[Libreoffice-commits] .: Branch 'feature/gnumake4' - 195 commits - starmath/CppunitTest_starmath_qa_cppunit.mk starmath/inc starmath/Library_smd.mk starmath/Library_sm.mk starmath/prj starmath/source starmath/util sw/CppunitTest_sw_swdoc_test.mk sw/CppunitTest_sw_test_filters.mk sw/inc sw/Library_msword.mk sw/Library_swd.mk sw/Library_sw.mk sw/Library_swui.mk sw/Library_vbaswobj.mk sw/prj sw/qa sw/sdi sw/source sw/uiconfig sw/util

Bjoern Michaelsen bmichaelsen at kemper.freedesktop.org
Thu Jul 21 10:07:46 PDT 2011


 starmath/CppunitTest_starmath_qa_cppunit.mk  |    7 
 starmath/Library_sm.mk                       |    6 
 starmath/Library_smd.mk                      |    6 
 starmath/inc/document.hxx                    |    4 
 starmath/prj/build.lst                       |    2 
 starmath/source/detreg.cxx                   |    2 
 starmath/source/document.cxx                 |    6 
 starmath/source/edit.cxx                     |    2 
 starmath/source/mathtype.hxx                 |    6 
 starmath/source/node.cxx                     |    6 
 starmath/source/register.cxx                 |    2 
 starmath/source/toolbox.cxx                  |   12 
 starmath/source/view.cxx                     |    5 
 starmath/source/visitors.cxx                 |    2 
 starmath/util/sm.component                   |    2 
 starmath/util/smd.component                  |    2 
 sw/CppunitTest_sw_swdoc_test.mk              |   13 
 sw/CppunitTest_sw_test_filters.mk            |   15 
 sw/Library_msword.mk                         |    6 
 sw/Library_sw.mk                             |    6 
 sw/Library_swd.mk                            |    6 
 sw/Library_swui.mk                           |    6 
 sw/Library_vbaswobj.mk                       |    7 
 sw/inc/PostItMgr.hxx                         |    2 
 sw/inc/cmdid.h                               |    1 
 sw/inc/comcore.hrc                           |    3 
 sw/inc/crsrsh.hxx                            |    5 
 sw/inc/extinput.hxx                          |    9 
 sw/inc/fesh.hxx                              |    1 
 sw/inc/ftnidx.hxx                            |    9 
 sw/inc/shellio.hxx                           |    1 
 sw/inc/viewsh.hxx                            |    4 
 sw/prj/build.lst                             |    2 
 sw/qa/core/data/rtf/fail/CVE-2005-2971-1.rtf |   11 
 sw/qa/core/data/rtf/pass/CVE-2005-2964.rtf   |   11 
 sw/qa/core/data/rtf/pass/CVE-2005-2972-1.rtf |   57 +
 sw/qa/core/data/rtf/pass/CVE-2005-2972-2.rtf |   57 +
 sw/qa/core/data/rtf/pass/CVE-2010-3333-1.rtf |binary
 sw/qa/core/data/ww8/fail/CVE-2005-0941-1.doc |binary
 sw/qa/core/data/ww8/fail/CVE-2006-2389-1.doc |binary
 sw/qa/core/data/ww8/fail/CVE-2008-0320-1.doc |binary
 sw/qa/core/data/ww8/pass/CVE-2006-3493-1.doc |binary
 sw/qa/core/data/ww8/pass/CVE-2006-6561-1.doc |binary
 sw/qa/core/data/ww8/pass/CVE-2006-6628-1.doc |binary
 sw/qa/core/data/ww8/pass/CVE-2007-1347-1.doc |binary
 sw/qa/core/data/ww8/pass/CVE-2008-2752-1.doc |binary
 sw/qa/core/data/ww8/pass/CVE-2008-2752-2.doc |binary
 sw/qa/core/data/ww8/pass/CVE-2008-2752-3.doc |binary
 sw/qa/core/data/ww8/pass/CVE-2008-2752-4.doc |binary
 sw/qa/core/data/ww8/pass/CVE-2008-4841-1.doc |binary
 sw/qa/core/data/ww8/pass/CVE-2009-0259-1.doc |binary
 sw/qa/core/data/ww8/pass/CVE-2010-3200-1.doc |binary
 sw/qa/core/filters-test.cxx                  |   76 +-
 sw/sdi/_textsh.sdi                           |    6 
 sw/sdi/swriter.sdi                           |   27 
 sw/source/core/crsr/crsrsh.cxx               |   61 +
 sw/source/core/crsr/findtxt.cxx              |   26 
 sw/source/core/doc/doc.cxx                   |    4 
 sw/source/core/doc/docbm.cxx                 |   22 
 sw/source/core/doc/docedt.cxx                |    8 
 sw/source/core/doc/docfld.cxx                |   14 
 sw/source/core/doc/docfmt.cxx                |    2 
 sw/source/core/doc/docnew.cxx                |   59 -
 sw/source/core/doc/extinput.cxx              |    8 
 sw/source/core/doc/ftnidx.cxx                |    6 
 sw/source/core/doc/notxtfrm.cxx              |   37 -
 sw/source/core/doc/poolfmt.cxx               |    8 
 sw/source/core/docnode/ndcopy.cxx            |   21 
 sw/source/core/docnode/ndtbl.cxx             |   16 
 sw/source/core/edit/edfld.cxx                |    2 
 sw/source/core/fields/reffld.cxx             |    2 
 sw/source/core/frmedt/feshview.cxx           |   13 
 sw/source/core/frmedt/fews.cxx               |   12 
 sw/source/core/inc/UndoTable.hxx             |   28 
 sw/source/core/inc/frame.hxx                 |    4 
 sw/source/core/inc/mvsave.hxx                |    7 
 sw/source/core/inc/pagefrm.hxx               |    2 
 sw/source/core/inc/scriptinfo.hxx            |   25 
 sw/source/core/layout/dbg_lay.cxx            |  220 +++----
 sw/source/core/layout/dumpfilter.cxx         |    4 
 sw/source/core/layout/ftnfrm.cxx             |    2 
 sw/source/core/layout/laycache.cxx           |   24 
 sw/source/core/layout/layhelp.hxx            |    7 
 sw/source/core/layout/paintfrm.cxx           |  208 +++++-
 sw/source/core/layout/tabfrm.cxx             |    4 
 sw/source/core/layout/trvlfrm.cxx            |   68 +-
 sw/source/core/layout/wsfrm.cxx              |   20 
 sw/source/core/sw3io/sw3convert.cxx          |  108 ---
 sw/source/core/swg/SwXMLTextBlocks.cxx       |   21 
 sw/source/core/table/swtable.cxx             |    8 
 sw/source/core/text/frmform.cxx              |   11 
 sw/source/core/text/frmpaint.cxx             |    6 
 sw/source/core/text/inftxt.cxx               |    3 
 sw/source/core/text/inftxt.hxx               |    8 
 sw/source/core/text/itradj.cxx               |    9 
 sw/source/core/text/itrcrsr.cxx              |   24 
 sw/source/core/text/porlay.cxx               |    4 
 sw/source/core/text/porlay.hxx               |    9 
 sw/source/core/text/pormulti.cxx             |    7 
 sw/source/core/text/redlnitr.cxx             |    9 
 sw/source/core/text/redlnitr.hxx             |   13 
 sw/source/core/text/txtfly.cxx               |   19 
 sw/source/core/text/txtfrm.cxx               |    7 
 sw/source/core/txtnode/fmtatr2.cxx           |    4 
 sw/source/core/txtnode/ndtxt.cxx             |    9 
 sw/source/core/txtnode/txtedt.cxx            |   67 +-
 sw/source/core/undo/undo.src                 |    2 
 sw/source/core/undo/untbl.cxx                |  131 +---
 sw/source/core/view/printdata.cxx            |    2 
 sw/source/core/view/viewsh.cxx               |    7 
 sw/source/core/view/vnew.cxx                 |    2 
 sw/source/filter/html/css1atr.cxx            |  195 +++---
 sw/source/filter/html/htmlatr.cxx            |   42 -
 sw/source/filter/html/htmlplug.cxx           |    6 
 sw/source/filter/html/svxcss1.cxx            |   35 +
 sw/source/filter/html/wrthtml.hxx            |    8 
 sw/source/filter/inc/fltshell.hxx            |   83 ++
 sw/source/filter/inc/msfilter.hxx            |   23 
 sw/source/filter/writer/writer.cxx           |    8 
 sw/source/filter/ww1/fltshell.cxx            |  363 ++++++-----
 sw/source/filter/ww8/WW8Sttbf.cxx            |   54 +
 sw/source/filter/ww8/attributeoutputbase.hxx |    3 
 sw/source/filter/ww8/docxattributeoutput.cxx |   66 +-
 sw/source/filter/ww8/docxattributeoutput.hxx |   20 
 sw/source/filter/ww8/docxexport.cxx          |   22 
 sw/source/filter/ww8/docxexport.hxx          |    3 
 sw/source/filter/ww8/docxexportfilter.cxx    |   11 
 sw/source/filter/ww8/escher.hxx              |    2 
 sw/source/filter/ww8/rtfsdrexport.cxx        |    7 
 sw/source/filter/ww8/rtfsdrexport.hxx        |    6 
 sw/source/filter/ww8/writerhelper.cxx        |    9 
 sw/source/filter/ww8/writerwordglue.cxx      |    7 
 sw/source/filter/ww8/wrtw8esh.cxx            |   43 +
 sw/source/filter/ww8/wrtw8nds.cxx            |    8 
 sw/source/filter/ww8/wrtww8.cxx              |   11 
 sw/source/filter/ww8/ww8atr.cxx              |    2 
 sw/source/filter/ww8/ww8graf.cxx             |  104 ++-
 sw/source/filter/ww8/ww8par.cxx              |  340 ++++++----
 sw/source/filter/ww8/ww8par.hxx              |  201 +++++-
 sw/source/filter/ww8/ww8par2.cxx             |  164 +----
 sw/source/filter/ww8/ww8par2.hxx             |  121 ---
 sw/source/filter/ww8/ww8par3.cxx             |  358 +++++------
 sw/source/filter/ww8/ww8par5.cxx             |   43 -
 sw/source/filter/ww8/ww8par6.cxx             |  147 ++--
 sw/source/filter/ww8/ww8scan.cxx             |  848 +++++++++++++++++----------
 sw/source/filter/ww8/ww8scan.hxx             |   53 +
 sw/source/filter/ww8/ww8toolbar.cxx          |   25 
 sw/source/filter/xml/xmlexpit.cxx            |   14 
 sw/source/filter/xml/xmlexpit.hxx            |    6 
 sw/source/filter/xml/xmlimp.cxx              |   20 
 sw/source/filter/xml/xmltexte.cxx            |    2 
 sw/source/ui/app/app.src                     |   10 
 sw/source/ui/app/docsh2.cxx                  |    2 
 sw/source/ui/app/mn.src                      |    1 
 sw/source/ui/config/usrpref.cxx              |   14 
 sw/source/ui/dbui/dbmgr.cxx                  |   64 +-
 sw/source/ui/dbui/mailmergechildwindow.cxx   |    4 
 sw/source/ui/docvw/edtwin.cxx                |   18 
 sw/source/ui/docvw/edtwin2.cxx               |   11 
 sw/source/ui/envelp/label1.cxx               |    6 
 sw/source/ui/inc/label.hxx                   |    9 
 sw/source/ui/inc/view.hxx                    |    3 
 sw/source/ui/misc/pggrid.cxx                 |    5 
 sw/source/ui/misc/titlepage.cxx              |    8 
 sw/source/ui/shells/grfsh.cxx                |    1 
 sw/source/ui/shells/textsh1.cxx              |   27 
 sw/source/ui/uiview/viewsrch.cxx             |   67 +-
 sw/source/ui/uno/detreg.cxx                  |    9 
 sw/source/ui/uno/unofreg.cxx                 |    9 
 sw/source/ui/vba/service.cxx                 |   22 
 sw/source/ui/vba/vbadocument.cxx             |    4 
 sw/source/ui/vba/vbafield.cxx                |    3 
 sw/uiconfig/sglobal/menubar/menubar.xml      |    1 
 sw/uiconfig/sglobal/toolbar/standardbar.xml  |    2 
 sw/uiconfig/sweb/toolbar/standardbar.xml     |    2 
 sw/uiconfig/swform/menubar/menubar.xml       |    1 
 sw/uiconfig/swform/toolbar/standardbar.xml   |    2 
 sw/uiconfig/swreport/menubar/menubar.xml     |    1 
 sw/uiconfig/swreport/toolbar/standardbar.xml |    2 
 sw/uiconfig/swriter/menubar/menubar.xml      |    1 
 sw/uiconfig/swriter/toolbar/standardbar.xml  |    2 
 sw/uiconfig/swxform/menubar/menubar.xml      |    1 
 sw/uiconfig/swxform/toolbar/standardbar.xml  |    2 
 sw/util/msword.component                     |    3 
 sw/util/sw.component                         |    3 
 sw/util/swd.component                        |    2 
 sw/util/vbaswobj.component                   |    2 
 187 files changed, 3396 insertions(+), 2258 deletions(-)

