fix(reader): guard null annotation and event pointers

[pengfeixx]

Combines #395 and #397 into a single commit (disjoint files, same content):

• BrowserPage.cpp: null-first guard in removeAllAnnotation (sheet item 205)
• SheetBrowser.cpp: null-check event before type test in gesture handling (sheet item 211)

The two original PRs will be closed in favor of this one.

Summary by Sourcery

Guard annotation and event processing against null pointers to improve reader stability.

Bug Fixes:

• Prevent null annotation pointers from being dereferenced during annotation removal.
• Prevent null event pointers from being dereferenced during gesture handling.

[sourcery-ai]

Sorry @pengfeixx, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 23 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Adds null-pointer guards in annotation removal and gesture-event dispatch, preventing dereferences of null annotation or event pointers while preserving existing handling for valid objects.

File-Level Changes

Change	Details	Files
Guard annotation pointers before dereferencing or validating them during bulk annotation removal.	Skip null annotation entries before checking membership or accessing contents and boundaries.	reader/browser/BrowserPage.cpp
Guard the event pointer before inspecting its type during event dispatch.	Require a non-null event before handling it as a gesture event.	reader/browser/SheetBrowser.cpp

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: lzwind, pengfeixx

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[deepin-ci-robot]

deepin pr auto review

AI 代码审查报告

项目: linuxdeepin/deepin-reader | PR: #400 | 分支: fix/null-guards → master
作者: pengfeixx | 提交: a8674d1 - fix(reader): guard null annotation and event pointers
扫描时间: 2026-09-20 13:17:59 | 分析模式: 全量分析

---

总体评价

项目	结果
总分	100 / 100
等级	优秀
结论	代码审查通过
原因	本次变更为空指针守卫修复，逻辑正确、修改精准、无安全漏洞，与提交目的完全一致

---

漏洞统计

指标	数值
当前漏洞总数	0
新增漏洞	0
已修复漏洞	0
持平漏洞	0

漏洞对比统计：新增漏洞 0 个，减少漏洞 0 个，持平 0 个

---

四维度评分

维度1：语法逻辑（25/25 ✓）

语法正确，逻辑清晰

• 检查结果：无语法错误，无编译风险
• 逻辑分析：
  1. reader/browser/BrowserPage.cpp 第1034行：新增 !annota 空指针守卫，利用 C++ 短路求值（short-circuit evaluation），当 annota 为 null 时立即 continue，阻止后续 annota->boundary() 的空指针解引用。原代码存在隐患：若 annota 为 null 且 m_annotations.contains(null) 返回 true，则两个条件均为 false，不执行 continue，导致空指针崩溃。新代码彻底消除了此风险。
  2. reader/browser/SheetBrowser.cpp 第925行：新增 event && 前置守卫，当 event 为 null 时条件为 false，跳过手势事件处理分支，逻辑正确。
• 边界处理：空指针边界条件处理完善，短路求值确保安全解引用顺序

维度2：代码质量（25/25 ✓）

代码结构清晰，注释完整

• 检查结果：代码简洁、修改精准、无残留调试代码
• 结构分析：
  1. BrowserPage.cpp：将空指针检查置于 OR 链首位，符合"先检查后使用"的防御性编程范式，同时简化了原代码中冗余的 (annota && annota->contents().isEmpty()) 嵌套逻辑为 annota->contents().isEmpty()，提升可读性
  2. SheetBrowser.cpp：单行添加 event && 守卫，修改最小化，不影响原有逻辑结构
• 代码重复：无重复代码
• 调试信息：无残留调试代码

维度3：代码性能（20/20 ✓）

性能良好，资源使用合理

• 检查结果：无性能缺陷
• 性能分析：
  1. BrowserPage.cpp：新增 !annota 检查为 O(1) 操作，且利用短路求值在 annota 为 null 时跳过后续 m_annotations.contains() 调用（O(n) 操作），实际可能略微提升性能
  2. SheetBrowser.cpp：新增指针判空为 O(1) 操作，对事件处理性能无可测量影响
• 资源使用：无新增资源分配，无内存泄漏风险

维度4：代码安全（30/30 ✓）

存在0个安全漏洞

• 检查结果：无安全漏洞
• 安全分析：
  1. 本次变更实质上是安全加固——修复了两处潜在的空指针解引用（null pointer dereference），属于防御性编程改进
  2. 无用户输入校验缺失、无命令注入/SQL注入风险、无硬编码密钥、无敏感信息泄露
  3. 无缓冲区溢出、无路径遍历、无不安全加密算法
• 漏洞对比统计：新增漏洞 0 个，减少漏洞 0 个，持平 0 个

---

修改文件详情

reader/browser/BrowserPage.cpp

函数: BrowserPage::removeAllAnnotation() | 行号: 1034

变更类型	描述
空指针守卫	在遍历 m_annotations 列表时，为 annota 指针添加前置空检查

-        if (!m_annotations.contains(annota) || (annota && annota->contents().isEmpty()))
+        if (!annota || !m_annotations.contains(annota) || annota->contents().isEmpty())

分析：原代码中 annota 的空指针检查位于第二个条件的子表达式中，当 annota 为 null 时无法有效拦截。新代码将 !annota 提升为 OR 链的首个条件，确保空指针在最早期被拦截，逻辑更安全且更清晰。

reader/browser/SheetBrowser.cpp

函数: SheetBrowser::event(QEvent *event) | 行号: 925

变更类型	描述
空指针守卫	为 event 指针添加前置空检查

-    if (event->type() == QEvent::Gesture) {
+    if (event && event->type() == QEvent::Gesture) {

分析：原代码直接解引用 event 而无空检查。新代码添加 event && 守卫，利用短路求值在 event 为 null 时安全跳过手势处理分支。

---

审查结论

本次 PR 为精准的空指针守卫修复，修改范围极小（2处、各1行），与提交信息 fix(reader): guard null annotation and event pointers 完全一致。两处修改均正确利用 C++ 短路求值机制，将空指针检查置于条件链首位，有效防止空指针解引用导致的崩溃。代码逻辑正确、结构清晰、无安全漏洞、无性能影响，审查通过。