Bug 167952 - Welcome dialog causes null-pointer-use undefined behavior
Summary: Welcome dialog causes null-pointer-use undefined behavior
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: framework (show other bugs)
Version:
(earliest affected)
unspecified
Hardware: All All
: medium normal
Assignee: Heiko Tietze
URL:
Whiteboard: target:26.2.0 target:25.8.1
Keywords:
Depends on:
Blocks:
 
Reported: 2025-08-14 11:45 UTC by Stephan Bergmann
Modified: 2025-08-20 13:37 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stephan Bergmann 2025-08-14 11:45:34 UTC
The new Welcome dialog (cf. <https://git.libreoffice.org/core/+/9d90a1733bcf65763268583c97cd5e31a2f90f0c%5E%21> "Resolves tdf#137931 - Show a Welcome dialog on first start-up", shown when running e.g. `soffice --writer` without an existing UserInstallation), causes

> cui/source/dialogs/whatsnewtabpage.cxx:37:68: runtime error: reference binding to null pointer of type 'const SfxItemSet'
>  #0 in WhatsNewTabPage::Reset(SfxItemSet const*) at cui/source/dialogs/whatsnewtabpage.cxx:37:55
>  #1 in SfxTabDialogController::CreatePages() at sfx2/source/dialog/tabdlg.cxx:962:36
>  #2 in SfxTabDialogController::Start_Impl() at sfx2/source/dialog/tabdlg.cxx:1034:5
>  #3 in SfxTabDialogController::run() at sfx2/source/dialog/tabdlg.cxx:1084:5
>  #4 in vcl::AbstractDialogImpl_BASE<SfxAbstractTabDialog, WelcomeDialog, std::shared_ptr, true>::Execute() at include/vcl/abstdlgimpl.hxx:47:47
>  #5 in SfxViewFrame::Notify(SfxBroadcaster&, SfxHint const&) at sfx2/source/view/viewfrm.cxx:1672:35
>  #6 in SfxBroadcaster::Broadcast(SfxHint const&) at svl/source/notify/SfxBroadcaster.cxx:43:24
>  #7 in (anonymous namespace)::SfxEventAsyncer_Impl::IdleHdl(Timer*) at sfx2/source/appl/appcfg.cxx:109:15
>  #8 in (anonymous namespace)::SfxEventAsyncer_Impl::LinkStubIdleHdl(void*, Timer*) at sfx2/source/appl/appcfg.cxx:102:1
>  #9 in Link<Timer*, void>::Call(Timer*) const at include/tools/link.hxx:105:45
>  #10 in Timer::Invoke() at vcl/source/app/timer.cxx:75:21
>  #11 in Scheduler::CallbackTaskScheduling() at vcl/source/app/scheduler.cxx:607:20
>  #12 in SalTimer::CallCallback() at vcl/inc/saltimer.hxx:53:13
>  #13 in sal_gtk_timeout_dispatch(_GSource*, int (*)(void*), void*) at vcl/unx/gtk3/gtkdata.cxx:734:45
>  #14  at <null>
>  #15  at <null>
>  #16 in g_main_context_iteration at <null>
>  #17 in GtkSalData::Yield(bool, bool) at vcl/unx/gtk3/gtkdata.cxx:403:31
>  #18 in GtkInstance::DoYield(bool, bool) at vcl/unx/gtk3/gtkinst.cxx:440:29
>  #19 in ImplYield(bool, bool) at vcl/source/app/svapp.cxx:385:48
>  #20 in Application::Yield() at vcl/source/app/svapp.cxx:488:5
>  #21 in Application::Execute() at vcl/source/app/svapp.cxx:360:13
>  #22 in desktop::Desktop::Main() at desktop/source/app/app.cxx:1678:13
>  #23 in ImplSVMain() at vcl/source/app/svmain.cxx:230:35
>  #24 in SVMain() at vcl/source/app/svmain.cxx:248:12
>  #25 in soffice_main at desktop/source/app/sofficemain.cxx:122:12
>  #26 in sal_main at desktop/source/app/main.c:51:15
>  #27 in main at desktop/source/app/main.c:49:1
>  #28 in __libc_start_call_main at <null>
>  #29 in __libc_start_main@GLIBC_2.2.5 at <null>
>  #30 in _start at <null>
> 
> SUMMARY: UndefinedBehaviorSanitizer: null-pointer-use cui/source/dialogs/whatsnewtabpage.cxx:37:68 