New commits:
commit 5c2e5bba411e367ffae7feac6a84b58569f6c91e
Merge: 3228802... b77c9a6...
Author: Bjoern Michaelsen <bjoern.michaelsen at canonical.com>
Date:   Thu Jul 21 19:01:55 2011 +0200

    resyncing to master

diff --cc starmath/Library_sm.mk
index 7e5162f,8bed8a5..6d9e05e
--- a/starmath/Library_sm.mk
+++ b/starmath/Library_sm.mk
@@@ -31,11 -31,22 +31,15 @@@ $(eval $(call gb_Library_set_include,sm
          -I$(realpath $(SRCDIR)/starmath/inc/pch) \
          -I$(realpath $(SRCDIR)/starmath/inc) \
          -I$(WORKDIR)/SdiTarget/starmath/sdi \
 -        -I$(WORKDIR)/Misc/starmath/ \
          $$(INCLUDE) \
          -I$(OUTDIR)/inc \
  ))
  
 -$(eval $(call gb_Library_set_defs,sm,\
 -        $$(DEFS) \
 -        -DSMDLL \
 -        -DSC_INFO_OSVERSION=\"$(OS)\" \
+ ))
+ 
+ $(eval $(call gb_Library_add_api,sm,\
+     offapi \
+     udkapi \
 -))
 -
  $(eval $(call gb_Library_add_linked_libs,sm,\
          comphelper \
          cppu \
diff --cc starmath/Library_smd.mk
index 5653614,4889413..995cd77
--- a/starmath/Library_smd.mk
+++ b/starmath/Library_smd.mk
@@@ -32,10 -26,20 +32,14 @@@ $(eval $(call gb_Library_add_precompile
  $(eval $(call gb_Library_set_componentfile,smd,starmath/util/smd))
  
  $(eval $(call gb_Library_set_include,smd,\
 -        -I$(realpath $(SRCDIR)/starmath/inc/pch) \
 -        -I$(realpath $(SRCDIR)/starmath/inc) \
 -        -I$(WORKDIR)/Misc/sm/ \
 -        $$(INCLUDE) \
 -        -I$(OUTDIR)/inc \
 -))
 -
 -$(eval $(call gb_Library_set_defs,smd,\
 -        $$(DEFS) \
 +	$$(INCLUDE) \
 +	-I$(SRCDIR)/starmath/inc \
 +	-I$(SRCDIR)/starmath/inc/pch \
- 	-I$(OUTDIR)/inc/offuh \
+ ))
+ 
+ $(eval $(call gb_Library_add_api,smd,\
+     offapi \
+     udkapi \
  ))
  
  $(eval $(call gb_Library_add_linked_libs,smd,\
diff --cc sw/Library_msword.mk
index e90639e,00870e3..c06bbcb
--- a/sw/Library_msword.mk
+++ b/sw/Library_msword.mk
@@@ -42,7 -42,15 +42,11 @@@ $(eval $(call gb_Library_set_include,ms
      -I$(OUTDIR)/inc/sw \
  ))
  
+ $(eval $(call gb_Library_add_api,msword,\
+ 	udkapi \
+ 	offapi \
+ ))
+ 
 -$(eval $(call gb_Library_set_defs,msword,\
 -    $$(DEFS) \
 -))
 -
  $(eval $(call gb_Library_add_linked_libs,msword,\
      basegfx \
      comphelper \
diff --cc sw/Library_sw.mk
index a2a555a,82ea9aa..e541473
--- a/sw/Library_sw.mk
+++ b/sw/Library_sw.mk
@@@ -46,8 -46,13 +46,12 @@@ $(eval $(call gb_Library_set_include,sw
      -I$(OUTDIR)/inc \
  ))
  
+ $(eval $(call gb_Library_add_api,sw,\
+ 	udkapi \
+ 	offapi \
+ ))
+ 
 -$(eval $(call gb_Library_set_defs,sw,\
 -    $$(DEFS) \
 +$(eval $(call gb_Library_add_defs,sw,\
      -DSW_DLLIMPLEMENTATION \
  ))
  
diff --cc sw/Library_swd.mk
index 067adb7,b155983..5298884
--- a/sw/Library_swd.mk
+++ b/sw/Library_swd.mk
@@@ -38,11 -38,15 +38,15 @@@ $(eval $(call gb_Library_set_include,sw
      -I$(realpath $(SRCDIR)/sw/source/core/inc) \
      -I$(realpath $(SRCDIR)/sw/source/filter/inc) \
      -I$(realpath $(SRCDIR)/sw/source/ui/inc) \
-     -I$(OUTDIR)/inc/offuh \
+ ))
+ 
+ $(eval $(call gb_Library_add_api,swd,\
+ 	udkapi \
+ 	offapi \
  ))
  
 -$(eval $(call gb_Library_set_defs,swd,\
 -    $$(DEFS) \
 +$(eval $(call gb_Library_add_defs,swd,\
 +	-DSWD_DLLIMPLEMENTATION \
      -DSWD_DLLIMPLEMENTATION \
  ))
  
diff --cc sw/Library_swui.mk
index c46b603,2cdf1b5..9649aab
--- a/sw/Library_swui.mk
+++ b/sw/Library_swui.mk
@@@ -36,9 -36,17 +36,13 @@@ $(eval $(call gb_Library_set_include,sw
      -I$(WORKDIR)/SdiTarget/sw/sdi \
      -I$(WORKDIR)/Misc/sw \
      $$(INCLUDE) \
-     -I$(OUTDIR)/inc/offuh \
  ))
  
 -$(eval $(call gb_Library_set_defs,swui,\
 -    $$(DEFS) \
+ ))
+ 
+ $(eval $(call gb_Library_add_api,swui,\
+ 	udkapi \
+ 	offapi \
 -))
 -
  $(eval $(call gb_Library_add_linked_libs,swui,\
      comphelper \
      cppu \
commit b77c9a6716a76fb0ccea9a389482ac9dfdf7dce4
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jul 21 09:16:24 2011 +0100

    check reads and seeks

diff --git a/sw/source/filter/ww8/wrtww8.cxx b/sw/source/filter/ww8/wrtww8.cxx
index 732b8f2..f657ad0 100644
--- a/sw/source/filter/ww8/wrtww8.cxx
+++ b/sw/source/filter/ww8/wrtww8.cxx
@@ -2875,10 +2875,10 @@ namespace
         rIn.Seek(0);
 
         sal_uInt8 in[WW_BLOCKSIZE];
-        for (sal_uLong nI = 0, nBlock = 0; nI < nLen; nI += WW_BLOCKSIZE, ++nBlock)
+        for (sal_Size nI = 0, nBlock = 0; nI < nLen; nI += WW_BLOCKSIZE, ++nBlock)
         {
-            sal_uLong nBS = (nLen - nI > WW_BLOCKSIZE) ? WW_BLOCKSIZE : nLen - nI;
-            rIn.Read(in, nBS);
+            sal_Size nBS = (nLen - nI > WW_BLOCKSIZE) ? WW_BLOCKSIZE : nLen - nI;
+            nBS = rIn.Read(in, nBS);
             rCtx.InitCipher(nBlock);
             rCtx.Encode(in, nBS, in, nBS);
             rOut.Write(in, nBS);
@@ -3510,8 +3510,9 @@ void WW8Export::RestoreMacroCmds()
             pStream->Seek(0);
 
             sal_uInt8 *pBuffer = new sal_uInt8[pFib->lcbCmds];
-            pStream->Read(pBuffer, pFib->lcbCmds);
-            pTableStrm->Write(pBuffer, pFib->lcbCmds);
+            bool bReadOk = checkRead(*pStream, pBuffer, pFib->lcbCmds);
+            if (bReadOk)
+                pTableStrm->Write(pBuffer, pFib->lcbCmds);
             delete[] pBuffer;
 
         }
diff --git a/sw/source/filter/ww8/ww8graf.cxx b/sw/source/filter/ww8/ww8graf.cxx
index 7d01d31..492a5d3 100644
--- a/sw/source/filter/ww8/ww8graf.cxx
+++ b/sw/source/filter/ww8/ww8graf.cxx
@@ -98,7 +98,7 @@
 #include <basegfx/point/b2dpoint.hxx>
 #include <basegfx/polygon/b2dpolygon.hxx>
 #include <editeng/editobj.hxx>
-
+#include <boost/scoped_ptr.hpp>
 #include <math.h>
 
 using ::editeng::SvxBorderLine;
@@ -182,7 +182,11 @@ bool SwWW8ImplReader::ReadGrafStart(void* pData, short nDataSiz,
         pStrm->SeekRel(SVBT16ToShort(pHd->cb) - sizeof(WW8_DPHEAD));
         return false;
     }
-    pStrm->Read(pData, nDataSiz);
+
+    bool bCouldRead = checkRead(*pStrm, pData, nDataSiz);
+    OSL_ENSURE(bCouldRead, "Short Graphic header");
+    if (!bCouldRead)
+        return false;
 
     RndStdIds eAnchor = (SVBT8ToByte(pDo->by) < 2) ? FLY_AT_PAGE : FLY_AT_PARA;
     rSet.Put(SwFmtAnchor(eAnchor));
@@ -443,20 +447,24 @@ SdrObject* SwWW8ImplReader::ReadPolyLine( WW8_DPHEAD* pHd, const WW8_DO* pDo,
         return 0;
 
     sal_uInt16 nCount = SVBT16ToShort( aPoly.aBits1 ) >> 1 & 0x7fff;
-    SVBT16 *pP = new SVBT16[nCount * 2];
-    pStrm->Read( pP, nCount * 4 );      // Punkte einlesen
+    boost::scoped_array<SVBT16> xP(new SVBT16[nCount * 2]);
+
+    bool bCouldRead = checkRead(*pStrm, xP.get(), nCount * 4);      // Punkte einlesen
+    OSL_ENSURE(bCouldRead, "Short PolyLine header");
+    if (!bCouldRead)
+        return 0;
+
     Polygon aP( nCount );
     Point aPt;
-    sal_uInt16 i;
-
-    for( i=0; i<nCount; i++ ){
-        aPt.X() = SVBT16ToShort( pP[i << 1] ) + nDrawXOfs2
+    for (sal_uInt16 i=0; i<nCount; ++i)
+    {
+        aPt.X() = SVBT16ToShort( xP[i << 1] ) + nDrawXOfs2
                   + (sal_Int16)SVBT16ToShort( pHd->xa );
-        aPt.Y() = SVBT16ToShort( pP[( i << 1 ) + 1] ) + nDrawYOfs2
+        aPt.Y() = SVBT16ToShort( xP[( i << 1 ) + 1] ) + nDrawYOfs2
                   + (sal_Int16)SVBT16ToShort( pHd->ya );
         aP[i] = aPt;
     }
-    delete[] pP;
+    xP.reset();
 
