I think problem can be discovered here:

We dereference ptr without checking against nullptr. One of the path for calling this function is here:

We using `segment.toTempUnicodeString().getBuffer(),`, but getBuffer() can return nullptr:

Found by Linux Verification Center (http://linuxtesting.org ) with SVACE.

Reporter: Burkov Egor (eburkov@rvision.ru).

Organization: R-Vision (support@rvision.ru).