and

> cui/source/options/appearance.cxx:219:18: runtime error: reference binding to null pointer of type 'const SfxItemSet'
>  #0 in SvxAppearanceTabPage::Reset(SfxItemSet const*) at cui/source/options/appearance.cxx:219:5
>  #1 in SfxTabDialogController::CreatePages() at sfx2/source/dialog/tabdlg.cxx:962:36
>  #2 in SfxTabDialogController::Start_Impl() at sfx2/source/dialog/tabdlg.cxx:1034:5
>  #3 in SfxTabDialogController::run() at sfx2/source/dialog/tabdlg.cxx:1084:5
>  #4 in vcl::AbstractDialogImpl_BASE<SfxAbstractTabDialog, WelcomeDialog, std::shared_ptr, true>::Execute() at include/vcl/abstdlgimpl.hxx:47:47
>  #5 in SfxViewFrame::Notify(SfxBroadcaster&, SfxHint const&) at sfx2/source/view/viewfrm.cxx:1672:35
>  #6 in SfxBroadcaster::Broadcast(SfxHint const&) at svl/source/notify/SfxBroadcaster.cxx:43:24
>  #7 in (anonymous namespace)::SfxEventAsyncer_Impl::IdleHdl(Timer*) at sfx2/source/appl/appcfg.cxx:109:15
>  #8 in (anonymous namespace)::SfxEventAsyncer_Impl::LinkStubIdleHdl(void*, Timer*) at sfx2/source/appl/appcfg.cxx:102:1
>  #9 in Link<Timer*, void>::Call(Timer*) const at include/tools/link.hxx:105:45
>  #10 in Timer::Invoke() at vcl/source/app/timer.cxx:75:21
>  #11 in Scheduler::CallbackTaskScheduling() at vcl/source/app/scheduler.cxx:607:20
>  #12 in SalTimer::CallCallback() at vcl/inc/saltimer.hxx:53:13
>  #13 in sal_gtk_timeout_dispatch(_GSource*, int (*)(void*), void*) at vcl/unx/gtk3/gtkdata.cxx:734:45
>  #14  at <null>
>  #15  at <null>
>  #16 in g_main_context_iteration at <null>
>  #17 in GtkSalData::Yield(bool, bool) at vcl/unx/gtk3/gtkdata.cxx:403:31
>  #18 in GtkInstance::DoYield(bool, bool) at vcl/unx/gtk3/gtkinst.cxx:440:29
>  #19 in ImplYield(bool, bool) at vcl/source/app/svapp.cxx:385:48
>  #20 in Application::Yield() at vcl/source/app/svapp.cxx:488:5
>  #21 in Application::Execute() at vcl/source/app/svapp.cxx:360:13
>  #22 in desktop::Desktop::Main() at desktop/source/app/app.cxx:1678:13
>  #23 in ImplSVMain() at vcl/source/app/svmain.cxx:230:35
>  #24 in SVMain() at vcl/source/app/svmain.cxx:248:12
>  #25 in soffice_main at desktop/source/app/sofficemain.cxx:122:12
>  #26 in sal_main at desktop/source/app/main.c:51:15
>  #27 in main at desktop/source/app/main.c:49:1
>  #28 in __libc_start_call_main at <null>
>  #29 in __libc_start_main@GLIBC_2.2.5 at <null>
>  #30 in _start at <null>
> 
> SUMMARY: UndefinedBehaviorSanitizer: null-pointer-use cui/source/options/appearance.cxx:219:18 

(as can be seen when building with -fsanitize=undefined).

Either. @Heiko: these calls to WhatsNewTabPage::Reset and SvxAppearanceTabPage::Reset should never be done with a null pointer argument (so whatever surrounding code would need fixing).