     SdrObject* pObj = new SdrPathObj(( SVBT16ToShort( aPoly.aBits1 ) & 0x1 ) ? OBJ_POLY : OBJ_PLIN, ::basegfx::B2DPolyPolygon(aP.getB2DPolygon()));
     SetStdAttr( rSet, aPoly.aLnt, aPoly.aShd );
@@ -1248,10 +1256,15 @@ SdrObject* SwWW8ImplReader::ReadCaptionBox( WW8_DPHEAD* pHd, const WW8_DO* pDo,
         return 0;
 
     sal_uInt16 nCount = SVBT16ToShort( aCallB.dpPolyLine.aBits1 ) >> 1 & 0x7fff;
-    SVBT16 *pP = new SVBT16[nCount * 2];
-    pStrm->Read( pP, nCount * 4 );      // Punkte einlesen
+    boost::scoped_array<SVBT16> xP(new SVBT16[nCount * 2]);
+
+    bool bCouldRead = checkRead(*pStrm, xP.get(), nCount * 4);      // Punkte einlesen
+    OSL_ENSURE(bCouldRead, "Short CaptionBox header");
+    if (!bCouldRead)
+        return 0;
+
     sal_uInt8 nTyp = (sal_uInt8)nCount - 1;
-    if( nTyp == 1 && SVBT16ToShort( pP[0] ) == SVBT16ToShort( pP[2] ) )
+    if( nTyp == 1 && SVBT16ToShort( xP[0] ) == SVBT16ToShort( xP[2] ) )
         nTyp = 0;
 
     Point aP0( (sal_Int16)SVBT16ToShort( pHd->xa ) +
@@ -1263,11 +1276,11 @@ SdrObject* SwWW8ImplReader::ReadCaptionBox( WW8_DPHEAD* pHd, const WW8_DO* pDo,
     aP1.Y() += (sal_Int16)SVBT16ToShort( aCallB.dpheadTxbx.dya );
     Point aP2( (sal_Int16)SVBT16ToShort( pHd->xa )
                 + (sal_Int16)SVBT16ToShort( aCallB.dpheadPolyLine.xa )
-                + nDrawXOfs2 + (sal_Int16)SVBT16ToShort( pP[0] ),
+                + nDrawXOfs2 + (sal_Int16)SVBT16ToShort( xP[0] ),
                (sal_Int16)SVBT16ToShort( pHd->ya )
                + (sal_Int16)SVBT16ToShort( aCallB.dpheadPolyLine.ya )
-               + nDrawYOfs2 + (sal_Int16)SVBT16ToShort( pP[1] ) );
-    delete[] pP;
+               + nDrawYOfs2 + (sal_Int16)SVBT16ToShort( xP[1] ) );
+    xP.reset();
 
     SdrCaptionObj* pObj = new SdrCaptionObj( Rectangle( aP0, aP1 ), aP2 );
     pObj->SetModel( pDrawModel );
@@ -1334,7 +1347,13 @@ SdrObject* SwWW8ImplReader::ReadGrafPrimitive( short& rLeft, const WW8_DO* pDo,
     //into an object hierarachy with a little effort.
     SdrObject *pRet=0;
     WW8_DPHEAD aHd;                         // Lese Draw-Primitive-Header
-    pStrm->Read(&aHd, sizeof(WW8_DPHEAD));
+    bool bCouldRead = checkRead(*pStrm, &aHd, sizeof(WW8_DPHEAD));
+    OSL_ENSURE(bCouldRead, "Graphic Primitive header short read" );
+    if (!bCouldRead)
+    {
+        rLeft=0;
+        return pRet;
+    }
 
     if( rLeft >= SVBT16ToShort(aHd.cb) )    // Vorsichtsmassmahme
     {
@@ -1394,9 +1413,18 @@ void SwWW8ImplReader::ReadGrafLayer1( WW8PLCFspecial* pPF, long nGrafAnchorCp )
         OSL_ENSURE( !this, "+Wo ist die Grafik (3) ?" );
         return;
     }
+
+    bool bCouldSeek = checkSeek(*pStrm, SVBT32ToUInt32(pF->fc));
+    OSL_ENSURE(bCouldSeek, "Invalid Graphic offset");
+    if (!bCouldSeek)
+        return;
+
+    // Lese Draw-Header
     WW8_DO aDo;
-    pStrm->Seek( SVBT32ToUInt32( pF->fc ) );                  // Lese Draw-Header
-    pStrm->Read( &aDo, sizeof( WW8_DO ) );
+    bool bCouldRead = checkRead(*pStrm, &aDo, sizeof(WW8_DO));
+    OSL_ENSURE(bCouldRead, "Short Graphic header");
+    if (!bCouldRead)
+        return;
 
     short nLeft = SVBT16ToShort( aDo.cb ) - sizeof( WW8_DO );
     while (nLeft > static_cast<short>(sizeof(WW8_DPHEAD)))
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 99e2fbf..9932661 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -4136,7 +4136,7 @@ void SwWW8ImplReader::StoreMacroCmds()
             SvStream* pStream = ::utl::UcbStreamHelper::CreateStream( xStream );
 
             sal_uInt8 *pBuffer = new sal_uInt8[pWwFib->lcbCmds];
-            pTableStream->Read(pBuffer, pWwFib->lcbCmds);
+            pWwFib->lcbCmds = pTableStream->Read(pBuffer, pWwFib->lcbCmds);
             pStream->Write(pBuffer, pWwFib->lcbCmds);
             delete[] pBuffer;
             delete pStream;
@@ -4829,7 +4829,7 @@ namespace
         for (sal_Size nI = 0, nBlock = 0; nI < nLen; nI += WW_BLOCKSIZE, ++nBlock)
         {
             sal_Size nBS = (nLen - nI > WW_BLOCKSIZE) ? WW_BLOCKSIZE : nLen - nI;
-            rIn.Read(in, nBS);
+            nBS = rIn.Read(in, nBS);
             rCtx.InitCipher(nBlock);
             rCtx.Decode(in, nBS, in, nBS);
             rOut.Write(in, nBS);
@@ -4838,19 +4838,19 @@ namespace
 
     void DecryptXOR(msfilter::MSCodec_XorWord95 &rCtx, SvStream &rIn, SvStream &rOut)
     {
-        sal_uLong nSt = rIn.Tell();
+        sal_Size nSt = rIn.Tell();
         rIn.Seek(STREAM_SEEK_TO_END);
-        sal_uLong nLen = rIn.Tell();
+        sal_Size nLen = rIn.Tell();
         rIn.Seek(nSt);
 
         rCtx.InitCipher();
         rCtx.Skip(nSt);
 
         sal_uInt8 in[0x4096];
-        for (sal_uLong nI = nSt; nI < nLen; nI += 0x4096)
+        for (sal_Size nI = nSt; nI < nLen; nI += 0x4096)
         {
-            sal_uLong nBS = (nLen - nI > 0x4096 ) ? 0x4096 : nLen - nI;
-            rIn.Read(in, nBS);
+            sal_Size nBS = (nLen - nI > 0x4096 ) ? 0x4096 : nLen - nI;
+            nBS = rIn.Read(in, nBS);
             rCtx.Decode(in, nBS);
             rOut.Write(in, nBS);
         }
@@ -5056,7 +5056,7 @@ sal_uLong SwWW8ImplReader::LoadThroughDecryption(SwPaM& rPaM ,WW8Glossary *pGlos
                         size_t nUnencryptedHdr =
                             (8 == pWwFib->nVersion) ? 0x44 : 0x34;
                         sal_uInt8 *pIn = new sal_uInt8[nUnencryptedHdr];
-                        pStrm->Read(pIn, nUnencryptedHdr);
+                        nUnencryptedHdr = pStrm->Read(pIn, nUnencryptedHdr);
                         aDecryptMain.Write(pIn, nUnencryptedHdr);
                         delete [] pIn;
 
@@ -5087,17 +5087,20 @@ sal_uLong SwWW8ImplReader::LoadThroughDecryption(SwPaM& rPaM ,WW8Glossary *pGlos
                 break;
                 case RC4:
                 {
-                    msfilter::MSCodec_Std97 aCtx;
-
                     sal_uInt8 aDocId[ 16 ];
-                    pTableStream->Read(aDocId, 16);
                     sal_uInt8 aSaltData[ 16 ];
-                    pTableStream->Read(aSaltData, 16);
                     sal_uInt8 aSaltHash[ 16 ];
-                    pTableStream->Read(aSaltHash, 16);
 
+                    bool bCouldReadHeaders =
+                        checkRead(*pTableStream, aDocId, 16) &&
+                        checkRead(*pTableStream, aSaltData, 16) &&
+                        checkRead(*pTableStream, aSaltHash, 16);
+
+                    msfilter::MSCodec_Std97 aCtx;
                     // if initialization has failed the EncryptionData should be empty
-                    uno::Sequence< beans::NamedValue > aEncryptionData = InitStd97Codec( aCtx, aDocId, *pMedium );
+                    uno::Sequence< beans::NamedValue > aEncryptionData;
+                    if (bCouldReadHeaders)
+                        aEncryptionData = InitStd97Codec( aCtx, aDocId, *pMedium );
                     if ( aEncryptionData.getLength() && aCtx.VerifyKey( aSaltData, aSaltHash ) )
                     {
                         nErrRet = 0;
@@ -5105,9 +5108,9 @@ sal_uLong SwWW8ImplReader::LoadThroughDecryption(SwPaM& rPaM ,WW8Glossary *pGlos
                         pTempMain = MakeTemp(aDecryptMain);
 
                         pStrm->Seek(0);
-                        const sal_Size nUnencryptedHdr = 0x44;
+                        sal_Size nUnencryptedHdr = 0x44;
                         sal_uInt8 *pIn = new sal_uInt8[nUnencryptedHdr];
-                        pStrm->Read(pIn, nUnencryptedHdr);
+                        nUnencryptedHdr = pStrm->Read(pIn, nUnencryptedHdr);
 
                         DecryptRC4(aCtx, *pStrm, aDecryptMain);
 
diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index ad0ec3c..79e930d 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -3694,8 +3694,7 @@ static inline short WW8SkipOdd(SvStream* pSt )
     if ( pSt->Tell() & 0x1 )
     {
         sal_uInt8 c;
-        pSt->Read( &c, 1 );
-        return 1;
+        return pSt->Read( &c, 1 );
     }
     return 0;
 }
@@ -3705,8 +3704,7 @@ static inline short WW8SkipEven(SvStream* pSt )
     if (!(pSt->Tell() & 0x1))
     {
         sal_uInt8 c;
-        pSt->Read( &c, 1 );
-        return 1;
+        return pSt->Read( &c, 1 );
     }
     return 0;
 }
diff --git a/sw/source/filter/ww8/ww8par6.cxx b/sw/source/filter/ww8/ww8par6.cxx
index 9870083..578a3a6 100644
--- a/sw/source/filter/ww8/ww8par6.cxx
+++ b/sw/source/filter/ww8/ww8par6.cxx
@@ -1689,10 +1689,11 @@ void WW8FlyPara::ReadFull(sal_uInt8 nOrigSp29, SwWW8ImplReader* pIo)
         bGrafApo = false;
 
         do{             // Block zum rausspringen
-
             sal_uInt8 nTxt[2];
 
