag->prev() ? QMAX(parag->prev()->bottomMargin(),parag->topMargin()) / 2: 0;
     int h = y;
     int len = parag->length();
     if ( doc )
         x = doc->flow()->adjustLMargin( y + parag->rect().y(), parag->rect().height(), x, 0 );
     int dw = parag->documentVisibleWidth() - ( doc ? ( left != x ? 0 : doc->rightMargin() ) : 0 );
 
     int curLeft = x;
     int rm = parag->rightMargin();
     int rdiff = doc ? doc->flow()->adjustRMargin( y + parag->rect().y(), parag->rect().height(), rm, 0 ) : 0;
     int w = dw - rdiff;
     bool fullWidth = TRUE;
     int marg = left + rdiff;
     int minw = 0;
     int wused = 0;
     int tminw = marg;
     int linespacing = doc ? parag->lineSpacing() : 0;
     bool wrapEnabled = isWrapEnabled( parag );
 
     start = 0;
     if ( start == 0 )
         c = &parag->string()->at( 0 );
 
     int i = start;
     QTextLineStart *lineStart = new QTextLineStart( y, y, 0 );
     insertLineStart( parag, 0, lineStart );
     int lastBreak = -1;
     int tmpBaseLine = 0, tmph = 0;
     bool lastWasNonInlineCustom = FALSE;
 
     int align = parag->alignment();
     if ( align == Qt3::AlignAuto && doc && doc->alignment() != Qt3::AlignAuto )
         align = doc->alignment();
 
     align &= Qt3::AlignHorizontal_Mask;
 
     QPainter *painter = QTextFormat::painter();
     int col = 0;
     int ww = 0;
     QChar lastChr;
     for ( ; i < len; ++i, ++col ) {
         if ( c )
             lastChr = c->c;
         // ### next line should not be needed
-        if ( painter )
+        if ( c && painter )
             c->format()->setPainter( painter );
         c = &string->at( i );
         c->rightToLeft = FALSE;
         if ( i > 0 && (x > curLeft || ww == 0) || lastWasNonInlineCustom ) {
             c->lineStart = 0;
         } else {
             c->lineStart = 1;
             firstChar = c;
         }
 
         if ( c->isCustom() && c->customItem()->placement() != QTextCustomItem::PlaceInline )
             lastWasNonInlineCustom = TRUE;
         else
             lastWasNonInlineCustom = FALSE;
 
         if ( c->c.unicode() >= 32 || c->isCustom() ) {
             ww = string->width( i );
         } else if ( c->c == '\t' ) {
             int nx = parag->nextTab( i, x - left ) + left;
             if ( nx < x )
                 ww = w - x;
             else
                 ww = nx - x;
         } else {
             ww = c->format()->width( ' ' );
         }
 
         // last character ("invisible" space) has no width
         if ( i == len - 1 )
             ww = 0;
 
         QTextCustomItem* ci = c->customItem();
         if ( c->isCustom() && ci->ownLine() ) {
             x = doc ? doc->flow()->adjustLMargin( y + parag->rect().y(), parag->rect().height(), left, 4 ) : left;
             w = dw - ( doc ? doc->flow()->adjustRMargin( y + parag->rect().y(), parag->rect().height(), rm, 4 ) : 0 );
             QTextLineStart *lineStart2 = formatLine( parag, string, lineStart, firstChar, c-1, align, SPACE(w - x) );
             ci->resize( w - x);
             if ( ci->width < w - x ) {
                 if ( align & Qt::AlignHCenter )
                     x = ( w - ci->width ) / 2;
                 else if ( align & Qt::AlignRight ) {
                     x = w - ci->width;
                 }
             }
             c->x = x;
             curLeft = x;
             if ( i == 0 || !isBreakable( string, i - 1 ) || string->at( i - 1 ).lineStart == 0 ) {
                 y += QMAX( h, QMAX( tmph, linespacing ) );