Or, @Armin: as the called WhatsNewTabPage::ActivatePage and SvxAppearanceTabPage::ActivatePage don't use their arguments anyway, we could ignore the pointer passed into WhatsNewTabPage::Reset and SvxAppearanceTabPage::Reset, and call WhatsNewTabPage::ActivatePage and SvxAppearanceTabPage::ActivatePage with "dummy" SfxItemSet instances---if there were a way to create such "dummy" instances.  That is, something like

> diff --git a/cui/source/dialogs/whatsnewtabpage.cxx b/cui/source/dialogs/whatsnewtabpage.cxx
> index 2afaa3e18efd..dbe7178d4f58 100644
> --- a/cui/source/dialogs/whatsnewtabpage.cxx
> +++ b/cui/source/dialogs/whatsnewtabpage.cxx
> @@ -34,7 +34,7 @@ std::unique_ptr<SfxTabPage> WhatsNewTabPage::Create(weld::Container* pPage,
>      return std::make_unique<WhatsNewTabPage>(pPage, pController, *rAttr);
>  }
>  
> -void WhatsNewTabPage::Reset(const SfxItemSet* rSet) { ActivatePage(*rSet); }
> +void WhatsNewTabPage::Reset(const SfxItemSet*) { ActivatePage(... create dummy SfxItemSet instance here ...); }
>  
>  void WhatsNewTabPage::ActivatePage(const SfxItemSet& /* rSet */)
>  {
> diff --git a/cui/source/options/appearance.cxx b/cui/source/options/appearance.cxx
> index 388b2c836c32..6892a138f379 100644
> --- a/cui/source/options/appearance.cxx
> +++ b/cui/source/options/appearance.cxx
> @@ -213,10 +213,10 @@ bool SvxAppearanceTabPage::FillItemSet(SfxItemSet* /* rSet */)
>      return true;
>  }
>  
> -void SvxAppearanceTabPage::Reset(const SfxItemSet* rSet)
> +void SvxAppearanceTabPage::Reset(const SfxItemSet*)
>  {
>      // hide advanced controls
> -    ActivatePage(*rSet);
> +    ActivatePage(... create dummy SfxItemSet instance here ...);
>  
>      // reset scheme list
>      LoadSchemeList();
Comment 1 Stephan Bergmann 2025-08-15 08:28:53 UTC
(In reply to Stephan Bergmann from comment #0)
> Either. @Heiko: these calls to WhatsNewTabPage::Reset and
> SvxAppearanceTabPage::Reset should never be done with a null pointer
> argument (so whatever surrounding code would need fixing).
> 
> Or, @Armin: as the called WhatsNewTabPage::ActivatePage and
> SvxAppearanceTabPage::ActivatePage don't use their arguments anyway, we
> could ignore the pointer passed into WhatsNewTabPage::Reset and
> SvxAppearanceTabPage::Reset, and call WhatsNewTabPage::ActivatePage and
> SvxAppearanceTabPage::ActivatePage with "dummy" SfxItemSet instances---if
> there were a way to create such "dummy" instances.

(Or, virtual SfxTabPage::ActivatePage could be changed to take its argument by pointer instead of by reference.  Whatever makes most sense for a clean architecture overall.)
Comment 2 Commit Notification 2025-08-19 17:47:33 UTC
Heiko Tietze committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/144e72591a61127a6d1e0f1a6bc9867a61e9b135

Resolves tdf#167952 - Null-pointer-use in Welcome dialog

It will be available in 26.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 3 Heiko Tietze 2025-08-19 17:48:35 UTC
Cherry-pick to 25.8?
Comment 4 Stephan Bergmann 2025-08-19 18:46:08 UTC
(In reply to Heiko Tietze from comment #3)
> Cherry-pick to 25.8?

I at least don't see a need for that
Comment 5 Commit Notification 2025-08-20 13:37:55 UTC
Heiko Tietze committed a patch related to this issue.
It has been pushed to "libreoffice-25-8":

https://git.libreoffice.org/core/commit/6fb8f20900139856cbe06aeaa8985efb761aeb40

Resolves tdf#167952 - Null-pointer-use in Welcome dialog

It will be available in 25.8.1.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.