-            pIoStrm->Read( nTxt, 2 );                   // lies Text
+            if (!checkRead(*pIoStrm, nTxt, 2)) // lies Text
+                break;
+
             if( nTxt[0] != 0x01 || nTxt[1] != 0x0d )// nur Grafik + CR ?
                 break;                              // Nein
 
@@ -1703,7 +1704,8 @@ void WW8FlyPara::ReadFull(sal_uInt8 nOrigSp29, SwWW8ImplReader* pIo)
             const sal_uInt8* pS = pPap->HasSprm( bVer67 ? 29 : 0x261B );
 
             // Nein -> Grafik-Apo
-            if( !pS ){
+            if (!pS)
+            {
                 bGrafApo = true;
                 break;                              // Ende des APO
             }
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 5bfd5de..3782dfd 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -1541,7 +1541,7 @@ WW8PLCFpcd* WW8ScannerBase::OpenPieceTable( SvStream* pStr, const WW8Fib* pWwF )
         *pStr >> nLen;
         nLeft -= 2 + nLen;
         if( nLeft < 0 )
-            return 0;                           // schiefgegangen
+            return NULL;                        // schiefgegangen
         pStr->SeekRel( nLen );                  // ueberlies grpprl
     }
 
@@ -1564,12 +1564,16 @@ WW8PLCFpcd* WW8ScannerBase::OpenPieceTable( SvStream* pStr, const WW8Fib* pWwF )
         *pStr >> nLen;
         nLeft -= 2 + nLen;
         if( nLeft < 0 )
-            return 0;                           // schiefgegangen
+            return NULL;                        // schiefgegangen
         if( 1 == clxt )                         // clxtGrpprl ?
         {
             sal_uInt8* p = new sal_uInt8[nLen+2];         // alloziere
             ShortToSVBT16(nLen, p);             // trage Laenge ein
-            pStr->Read( p+2, nLen );            // lies grpprl
+            if (!checkRead(*pStr, p+2, nLen))   // lies grpprl
+            {
+                delete[] p;
+                return NULL;
+            }
             pPieceGrpprls[nAktGrpprl++] = p;    // trage in Array ein
         }
         else
@@ -2510,20 +2514,22 @@ WW8PLCFx_Fc_FKP::WW8Fkp::WW8Fkp(ww::WordVersion eVersion, SvStream* pSt,
     : nItemSize(nItemSiz), nFilePos(_nFilePos),  mnIdx(0), ePLCF(ePl),
     maSprmParser(eVersion)
 {
-    long nOldPos = pSt->Tell();
-
-    pSt->Seek(nFilePos);
     memset(maRawData, 0, 512);
-    pSt->Read(maRawData, 512);
-    mnIMax = maRawData[511];
+
+    sal_Size nOldPos = pSt->Tell();
+
+    bool bCouldSeek = checkSeek(*pSt, nFilePos);
+    bool bCouldRead = bCouldSeek ? checkRead(*pSt, maRawData, 512) : false;
+
+    mnIMax = bCouldRead ? maRawData[511] : 0;
 
     sal_uInt8 *pStart = maRawData;
     // Offset-Location in maRawData
-    size_t nRawDataStart = (mnIMax + 1) * 4;
+    const size_t nRawDataStart = (mnIMax + 1) * 4;
 
     for (mnIdx = 0; mnIdx < mnIMax; ++mnIdx)
     {
-        size_t nRawDataOffset = nRawDataStart + mnIdx * nItemSize;
+        const size_t nRawDataOffset = nRawDataStart + mnIdx * nItemSize;
 
         //clip to available data, corrupt fkp
         if (nRawDataOffset >= 511)
commit c943149136404beaddc6422752c66faa20dbd2c1
Author: Thomas Arnhold <thomas at arnhold.org>
Date:   Tue Jul 19 15:33:12 2011 +0200

    callcatcher: remove unused lcl_SkipNPages

diff --git a/sw/source/ui/misc/titlepage.cxx b/sw/source/ui/misc/titlepage.cxx
index f41bc49..6aac405 100644
--- a/sw/source/ui/misc/titlepage.cxx
+++ b/sw/source/ui/misc/titlepage.cxx
@@ -73,14 +73,6 @@ namespace
         return bRet;
     }
 
-    bool lcl_SkipNPages(SwWrtShell *pSh, sal_uInt16 nNoPages)
-    {
-        bool bAllOk = true;
-        for (sal_uInt16 nI = 0; nI < nNoPages && bAllOk; ++nI)
-            bAllOk = pSh->SttNxtPg();
-        return bAllOk;
-    }
-
     void lcl_ChangePage(SwWrtShell *pSh, sal_uInt16 nNewNumber,
         const SwPageDesc *pNewDesc)
     {
commit e9c8beb4467fe352ff1ac482d5b99116607d11ce
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Jul 20 09:57:31 2011 +0100

    check for short reads

diff --git a/sw/source/filter/ww8/WW8Sttbf.cxx b/sw/source/filter/ww8/WW8Sttbf.cxx
index f8edb7f..5325dda 100644
--- a/sw/source/filter/ww8/WW8Sttbf.cxx
+++ b/sw/source/filter/ww8/WW8Sttbf.cxx
@@ -29,6 +29,7 @@
 #include <iostream>
 #include <dbgoutsw.hxx>
 #include "WW8Sttbf.hxx"
+#include "ww8scan.hxx"
 #include <cstdio>
 #include <osl/endian.h>
 #include <rtl/ustrbuf.hxx>
@@ -40,17 +41,19 @@
 namespace ww8
 {
     WW8Struct::WW8Struct(SvStream& rSt, sal_uInt32 nPos, sal_uInt32 nSize)
-    : mn_offset(0), mn_size(nSize)
+        : mn_offset(0), mn_size(0)
     {
-        rSt.Seek(nPos);
-        
-        mp_data.reset(new sal_uInt8[nSize]);
-        rSt.Read(mp_data.get(), nSize);                
+        if (checkSeek(rSt, nPos))
+        {
+            mp_data.reset(new sal_uInt8[nSize]);
+            mn_size = rSt.Read(mp_data.get(), nSize);
+        }
+        OSL_ENSURE(mn_size == nSize, "short read in WW8Struct::WW8Struct");
     }
     
     WW8Struct::WW8Struct(WW8Struct * pStruct, sal_uInt32 nPos, sal_uInt32 nSize)
-    : mp_data(pStruct->mp_data), mn_offset(pStruct->mn_offset + nPos), 
-    mn_size(nSize)
+        : mp_data(pStruct->mp_data), mn_offset(pStruct->mn_offset + nPos)
+        , mn_size(nSize)
     {
     }
     
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 485083d..5bfd5de 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -1518,31 +1518,36 @@ WW8_FC WW8ScannerBase::WW8Cp2Fc(WW8_CP nCpPos, bool* pIsUnicode,
 WW8PLCFpcd* WW8ScannerBase::OpenPieceTable( SvStream* pStr, const WW8Fib* pWwF )
 {
     if ( ((8 > pWw8Fib->nVersion) && !pWwF->fComplex) || !pWwF->lcbClx )
-        return 0;
+        return NULL;
 
     WW8_FC nClxPos = pWwF->fcClx;
     sal_Int32 nClxLen = pWwF->lcbClx;
     sal_Int32 nLeft = nClxLen;
     sal_Int16 nGrpprl = 0;
-    sal_uInt8 clxt;
 
-    pStr->Seek( nClxPos );
+    if (!checkSeek(*pStr, nClxPos))
+        return NULL;
+
     while( 1 ) // Zaehle Zahl der Grpprls
     {
+        sal_uInt8 clxt(2);
         *pStr >> clxt;
         nLeft--;
         if( 2 == clxt )                         // PLCFfpcd ?
             break;                              // PLCFfpcd gefunden
         if( 1 == clxt )                         // clxtGrpprl ?
             nGrpprl++;
-        sal_uInt16 nLen;
+        sal_uInt16 nLen(0);
         *pStr >> nLen;
         nLeft -= 2 + nLen;
         if( nLeft < 0 )
             return 0;                           // schiefgegangen
         pStr->SeekRel( nLen );                  // ueberlies grpprl
     }
-    pStr->Seek( nClxPos );
+
+    if (!checkSeek(*pStr, nClxPos))
+        return NULL;
+
     nLeft = nClxLen;
     pPieceGrpprls = new sal_uInt8*[nGrpprl + 1];
     memset( pPieceGrpprls, 0, ( nGrpprl + 1 ) * sizeof(sal_uInt8 *) );
@@ -1550,11 +1555,12 @@ WW8PLCFpcd* WW8ScannerBase::OpenPieceTable( SvStream* pStr, const WW8Fib* pWwF )
     sal_Int16 nAktGrpprl = 0;                       // lies Grpprls ein
     while( 1 )
     {
+        sal_uInt8 clxt(2);
         *pStr >> clxt;
         nLeft--;
         if( 2 == clxt)                          // PLCFfpcd ?
             break;                              // PLCFfpcd gefunden
-        sal_uInt16 nLen;
+        sal_uInt16 nLen(0);
         *pStr >> nLen;
         nLeft -= 2 + nLen;
         if( nLeft < 0 )
@@ -1570,10 +1576,10 @@ WW8PLCFpcd* WW8ScannerBase::OpenPieceTable( SvStream* pStr, const WW8Fib* pWwF )
             pStr->SeekRel( nLen );              // ueberlies nicht-Grpprl
     }
     // lies Piece Table PLCF ein
-    sal_Int32 nPLCFfLen;
+    sal_Int32 nPLCFfLen(0);
     if (pWwF->GetFIBVersion() <= ww::eWW2)
     {
-        sal_Int16 nWordTwoLen;
+        sal_Int16 nWordTwoLen(0);
         *pStr >> nWordTwoLen;
         nPLCFfLen = nWordTwoLen;
     }
commit 5393c0d0d3170fc1ba03f2ac86e107ceeb999305
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Jul 19 21:35:42 2011 +0100

    use SprmIterator here too instead of hand-rolled loop

diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index a772166..f715359 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -684,14 +684,15 @@ bool WW8ListManager::ReadLVL(SwNumFmt& rNumFmt, SfxItemSet*& rpItemSet,
         // spezielle ItemSet relevant ist - und nicht ein Stack oder Style!
         sal_uInt16 nOldFlags1 = rReader.GetToggleAttrFlags();
         sal_uInt16 nOldFlags2 = rReader.GetToggleBiDiAttrFlags();
-        short nLen      = aLVL.nLenGrpprlChpx;
-        sal_uInt8* pSprms1  = &aGrpprlChpx[0];
-        while (0 < nLen)
+
+        WW8SprmIter aSprmIter(&aGrpprlChpx[0], aLVL.nLenGrpprlChpx,
+            maSprmParser);
+        while (const sal_uInt8* pSprm = aSprmIter.GetSprms())
         {
-            sal_uInt16 nL1 = rReader.ImportSprm( pSprms1 );
-            nLen       = nLen - nL1;
-            pSprms1   += nL1;
+            rReader.ImportSprm(pSprm);
+            aSprmIter.advance();
         }
+
         // Reader-ItemSet-Pointer und Reader-Style zuruecksetzen
         rReader.SetAktItemSet( 0 );
         rReader.SetNAktColl( nOldColl );
commit 188b1ae73fddd2a1454c10f61cbdf40db723433b
Author: Julien Nabet <serval2412 at yahoo.fr>
Date:   Tue Jul 19 23:54:50 2011 +0200

    fix an extra comma (was already referenced OOo bug 87057)

diff --git a/sw/source/ui/config/usrpref.cxx b/sw/source/ui/config/usrpref.cxx
index 20627df..de73d21 100644
--- a/sw/source/ui/config/usrpref.cxx
+++ b/sw/source/ui/config/usrpref.cxx
@@ -250,7 +250,7 @@ Sequence<OUString> SwLayoutViewConfig::GetPropertyNames()
         "Window/IsVerticalRulerRight",          //16
         "ViewLayout/Columns",                   //17
         "ViewLayout/BookMode",                  //18
-        "Other/IsSquaredPageMode"               //19
+        "Other/IsSquaredPageMode",              //19
         "Other/ApplyCharUnit"                   //20
     };
     const int nCount = bWeb ? 15 : 21;
@@ -315,7 +315,7 @@ void SwLayoutViewConfig::Commit()
             case 17: rVal <<= (sal_Int32)rParent.GetViewLayoutColumns(); break;     // "ViewLayout/Columns",
             case 18: rVal <<= (sal_Bool) rParent.IsViewLayoutBookMode(); break;     // "ViewLayout/BookMode",
             case 19: rVal <<= (sal_Bool) rParent.IsSquaredPageMode(); break;        // "Other/IsSquaredPageMode",
-            case 20: rVal <<= (sal_Bool) rParent.IsApplyCharUnit(); break;        // "Other/IsSquaredPageMode",
+            case 20: rVal <<= (sal_Bool) rParent.IsApplyCharUnit(); break;        // "Other/ApplyCharUnit",
         }
     }
     PutProperties(aNames, aValues);
commit 3479fad9ad14ebf2b797bc9e0e0c12ba257a082b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Jul 19 14:24:52 2011 +0100

