From b7bc6ad1e686b091d32d1e247284f3279185b8cd Mon Sep 17 00:00:00 2001
From: wmayer <wmayer@users.sourceforge.net>
Date: Sat, 6 Apr 2024 02:12:04 +0200
Subject: [PATCH] Gui: add security checks to view provider extensions because
 they can be accessed if a document objects is not yet attached

---
 .../ViewProviderGeoFeatureGroupExtension.cpp    | 17 ++++++++++++-----
 src/Gui/ViewProviderGroupExtension.cpp          |  7 ++++++-
 src/Gui/ViewProviderOriginGroupExtension.cpp    | 12 ++++++++----
 src/Gui/ViewProviderSuppressibleExtension.cpp   |  2 +-
 .../Part/Gui/ViewProviderAttachExtension.cpp    |  5 +++--
 5 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/src/Gui/ViewProviderGeoFeatureGroupExtension.cpp b/src/Gui/ViewProviderGeoFeatureGroupExtension.cpp
index c6ab8a900e..e441220f4b 100644
--- a/src/Gui/ViewProviderGeoFeatureGroupExtension.cpp
+++ b/src/Gui/ViewProviderGeoFeatureGroupExtension.cpp
@@ -67,7 +67,8 @@ ViewProviderGeoFeatureGroupExtension::~ViewProviderGeoFeatureGroupExtension()
 std::vector<App::DocumentObject*> ViewProviderGeoFeatureGroupExtension::extensionClaimChildren3D() const {
 
     //all object in the group must be claimed in 3D, as we are a coordinate system for all of them
-    auto* ext = getExtendedViewProvider()->getObject()->getExtensionByType<App::GeoFeatureGroupExtension>();
+    auto* obj = getExtendedViewProvider()->getObject();
+    auto* ext = obj ? obj->getExtensionByType<App::GeoFeatureGroupExtension>() : nullptr;
     if (ext) {
         auto objs = ext->Group.getValues();
         return objs;
@@ -77,7 +78,12 @@ std::vector<App::DocumentObject*> ViewProviderGeoFeatureGroupExtension::extensio
 
 std::vector<App::DocumentObject*> ViewProviderGeoFeatureGroupExtension::extensionClaimChildren() const {
 
-    auto* group = getExtendedViewProvider()->getObject()->getExtensionByType<App::GeoFeatureGroupExtension>();
+    auto* obj = getExtendedViewProvider()->getObject();
+    if (!obj) {
+        return {};
+    }
+
+    auto* group = obj->getExtensionByType<App::GeoFeatureGroupExtension>();
     const std::vector<App::DocumentObject*> &model = group->Group.getValues ();
     std::set<App::DocumentObject*> outSet; //< set of objects not to claim (childrens of childrens)
 
@@ -142,9 +148,10 @@ std::vector<std::string> ViewProviderGeoFeatureGroupExtension::extensionGetDispl
 
 void ViewProviderGeoFeatureGroupExtension::extensionUpdateData(const App::Property* prop)
 {
-    auto obj = getExtendedViewProvider()->getObject()->getExtensionByType<App::GeoFeatureGroupExtension>();
-    if (obj && prop == &obj->placement()) {
-        getExtendedViewProvider()->setTransformation ( obj->placement().getValue().toMatrix() );
+    auto obj = getExtendedViewProvider()->getObject();
+    auto grp = obj ? obj->getExtensionByType<App::GeoFeatureGroupExtension>() : nullptr;
+    if (grp && prop == &grp->placement()) {
+        getExtendedViewProvider()->setTransformation ( grp->placement().getValue().toMatrix() );
     }
     else {
         ViewProviderGroupExtension::extensionUpdateData ( prop );
diff --git a/src/Gui/ViewProviderGroupExtension.cpp b/src/Gui/ViewProviderGroupExtension.cpp
index 4bfbabbdbb..310997929e 100644
--- a/src/Gui/ViewProviderGroupExtension.cpp
+++ b/src/Gui/ViewProviderGroupExtension.cpp
@@ -108,7 +108,12 @@ void ViewProviderGroupExtension::extensionDropObject(App::DocumentObject* obj) {
 
 std::vector< App::DocumentObject* > ViewProviderGroupExtension::extensionClaimChildren() const {
 