    I knew there was something screwy about that use of getVersion

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index f2e1911..485083d 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -909,13 +909,18 @@ void WW8SprmIter::advance()
 
 void WW8SprmIter::UpdateMyMembers()
 {
-    if (pSprms && nRemLen > (mrSprmParser.getVersion()?1:0))
+    bool bValid = (pSprms && nRemLen >= mrSprmParser.MinSprmLen());
+
+    if (bValid)
     {
         nAktId = mrSprmParser.GetSprmId(pSprms);
-        pAktParams = pSprms + mrSprmParser.DistanceToData(nAktId);
         nAktSize = mrSprmParser.GetSprmSize(nAktId, pSprms);
+        pAktParams = pSprms + mrSprmParser.DistanceToData(nAktId);
+        bValid = nAktSize <= nRemLen;
+        OSL_ENSURE(bValid, "sprm longer than remaining bytes");
     }
-    else
+
+    if (!bValid)
     {
         nAktId = 0;
         pAktParams = 0;
@@ -7445,7 +7450,7 @@ sal_uInt16 wwSprmParser::DistanceToData(sal_uInt16 nId) const
 sal_uInt8* wwSprmParser::findSprmData(sal_uInt16 nId, sal_uInt8* pSprms,
     sal_uInt16 nLen) const
 {
-    while (nLen > (getVersion()?1:0))
+    while (nLen >= MinSprmLen())
     {
         sal_uInt16 nAktId = GetSprmId(pSprms);
         // gib Zeiger auf Daten
diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx
index b2d7747..1811cb3 100644
--- a/sw/source/filter/ww8/ww8scan.hxx
+++ b/sw/source/filter/ww8/ww8scan.hxx
@@ -149,8 +149,6 @@ public:
     //  if not found. nLen must be the <= length of pSprms
     sal_uInt8* findSprmData(sal_uInt16 nId, sal_uInt8* pSprms, sal_uInt16 nLen)
         const;
-
-    inline int getVersion() const { return meVersion; } //cmc, I'm dubious about the usage of this, how can it be 0
 };
 
 //--Line abovewhich the code has meaningful comments
commit b375e1bb75730d06f3a9dcc2b6b1c5886749ecfd
Author: Luboš Luňák <l.lunak at suse.cz>
Date:   Tue Jul 19 14:32:21 2011 +0200

    comment out an unused variable for now

diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx b/sw/source/filter/ww8/docxattributeoutput.cxx
index e5bac97..9e066a0 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -3325,7 +3325,7 @@ void DocxAttributeOutput::WritePostitFields()
          ++i )
     {
         OString idstr = OString::valueOf( sal_Int32( i ));
-        const SwPostItField* f = m_postitFields[ i ];
+// TODO        const SwPostItField* f = m_postitFields[ i ];
         m_pSerializer->startElementNS( XML_w, XML_comment, FSNS( XML_w, XML_id ), idstr.getStr(),
             /*TODO*/ FSEND );
         m_pSerializer->endElementNS( XML_w, XML_comment );
commit 17651a5b8aab1a64fcefde3067422509a3221e34
Author: Luboš Luňák <l.lunak at suse.cz>
Date:   Tue Jul 19 13:56:30 2011 +0200

    skeleton for writting .docx comments

diff --git a/sw/source/filter/ww8/attributeoutputbase.hxx b/sw/source/filter/ww8/attributeoutputbase.hxx
index c002488..1562a75 100644
--- a/sw/source/filter/ww8/attributeoutputbase.hxx
+++ b/sw/source/filter/ww8/attributeoutputbase.hxx
@@ -176,6 +176,9 @@ public:
     /// for docx footnotePr/endnotePr inside sectPr
     virtual void SectFootnoteEndnotePr() {};
 
+    /// for docx w:commentReference
+    virtual void WritePostitFieldReference() {};
+
     /// Output text (inside a run).
     virtual void RunText( const String& rText, rtl_TextEncoding eCharSet ) = 0;
 
diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx b/sw/source/filter/ww8/docxattributeoutput.cxx
index 8b7f095..e5bac97 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -3302,9 +3302,34 @@ void DocxAttributeOutput::HiddenField( const SwField& /*rFld*/ )
     OSL_TRACE( "TODO DocxAttributeOutput::HiddenField()\n" );
 }
 
-void DocxAttributeOutput::PostitField( const SwField* /* pFld*/ )
+void DocxAttributeOutput::PostitField( const SwField* pFld )
 {
-    OSL_TRACE( "TODO DocxAttributeOutput::PostitField()\n" );
+    assert( dynamic_cast< const SwPostItField* >( pFld ));
+    m_postitFields.push_back( static_cast< const SwPostItField* >( pFld ));
+}
+
+void DocxAttributeOutput::WritePostitFieldReference()
+{
+    while( m_postitFieldsMaxId < m_postitFields.size())
+    {
+        OString idstr = OString::valueOf( sal_Int32( m_postitFieldsMaxId ));
+        m_pSerializer->singleElementNS( XML_w, XML_commentReference, FSNS( XML_w, XML_id ), idstr.getStr(), FSEND );
+        ++m_postitFieldsMaxId;
+    }
+}
+
+void DocxAttributeOutput::WritePostitFields()
+{
+    for( unsigned int i = 0;
+         i < m_postitFields.size();
+         ++i )
+    {
+        OString idstr = OString::valueOf( sal_Int32( i ));
+        const SwPostItField* f = m_postitFields[ i ];
+        m_pSerializer->startElementNS( XML_w, XML_comment, FSNS( XML_w, XML_id ), idstr.getStr(),
+            /*TODO*/ FSEND );
+        m_pSerializer->endElementNS( XML_w, XML_comment );
+    }
 }
 
 bool DocxAttributeOutput::DropdownField( const SwField* pFld )
@@ -4283,7 +4308,8 @@ DocxAttributeOutput::DocxAttributeOutput( DocxExport &rExport, FSHelperPtr pSeri
       m_nColBreakStatus( COLBRK_NONE ),
       m_pParentFrame( NULL ),
       m_nCloseHyperlinkStatus( Undetected ),
-      m_postponedGraphic( NULL )
+      m_postponedGraphic( NULL ),
+      m_postitFieldsMaxId( 0 )
 {
 }
 
@@ -4319,4 +4345,9 @@ bool DocxAttributeOutput::HasEndnotes() const
     return !m_pEndnotesList->isEmpty();
 }
 
+bool DocxAttributeOutput::HasPostitFields() const
+{
+    return !m_postitFields.empty();
+}
+
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/source/filter/ww8/docxattributeoutput.hxx b/sw/source/filter/ww8/docxattributeoutput.hxx
index a476cc5..cc67549 100644
--- a/sw/source/filter/ww8/docxattributeoutput.hxx
+++ b/sw/source/filter/ww8/docxattributeoutput.hxx
@@ -105,6 +105,8 @@ public:
 
     virtual void SectFootnoteEndnotePr();
 
+    virtual void WritePostitFieldReference();
+
     /// Output text (inside a run).
     virtual void RunText( const String& rText, rtl_TextEncoding eCharSet = RTL_TEXTENCODING_UTF8 );
     
@@ -599,6 +601,8 @@ private:
         Size size;
     };
     std::list< PostponedGraphic >* m_postponedGraphic;
+    std::vector< const SwPostItField* > m_postitFields;
+    unsigned int m_postitFieldsMaxId;
 
 public:
     DocxAttributeOutput( DocxExport &rExport, ::sax_fastparser::FSHelperPtr pSerializer, oox::drawingml::DrawingML* pDrawingML );
@@ -626,6 +630,9 @@ public:
 
     /// writes the footnotePr/endnotePr (depending on tag) section
     void WriteFootnoteEndnotePr( ::sax_fastparser::FSHelperPtr fs, int tag, const SwEndNoteInfo& info, int listtag );
+
+    bool HasPostitFields() const;
+    void WritePostitFields();
 };
 
 #endif // _DOCXATTRIBUTEOUTPUT_HXX_
diff --git a/sw/source/filter/ww8/docxexport.cxx b/sw/source/filter/ww8/docxexport.cxx
index 12ab4a8..dd77d7b 100644
--- a/sw/source/filter/ww8/docxexport.cxx
+++ b/sw/source/filter/ww8/docxexport.cxx
@@ -339,6 +339,8 @@ void DocxExport::ExportDocument_Impl()
 
     WriteFootnotesEndnotes();
     
+    WritePostitFields();
+
     WriteNumbering();
 
     WriteFonts();
@@ -516,6 +518,26 @@ void DocxExport::WriteFootnotesEndnotes()
     }
 }
 
+void DocxExport::WritePostitFields()
+{
+    if ( m_pAttrOutput->HasPostitFields() )
+    {
+        m_pFilter->addRelation( m_pDocumentFS->getOutputStream(),
+                S( "http://schemas.openxmlformats.org/officeDocument/2006/relationships/comments" ),
+                S( "comments.xml" ) );
+
+        ::sax_fastparser::FSHelperPtr pPostitFS =
+            m_pFilter->openFragmentStreamWithSerializer( S( "word/comments.xml" ),
+                    S( "application/vnd.openxmlformats-officedocument.wordprocessingml.comments+xml" ) );
+
+        pPostitFS->startElementNS( XML_w, XML_comments, MainXmlNamespaces( pPostitFS ));
+        m_pAttrOutput->SetSerializer( pPostitFS );
+        m_pAttrOutput->WritePostitFields();
+        m_pAttrOutput->SetSerializer( m_pDocumentFS );
+        pPostitFS->endElementNS( XML_w, XML_comments );
+    }
+}
+
 void DocxExport::WriteNumbering()
 {
     if ( !pUsedNumTbl )
diff --git a/sw/source/filter/ww8/docxexport.hxx b/sw/source/filter/ww8/docxexport.hxx
index ee84dcd..faed1e0 100644
--- a/sw/source/filter/ww8/docxexport.hxx
+++ b/sw/source/filter/ww8/docxexport.hxx
@@ -190,6 +190,9 @@ private:
     /// Write footnotes.xml and endnotes.xml.
     void WriteFootnotesEndnotes();
 
+    /// Write comments.xml
+    void WritePostitFields();
+
     /// Write the numbering table.
     virtual void WriteNumbering();
 
diff --git a/sw/source/filter/ww8/wrtw8nds.cxx b/sw/source/filter/ww8/wrtw8nds.cxx
index 72ae0fd..8dcd8b8 100644
--- a/sw/source/filter/ww8/wrtw8nds.cxx
+++ b/sw/source/filter/ww8/wrtw8nds.cxx
@@ -2030,6 +2030,8 @@ void MSWordExportBase::OutputTextNode( const SwTxtNode& rNode )
             }
         }
 
+        AttrOutput().WritePostitFieldReference();
+
         AttrOutput().EndRun();
 
         nAktPos = nNextAttr;
commit 51dae8c127e4d9d3d864947f239ceec6bebd0ae8
Author: Luboš Luňák <l.lunak at suse.cz>
Date:   Tue Jul 19 13:53:46 2011 +0200

    make text wrapping work in headers/footers too (fdo#39155)
    
    There does not seem to be a reason for avoiding this in headers,
    with this change the behavior either stays the same or improves.

diff --git a/sw/source/core/text/txtfly.cxx b/sw/source/core/text/txtfly.cxx
index 513c2d5..a900867 100644
--- a/sw/source/core/text/txtfly.cxx
+++ b/sw/source/core/text/txtfly.cxx
@@ -1380,14 +1380,7 @@ SwAnchoredObjList* SwTxtFly::InitAnchoredObjList()
 
     const SwSortedObjs *pSorted = pPage->GetSortedObjs();
     const sal_uInt32 nCount = pSorted ? pSorted->Count() : 0;
-    // --> #108724# Page header/footer content doesn't have to wrap around
-    //              floating screen objects
-    const bool bFooterHeader = 0 != pCurrFrm->FindFooterOrHeader();
-    const IDocumentSettingAccess* pIDSA = pCurrFrm->GetTxtNode()->getIDocumentSettingAccess();
-    // #i40155# - check, if frame is marked not to wrap
-    const sal_Bool bWrapAllowed = ( pIDSA->get(IDocumentSettingAccess::USE_FORMER_TEXT_WRAPPING) ||
-                                    ( !pCurrFrm->IsInFtn() && !bFooterHeader ) ) &&
-                                      !SwLayouter::FrmNotToWrap( *pCurrFrm->GetTxtNode()->getIDocumentLayoutAccess(), *pCurrFrm );
+    const sal_Bool bWrapAllowed = !SwLayouter::FrmNotToWrap( *pCurrFrm->GetTxtNode()->getIDocumentLayoutAccess(), *pCurrFrm );
 
     bOn = sal_False;
 
@@ -1399,6 +1392,7 @@ SwAnchoredObjList* SwTxtFly::InitAnchoredObjList()
         // #i28701# - consider complete frame area for new
         // text wrapping
         SwRect aRect;
+        const IDocumentSettingAccess* pIDSA = pCurrFrm->GetTxtNode()->getIDocumentSettingAccess();
         if ( pIDSA->get(IDocumentSettingAccess::USE_FORMER_TEXT_WRAPPING) )
         {
             aRect = pCurrFrm->Prt();
@@ -1414,6 +1408,7 @@ SwAnchoredObjList* SwTxtFly::InitAnchoredObjList()
         const long nRight = (aRect.*fnRect->fnGetRight)() - 1;
         const long nLeft = (aRect.*fnRect->fnGetLeft)() + 1;
         const sal_Bool bR2L = pCurrFrm->IsRightToLeft();
+        const bool bFooterHeader = ( pCurrFrm->FindFooterOrHeader() != NULL );
 
         const IDocumentDrawModelAccess* pIDDMA = pCurrFrm->GetTxtNode()->getIDocumentDrawModelAccess();
 
commit 0e00fc23b54bc1f93bb531a18f7e23ada5ee429b
Author: Luboš Luňák <l.lunak at suse.cz>
Date:   Fri Jul 8 17:02:41 2011 +0200

    const methods

diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx b/sw/source/filter/ww8/docxattributeoutput.cxx
index 6086213..8b7f095 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -4309,12 +4309,12 @@ DocxExport& DocxAttributeOutput::GetExport()
     return m_rExport;
 }
 
-bool DocxAttributeOutput::HasFootnotes()
+bool DocxAttributeOutput::HasFootnotes() const
 {
     return !m_pFootnotesList->isEmpty();
 }
 
-bool DocxAttributeOutput::HasEndnotes()
+bool DocxAttributeOutput::HasEndnotes() const
 {
     return !m_pEndnotesList->isEmpty();
 }
diff --git a/sw/source/filter/ww8/docxattributeoutput.hxx b/sw/source/filter/ww8/docxattributeoutput.hxx
index 884563d..a476cc5 100644
--- a/sw/source/filter/ww8/docxattributeoutput.hxx
+++ b/sw/source/filter/ww8/docxattributeoutput.hxx
@@ -616,10 +616,10 @@ public:
     ::sax_fastparser::FSHelperPtr GetSerializer( ) { return m_pSerializer; }
     
     /// Do we have any footnotes?
-    bool HasFootnotes();
+    bool HasFootnotes() const;
 
     /// Do we have any endnotes?
-    bool HasEndnotes();
+    bool HasEndnotes() const;
     
     /// Output the content of the footnotes.xml resp. endnotes.xml
     void FootnotesEndnotes( bool bFootnotes );
commit 74e24d9c98d1f3b333d00e78efbf081093abd8fb
Author: Jeffrey Chang <jeffdchang at gmail.com>
Date:   Tue Jul 12 09:11:27 2011 +0800

    Changed undo insert horizontal ruler to rule.

diff --git a/sw/source/core/undo/undo.src b/sw/source/core/undo/undo.src
index f22cb38..9a440d9 100644
--- a/sw/source/core/undo/undo.src
+++ b/sw/source/core/undo/undo.src
@@ -139,7 +139,7 @@ String STR_DRAG_AND_MOVE
 };
 String STR_INSERT_RULER
 {
-    Text [ en-US ] = "Insert horizontal ruler" ;
+    Text [ en-US ] = "Insert horizontal rule" ;
 };
 String STR_INSERT_CHART
 {
commit e68dcf570f7bec639927875b1f1c2b78fc2d0551
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 18 10:07:02 2011 +0100

    de-stupid-operator-ize plcf and keep nIdx within legal limits

diff --git a/sw/source/filter/ww8/ww8graf.cxx b/sw/source/filter/ww8/ww8graf.cxx
index 7963f0e..7d01d31 100644
--- a/sw/source/filter/ww8/ww8graf.cxx
+++ b/sw/source/filter/ww8/ww8graf.cxx
@@ -831,7 +831,7 @@ bool SwWW8ImplReader::GetTxbxTextSttEndCp(WW8_CP& rStartCp, WW8_CP& rEndCp,
         bool bReusable = (0 != SVBT16ToShort( ((WW8_TXBXS*)pT0)->fReusable ));
         while( bReusable )
         {
-            (*pT)++;
+            pT->advance();
             if( !pT->Get( rStartCp, pT0 ) )
             {
                 OSL_ENSURE( !this, "+Wo ist der Grafik-Text (2-a) ?" );
@@ -840,7 +840,7 @@ bool SwWW8ImplReader::GetTxbxTextSttEndCp(WW8_CP& rStartCp, WW8_CP& rEndCp,
             bReusable = (0 != SVBT16ToShort( ((WW8_TXBXS*)pT0)->fReusable ));
         }
     }
-    (*pT)++;
+    pT->advance();
     if( !pT->Get( rEndCp, pT0 ) )
     {
         OSL_ENSURE( !this, "+Wo ist der Grafik-Text (3) ?" );
@@ -868,7 +868,8 @@ bool SwWW8ImplReader::GetTxbxTextSttEndCp(WW8_CP& rStartCp, WW8_CP& rEndCp,
                 return false;
             }
             // ggfs. entsprechende Anzahl Eintraege weitergehen
-            for(sal_uInt16 iSequence = 0; iSequence < nSequence; iSequence++) (*pT)++;
+            for (sal_uInt16 iSequence = 0; iSequence < nSequence; ++iSequence)
+                pT->advance();
             // dann die tatsaechlichen Start und Ende ermitteln
             if(    (!pT->Get( rStartCp, pT0 ))
                 || ( nMinStartCp > rStartCp  ) )
@@ -880,9 +881,8 @@ bool SwWW8ImplReader::GetTxbxTextSttEndCp(WW8_CP& rStartCp, WW8_CP& rEndCp,
                 rEndCp = rStartCp;  // kein Error: leerer String!
             else
             {
-                (*pT)++;
-                if(    (!pT->Get( rEndCp, pT0 ))
-                    || ( nMaxEndCp < rEndCp-1  ) )
+                pT->advance();
+                if ( (!pT->Get(rEndCp, pT0)) || (nMaxEndCp < rEndCp-1) )
                 {
                     OSL_ENSURE( !this, "+Wo ist der Grafik-Text (6) ?" );
                     return false;
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index a13edd8..f2e1911 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -1779,7 +1779,7 @@ static bool WW8SkipField(WW8PLCFspecial& rPLCF)
     if (!rPLCF.Get(nP, pData))              // Ende des PLCFspecial ?
         return false;
 
-    rPLCF++;
+    rPLCF.advance();
 
     if((((sal_uInt8*)pData)[0] & 0x1f ) != 0x13 )    // Kein Anfang ?
         return true;                            // Bei Fehler nicht abbrechen
@@ -1800,7 +1800,7 @@ static bool WW8SkipField(WW8PLCFspecial& rPLCF)
     {
 
         // Field Separator ?
-        rPLCF++;
+        rPLCF.advance();
 
         if( !rPLCF.Get( nP, pData ) )
             return false;
@@ -1813,7 +1813,7 @@ static bool WW8SkipField(WW8PLCFspecial& rPLCF)
                 return false;
         }
     }
-    rPLCF++;
+    rPLCF.advance();
 
     return true;
 }
@@ -1828,7 +1828,7 @@ static bool WW8GetFieldPara(WW8PLCFspecial& rPLCF, WW8FieldDesc& rF)
     if( !rPLCF.Get( rF.nSCode, pData ) )             // Ende des PLCFspecial ?
         goto Err;
 
-    rPLCF++;
+    rPLCF.advance();
 
     if((((sal_uInt8*)pData)[0] & 0x1f ) != 0x13 )        // Kein Anfang ?
         goto Err;
@@ -1851,8 +1851,9 @@ static bool WW8GetFieldPara(WW8PLCFspecial& rPLCF, WW8FieldDesc& rF)
             goto Err;
     }
 
-    if((((sal_uInt8*)pData)[0] & 0x1f ) == 0x14 ){       // Field Separator ?
-        rPLCF++;
+    if ((((sal_uInt8*)pData)[0] & 0x1f ) == 0x14 )       // Field Separator ?
+    {
+        rPLCF.advance();
 
         if( !rPLCF.Get( rF.nLRes, pData ) )
             goto Err;
@@ -1875,7 +1876,7 @@ static bool WW8GetFieldPara(WW8PLCFspecial& rPLCF, WW8FieldDesc& rF)
         rF.nLen = rF.nSRes - rF.nSCode + 2;         // Gesamtlaenge
     }
 
-    rPLCF++;
+    rPLCF.advance();
     if((((sal_uInt8*)pData)[0] & 0x1f ) == 0x15 )
     {
         // Field Ende ?
@@ -3804,7 +3805,7 @@ bool WW8PLCFx_FLD::EndPosIsFieldEnd()
     {
         long n = pPLCF->GetIdx();
 