-    auto* group = getExtendedViewProvider()->getObject()->getExtensionByType<App::GroupExtension>();
+    auto* obj = getExtendedViewProvider()->getObject();
+    if (!obj) {
+        return {};
+    }
+
+    auto* group = obj->getExtensionByType<App::GroupExtension>();
     return group->Group.getValues();
 }
 
diff --git a/src/Gui/ViewProviderOriginGroupExtension.cpp b/src/Gui/ViewProviderOriginGroupExtension.cpp
index 1eb7f3e526..2d08457968 100644
--- a/src/Gui/ViewProviderOriginGroupExtension.cpp
+++ b/src/Gui/ViewProviderOriginGroupExtension.cpp
@@ -62,7 +62,8 @@ ViewProviderOriginGroupExtension::~ViewProviderOriginGroupExtension()
 std::vector<App::DocumentObject*> ViewProviderOriginGroupExtension::constructChildren (
         const std::vector<App::DocumentObject*> &children ) const
 {
-    auto* group = getExtendedViewProvider()->getObject()->getExtensionByType<App::OriginGroupExtension>();
+    auto* obj = getExtendedViewProvider()->getObject();
+    auto* group = obj ? obj->getExtensionByType<App::OriginGroupExtension>() : nullptr;
     if(!group)
         return children;
 
@@ -108,7 +109,8 @@ void ViewProviderOriginGroupExtension::extensionAttach(App::DocumentObject *pcOb
 
 void ViewProviderOriginGroupExtension::extensionUpdateData( const App::Property* prop ) {
 
-    auto* group = getExtendedViewProvider()->getObject()->getExtensionByType<App::OriginGroupExtension>();
+    auto* obj = getExtendedViewProvider()->getObject();
+    auto* group = obj ? obj->getExtensionByType<App::OriginGroupExtension>() : nullptr;
     if ( group && prop == &group->Group ) {
         updateOriginSize();
     }
@@ -117,7 +119,8 @@ void ViewProviderOriginGroupExtension::extensionUpdateData( const App::Property*
 }
 
 void ViewProviderOriginGroupExtension::slotChangedObjectApp ( const App::DocumentObject& obj) {
-    auto* group = getExtendedViewProvider()->getObject()->getExtensionByType<App::OriginGroupExtension>();
+    auto* ext = getExtendedViewProvider()->getObject();
+    auto* group = ext ? ext->getExtensionByType<App::OriginGroupExtension>() : nullptr;
     if ( group && group->hasObject (&obj, /*recursive=*/ true ) ) {
         updateOriginSize ();
     }
@@ -127,7 +130,8 @@ void ViewProviderOriginGroupExtension::slotChangedObjectGui ( const Gui::ViewPro
     if ( !vp.isDerivedFrom ( Gui::ViewProviderOriginFeature::getClassTypeId () )) {
         // Ignore origins to avoid infinite recursion (not likely in a well-formed document,
         //          but may happen in documents designed in old versions of assembly branch )
-        auto* group = getExtendedViewProvider()->getObject()->getExtensionByType<App::OriginGroupExtension>();
+        auto* ext = getExtendedViewProvider()->getObject();
+        auto* group = ext ? ext->getExtensionByType<App::OriginGroupExtension>() : nullptr;
         App::DocumentObject *obj = vp.getObject ();
 
         if ( group && obj && group->hasObject (obj, /*recursive=*/ true ) ) {
diff --git a/src/Gui/ViewProviderSuppressibleExtension.cpp b/src/Gui/ViewProviderSuppressibleExtension.cpp
index 17d48c4df0..4ebd3c5d64 100644
--- a/src/Gui/ViewProviderSuppressibleExtension.cpp
+++ b/src/Gui/ViewProviderSuppressibleExtension.cpp
@@ -53,7 +53,7 @@ void ViewProviderSuppressibleExtension::extensionUpdateData(const App::Property*
 {
     auto vp = getExtendedViewProvider();
     auto owner = vp->getObject();
-    if(!owner->isValid())
+    if(!owner || !owner->isValid())
         return;
 
     auto ext = owner->getExtensionByType<App::SuppressibleExtension>();
diff --git a/src/Mod/Part/Gui/ViewProviderAttachExtension.cpp b/src/Mod/Part/Gui/ViewProviderAttachExtension.cpp
index 550c6936e1..06a2dd377a 100644
--- a/src/Mod/Part/Gui/ViewProviderAttachExtension.cpp
+++ b/src/Mod/Part/Gui/ViewProviderAttachExtension.cpp
@@ -77,8 +77,9 @@ QIcon ViewProviderAttachExtension::extensionMergeColorfullOverlayIcons (const QI
 
 void ViewProviderAttachExtension::extensionUpdateData(const App::Property* prop)
 {
-    if (getExtendedViewProvider()->getObject()->hasExtension(Part::AttachExtension::getExtensionClassTypeId())) {
-        auto* attach = getExtendedViewProvider()->getObject()->getExtensionByType<Part::AttachExtension>();
+    auto obj = getExtendedViewProvider()->getObject();
+    if (obj && obj->hasExtension(Part::AttachExtension::getExtensionClassTypeId())) {
+        auto* attach = obj->getExtensionByType<Part::AttachExtension>();
 
         if(attach) {
             if( prop == &(attach->AttachmentSupport) ||