-        (*pPLCF)++;
+        pPLCF->advance();
 
         void* pData;
         sal_Int32 nTest;
@@ -3842,7 +3843,7 @@ void WW8PLCFx_FLD::GetSprms(WW8PLCFxDesc* p)
 
     p->nStartPos = nP;
 
-    (*pPLCF)++;
+    pPLCF->advance();
     if (!pPLCF->Get(nP, pData))             // Ende des PLCFspecial ?
     {
         p->nStartPos = WW8_CP_MAX;            // PLCF fertig abgearbeitet
@@ -3858,7 +3859,7 @@ void WW8PLCFx_FLD::GetSprms(WW8PLCFxDesc* p)
 
 WW8PLCFx& WW8PLCFx_FLD::operator ++( int )
 {
-    (*pPLCF)++;
+    pPLCF->advance();
     return *this;
 }
 
@@ -4120,7 +4121,7 @@ WW8PLCFx& WW8PLCFx_Book::operator ++( int )
 {
     if( pBook[0] && pBook[1] && nIMax )
     {
-        (*pBook[nIsEnd])++;
+        (*pBook[nIsEnd]).advance();
 
         sal_uLong l0 = pBook[0]->Where();
         sal_uLong l1 = pBook[1]->Where();
diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx
index 33a165f..b2d7747 100644
--- a/sw/source/filter/ww8/ww8scan.hxx
+++ b/sw/source/filter/ww8/ww8scan.hxx
@@ -224,7 +224,7 @@ public:
         sal_uInt32 nStruct);
     ~WW8PLCFspecial() { delete[] pPLCF_PosArray; }
     long GetIdx() const { return nIdx; }
-    void SetIdx( long nI ) { nIdx = nI; }   
+    void SetIdx( long nI ) { nIdx = nI; }
     long GetIMax() const { return nIMax; }
     bool SeekPos(long nPos);            // geht ueber FC- bzw. CP-Wert
                                         // bzw. naechste groesseren Wert
@@ -242,8 +242,11 @@ public:
     sal_Int32 GetPos( long nInIdx ) const
         { return ( nInIdx >= nIMax ) ? SAL_MAX_INT32 : pPLCF_PosArray[nInIdx]; }
 
-    WW8PLCFspecial& operator ++( int ) { nIdx++; return *this; }
-    WW8PLCFspecial& operator --( int ) { nIdx--; return *this; }
+    void advance()
+    {
+        if (nIdx <= nIMax)
+            ++nIdx;
+    }
 };
 
 /** simple Iterator for SPRMs */
commit 467b1308139c73f4de47fff06d19730d2b69ad43
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 18 01:12:43 2011 +0100

    merge PAP and CHP length and offset clipping

diff --git a/sw/qa/core/filters-test.cxx b/sw/qa/core/filters-test.cxx
index 9ace6d6..71e5d74 100644
--- a/sw/qa/core/filters-test.cxx
+++ b/sw/qa/core/filters-test.cxx
@@ -97,6 +97,7 @@ private:
     uno::Reference<lang::XMultiComponentFactory> m_xFactory;
     uno::Reference<uno::XInterface> m_xWriterComponent;
     ::rtl::OUString m_aSrcRoot;
+    int m_nLoadedDocs;
 };
 
 bool FiltersTest::load(const rtl::OUString &rFilter, const rtl::OUString &rURL,
@@ -110,7 +111,11 @@ bool FiltersTest::load(const rtl::OUString &rFilter, const rtl::OUString &rURL,
     SwDocShellRef xDocShRef = new SwDocShell;
     SfxMedium aSrcMed(rURL, STREAM_STD_READ, true);
     aSrcMed.SetFilter(&aFilter);
-    return xDocShRef->DoLoad(&aSrcMed);
+    bool bRet = xDocShRef->DoLoad(&aSrcMed);
+
+    ++m_nLoadedDocs;
+
+    return bRet;
 }
 
 void FiltersTest::recursiveScan(const rtl::OUString &rFilter, const rtl::OUString &rURL, const rtl::OUString &rUserData, int nExpected)
@@ -177,10 +182,13 @@ void FiltersTest::testCVEs()
     recursiveScan(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("MS Word 97")), m_aSrcRoot + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/clone/writer/sw/qa/core/data/ww8/fail")), rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("CWW8")), false);
 
     recursiveScan(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("MS Word 97")), m_aSrcRoot + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/clone/writer/sw/qa/core/data/ww8/indeterminate")), rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("CWW8")), indeterminate);
+
+    printf("Writer: tested %d files\n", m_nLoadedDocs);
 }
 
 FiltersTest::FiltersTest()
     : m_aSrcRoot(RTL_CONSTASCII_USTRINGPARAM("file://"))
+    , m_nLoadedDocs(0)
 {
     m_xContext = cppu::defaultBootstrap_InitialComponentContext();
     m_xFactory = m_xContext->getServiceManager();
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index a5acf1a..a13edd8 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2473,6 +2473,25 @@ bool IsExpandableSprm(sal_uInt16 nSpId)
     return 0x646B == nSpId;
 }
 
+void WW8PLCFx_Fc_FKP::WW8Fkp::FillEntry(WW8PLCFx_Fc_FKP::WW8Fkp::Entry &rEntry,
+    sal_Size nDataOffset, sal_uInt16 nLen)
+{
+    bool bValidPos = (nDataOffset < sizeof(maRawData));
+
+    OSL_ENSURE(bValidPos, "sprm sequence offset is out of range, ignoring");
+
+    if (!bValidPos)
+    {
+        rEntry.mnLen = 0;
+        return;
+    }
+
+    sal_uInt16 nAvailableData = sizeof(maRawData)-nDataOffset;
+    OSL_ENSURE(nLen <= nAvailableData, "srpm sequence len is out of range, clipping");
+    rEntry.mnLen = std::min(nLen, nAvailableData);
+    rEntry.mpData = maRawData + nDataOffset;
+}
+
 WW8PLCFx_Fc_FKP::WW8Fkp::WW8Fkp(ww::WordVersion eVersion, SvStream* pSt,
     SvStream* pDataSt, long _nFilePos, long nItemSiz, ePLCFT ePl,
     WW8_FC nStartFc)
@@ -2517,8 +2536,13 @@ WW8PLCFx_Fc_FKP::WW8Fkp::WW8Fkp(ww::WordVersion eVersion, SvStream* pSt,
             switch (ePLCF)
             {
                 case CHP:
-                    aEntry.mnLen  = maRawData[nOfs];
-                    aEntry.mpData = maRawData + nOfs + 1;
+                {
+                    aEntry.mnLen = maRawData[nOfs];
+
+                    //len byte
+                    sal_Size nDataOffset = nOfs + 1;
+
+                    FillEntry(aEntry, nDataOffset, aEntry.mnLen);
 
                     if (aEntry.mnLen && eVersion == ww::eWW2)
                     {
@@ -2532,8 +2556,8 @@ WW8PLCFx_Fc_FKP::WW8Fkp::WW8Fkp(ww::WordVersion eVersion, SvStream* pSt,
                             aEntry.mbMustDelete = true;
                         }
                     }
-
                     break;
+                }
                 case PAP:
                     {
                         sal_uInt8 nDelta = 0;
@@ -2576,18 +2600,8 @@ WW8PLCFx_Fc_FKP::WW8Fkp::WW8Fkp(ww::WordVersion eVersion, SvStream* pSt,
                                 {
                                     //additional istd
                                     nDataOffset += sizeof(aEntry.mnIStd);
-                                    OSL_ENSURE(nDataOffset < sizeof(maRawData),
-                                        "sprm offset is out of range, ignoring");
-                                    if (nDataOffset < sizeof(maRawData))
-                                    {
-                                        aEntry.mpData = maRawData + nDataOffset;
-                                        sal_uInt16 nAvailableData = sizeof(maRawData)-nDataOffset;
-                                        OSL_ENSURE(aEntry.mnLen <= nAvailableData,
-                                            "srpm len is out of range, clipping");
-                                        aEntry.mnLen = std::min(aEntry.mnLen, nAvailableData);
-                                    }
-                                    else
-                                        aEntry.mnLen = 0;
+
+                                    FillEntry(aEntry, nDataOffset, aEntry.mnLen);
                                 }
                             }
                             else
@@ -2644,8 +2658,11 @@ WW8PLCFx_Fc_FKP::WW8Fkp::WW8Fkp(ww::WordVersion eVersion, SvStream* pSt,
             sal_uInt8* pSprms = GetLenAndIStdAndSprms( nLen );
 
             WW8SprmIter aIter(pSprms, nLen, maSprmParser);
-            while(aIter.GetSprms())
+            while (aIter.GetSprms())
+            {
+                fprintf(stderr, "id is %x\n", aIter.GetAktId());
                 aIter.advance();
+            }
         }
 #endif
     }
@@ -4355,7 +4372,7 @@ void WW8PLCFMan::GetNewNoSprms( WW8PLCFxDesc& rDesc )
 
 sal_uInt16 WW8PLCFMan::GetId(const WW8PLCFxDesc* p) const
 {
-    sal_uInt16 nId;
+    sal_uInt16 nId = 0;        // Id = 0 for empty attributes
 
     if (p == pFld)
         nId = eFLD;
@@ -4365,10 +4382,8 @@ sal_uInt16 WW8PLCFMan::GetId(const WW8PLCFxDesc* p) const
         nId = eEDN;
     else if (p == pAnd)
         nId = eAND;
-    else if (p->nSprmsLen > 0)
+    else if (p->nSprmsLen >= maSprmParser.MinSprmLen())
         nId = maSprmParser.GetSprmId(p->pMemPos);
-    else
-        nId = 0;        // Id = 0 for empty attributes
 
     return nId;
 }
@@ -4666,7 +4681,7 @@ void WW8PLCFMan::GetSprmStart( short nIdx, WW8PLCFManResult* pRes ) const
     pRes->nCp2OrIdx = p->nCp2OrIdx;
     if ((p == pFtn) || (p == pEdn) || (p == pAnd))
         pRes->nMemLen = p->nSprmsLen;
-    else if (p->nSprmsLen)  //Normal
+    else if (p->nSprmsLen >= maSprmParser.MinSprmLen()) //Normal
     {
         // Length of actual sprm
         pRes->nMemLen = maSprmParser.GetSprmSize(pRes->nSprmId, pRes->pMemPos);
diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx
index 2f83cba..33a165f 100644
--- a/sw/source/filter/ww8/ww8scan.hxx
+++ b/sw/source/filter/ww8/ww8scan.hxx
@@ -507,6 +507,9 @@ public:
         sal_uInt8 mnIMax;         // Anzahl der Eintraege
         
         wwSprmParser maSprmParser;
+
+        //Fill in an Entry with sanity testing
+        void FillEntry(Entry &rEntry, sal_Size nDataOffset, sal_uInt16 nLen);
     public:
         WW8Fkp (ww::WordVersion eVersion, SvStream* pFKPStrm, 
             SvStream* pDataStrm, long _nFilePos, long nItemSiz, ePLCFT ePl, 
commit 80305b54419752026ec3bc7f041c8f9d6c147b08
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Jul 17 21:25:18 2011 +0100

    check if strlen is even possible

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index e34973a..99e2fbf 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -2635,28 +2635,42 @@ sal_Unicode SwWW8ImplReader::TranslateToHindiNumbers(sal_Unicode nChar)
 // Returnwert: true for no Sonderzeichen
 bool SwWW8ImplReader::ReadPlainChars(WW8_CP& rPos, long nEnd, long nCpOfs)
 {
-    // Unicode-Flag neu setzen und notfalls File-Pos korrigieren
-    // merke: Seek kostet nicht viel, da inline geprueft wird,
-    //        ob die korrekte FilePos nicht schon erreicht ist.
-    xub_StrLen nLen;
-    if (nEnd - rPos <= (STRING_MAXLEN-1))
-        nLen = writer_cast<xub_StrLen>(nEnd - rPos);
-    else
-        nLen = STRING_MAXLEN-1;
-    OSL_ENSURE(nLen, "String is 0");
-    if (!nLen)
+    sal_Size nRequestedStrLen = nEnd - rPos;
+
+    OSL_ENSURE(nRequestedStrLen, "String is 0");
+    if (!nRequestedStrLen)
         return true;
 
     sal_Size nRequestedPos = pSBase->WW8Cp2Fc(nCpOfs+rPos, &bIsUnicode);
-    sal_Size nSeekedPos = pStrm->Seek(nRequestedPos);
-    OSL_ENSURE(nRequestedPos == nSeekedPos, "Document claimed to have more text than available");
-    if (nRequestedPos != nSeekedPos)
+    bool bValidPos = checkSeek(*pStrm, nRequestedPos);
+    OSL_ENSURE(bValidPos, "Document claimed to have more text than available");
+    if (!bValidPos)
     {
         //Swallow missing range, e.g. #i95550#
-        rPos+=nLen;
+        rPos+=nRequestedStrLen;
         return true;
     }
 
+    sal_Size nAvailableStrLen = pStrm->remainingSize() / (bIsUnicode ? 2 : 1);
+    OSL_ENSURE(nAvailableStrLen, "Document claimed to have more text than available");
+    if (!nAvailableStrLen)
+    {
+        //Swallow missing range, e.g. #i95550#
+        rPos+=nRequestedStrLen;
+        return true;
+    }
+
+    sal_Size nValidStrLen = std::min(nRequestedStrLen, nAvailableStrLen);
+
+    // Unicode-Flag neu setzen und notfalls File-Pos korrigieren
+    // merke: Seek kostet nicht viel, da inline geprueft wird,
+    //        ob die korrekte FilePos nicht schon erreicht ist.
+    xub_StrLen nStrLen;
+    if (nValidStrLen <= (STRING_MAXLEN-1))
+        nStrLen = writer_cast<xub_StrLen>(nValidStrLen);
+    else
+        nStrLen = STRING_MAXLEN-1;
+
     const CharSet eSrcCharSet = bVer67 ? GetCurrentCharSet() :
         RTL_TEXTENCODING_MS_1252;
     const CharSet eSrcCJKCharSet = bVer67 ? GetCurrentCJKCharSet() :
@@ -2665,7 +2679,7 @@ bool SwWW8ImplReader::ReadPlainChars(WW8_CP& rPos, long nEnd, long nCpOfs)
     // (re)alloc UniString data
     String sPlainCharsBuf;
 
-    sal_Unicode* pBuffer = sPlainCharsBuf.AllocBuffer( nLen );
+    sal_Unicode* pBuffer = sPlainCharsBuf.AllocBuffer(nStrLen);
     sal_Unicode* pWork = pBuffer;
 
     sal_Char* p8Bits = NULL;
@@ -2675,7 +2689,7 @@ bool SwWW8ImplReader::ReadPlainChars(WW8_CP& rPos, long nEnd, long nCpOfs)
         hConverter = rtl_createTextToUnicodeConverter(eSrcCharSet);
 
     if (!bIsUnicode)
-        p8Bits = new sal_Char[nLen];
+        p8Bits = new sal_Char[nStrLen];
 
     // read the stream data
     sal_uInt8   nBCode = 0;
@@ -2687,7 +2701,7 @@ bool SwWW8ImplReader::ReadPlainChars(WW8_CP& rPos, long nEnd, long nCpOfs)
     if (pItem != NULL)
         nCTLLang = dynamic_cast<const SvxLanguageItem *>(pItem)->GetLanguage();
 
-    for( nL2 = 0; nL2 < nLen; ++nL2, ++pWork )
+    for( nL2 = 0; nL2 < nStrLen; ++nL2, ++pWork )
     {
         if (bIsUnicode)
             *pStrm >> nUCode;   // unicode  --> read 2 bytes
@@ -2742,9 +2756,9 @@ bool SwWW8ImplReader::ReadPlainChars(WW8_CP& rPos, long nEnd, long nCpOfs)
         xub_StrLen nEndUsed = nL2;
 
         if (!bIsUnicode)
-            nEndUsed = Custom8BitToUnicode(hConverter, p8Bits, nL2, pBuffer, nLen);
+            nEndUsed = Custom8BitToUnicode(hConverter, p8Bits, nL2, pBuffer, nStrLen);
 
-        for( xub_StrLen nI = 0; nI < nLen; ++nI, ++pBuffer )
+        for( xub_StrLen nI = 0; nI < nStrLen; ++nI, ++pBuffer )
             if (m_bRegardHindiDigits && bBidi && LangUsesHindiNumbers(nCTLLang))
                 *pBuffer = TranslateToHindiNumbers(*pBuffer);
 
@@ -2759,7 +2773,7 @@ bool SwWW8ImplReader::ReadPlainChars(WW8_CP& rPos, long nEnd, long nCpOfs)
     if (hConverter)
         rtl_destroyTextToUnicodeConverter(hConverter);
     delete [] p8Bits;
-    return nL2 >= nLen;
+    return nL2 >= nStrLen;
 }
 
 #define MSASCII SAL_MAX_INT16
@@ -3029,10 +3043,12 @@ bool SwWW8ImplReader::ReadChar(long nPosCp, long nCpOfs)
     // Unicode-Flag neu setzen und notfalls File-Pos korrigieren
     // merke: Seek kostet nicht viel, da inline geprueft wird,
     //        ob die korrekte FilePos nicht schon erreicht ist.
-    pStrm->Seek( pSBase->WW8Cp2Fc(nCpOfs+nPosCp, &bIsUnicode) );
+    sal_Size nRequestedPos = pSBase->WW8Cp2Fc(nCpOfs+nPosCp, &bIsUnicode);
+    if (!checkSeek(*pStrm, nRequestedPos))
+        return false;
 
-    sal_uInt8   nBCode;
-    sal_uInt16 nWCharVal;
+    sal_uInt8 nBCode(0);
+    sal_uInt16 nWCharVal(0);
     if( bIsUnicode )
         *pStrm >> nWCharVal;    // unicode  --> read 2 bytes
     else
commit 763801f3af271d6c250f1c33785a0082f303da5e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Jul 17 00:19:00 2011 +0100

    check seeks, check available size, pointers to ref

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 750182e..e34973a 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -4554,7 +4554,7 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss, const SwPosition &rPos)
     // loop for each glossary entry and add dummy section node
     if (pGloss)
     {
-        WW8PLCF aPlc(pTableStream, pWwFib->fcPlcfglsy, pWwFib->lcbPlcfglsy, 0);
+        WW8PLCF aPlc(*pTableStream, pWwFib->fcPlcfglsy, pWwFib->lcbPlcfglsy, 0);
 
         WW8_CP nStart, nEnd;
         void* pDummy;
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index d5f31a8..a5acf1a 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2153,14 +2153,14 @@ bool WW8PLCFspecial::GetData(long nInIdx, WW8_CP& rPos, void*& rpValue) const
 
 // Ctor fuer *andere* als Fkps
 // Bei nStartPos < 0 wird das erste Element des PLCFs genommen
-WW8PLCF::WW8PLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
-    WW8_CP nStartPos ) : pPLCF_PosArray(0), nIdx(0), nStru(nStruct)
+WW8PLCF::WW8PLCF(SvStream& rSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
+    WW8_CP nStartPos) : pPLCF_PosArray(0), nIdx(0), nStru(nStruct)
 {
     OSL_ENSURE( nPLCF, "WW8PLCF: nPLCF ist Null!" );
 
     nIMax = ( nPLCF - 4 ) / ( 4 + nStruct );
 
-    ReadPLCF( pSt, nFilePos, nPLCF );
+    ReadPLCF(rSt, nFilePos, nPLCF);
 
     if( nStartPos >= 0 )
         SeekPos( nStartPos );
@@ -2171,32 +2171,33 @@ WW8PLCF::WW8PLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
 // != 0, dann wird ein unvollstaendiger PLCF vervollstaendigt.  Das ist bei
 // WW6 bei Resourcenmangel und bei WordPad (W95) immer noetig.  Bei nStartPos
 // < 0 wird das erste Element des PLCFs genommen
-WW8PLCF::WW8PLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
-    WW8_CP nStartPos, sal_Int32 nPN, sal_Int32 ncpN ) : pPLCF_PosArray(0), nIdx(0),
+WW8PLCF::WW8PLCF(SvStream& rSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
+    WW8_CP nStartPos, sal_Int32 nPN, sal_Int32 ncpN): pPLCF_PosArray(0), nIdx(0),
     nStru(nStruct)
 {
     nIMax = ( nPLCF - 4 ) / ( 4 + nStruct );
 
     if( nIMax >= ncpN )
-        ReadPLCF( pSt, nFilePos, nPLCF );
+        ReadPLCF(rSt, nFilePos, nPLCF);
     else
-        GeneratePLCF( pSt, nPN, ncpN );
+        GeneratePLCF(rSt, nPN, ncpN);
 
     if( nStartPos >= 0 )
         SeekPos( nStartPos );
 }
 
-void WW8PLCF::ReadPLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF )
+void WW8PLCF::ReadPLCF(SvStream& rSt, WW8_FC nFilePos, sal_uInt32 nPLCF)
 {
-    sal_Size nOldPos = pSt->Tell();
+    sal_Size nOldPos = rSt.Tell();
+    sal_Size nRemainingSize = rSt.remainingSize();
 
-    bool bValid = checkSeek(*pSt, nFilePos);
+    bool bValid = checkSeek(rSt, nFilePos) && (nRemainingSize >= nPLCF);
 
     if (bValid)
     {
         // Pointer auf Pos-Array
         pPLCF_PosArray = new WW8_CP[ ( nPLCF + 3 ) / 4 ];
-        bValid = checkRead(*pSt, pPLCF_PosArray, nPLCF);
+        bValid = checkRead(rSt, pPLCF_PosArray, nPLCF);
     }
 
     if (bValid)
@@ -2215,7 +2216,7 @@ void WW8PLCF::ReadPLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF )
     if (!bValid)
         MakeFailedPLCF();
 
-    pSt->Seek(nOldPos);
+    rSt.Seek(nOldPos);
 }
 
 void WW8PLCF::MakeFailedPLCF()
@@ -2227,7 +2228,7 @@ void WW8PLCF::MakeFailedPLCF()
     pPLCF_Contents = (sal_uInt8*)&pPLCF_PosArray[nIMax + 1];
 }
 
-void WW8PLCF::GeneratePLCF( SvStream* pSt, sal_Int32 nPN, sal_Int32 ncpN )
+void WW8PLCF::GeneratePLCF(SvStream& rSt, sal_Int32 nPN, sal_Int32 ncpN)
 {
     OSL_ENSURE( nIMax < ncpN, "Pcl.Fkp: Warum ist PLCF zu gross ?" );
 
@@ -2243,32 +2244,43 @@ void WW8PLCF::GeneratePLCF( SvStream* pSt, sal_Int32 nPN, sal_Int32 ncpN )
         size_t nElems = ( nSiz + 3 ) / 4;
         pPLCF_PosArray = new sal_Int32[ nElems ]; // Pointer auf Pos-Array
 
-        for (sal_Int32 i = 0; i < ncpN && !pSt->GetError(); ++i)
+        for (sal_Int32 i = 0; i < ncpN && !failure; ++i)
         {
+            failure = true;
             // Baue FC-Eintraege
-            pSt->Seek( ( nPN + i ) << 9 );  // erster FC-Eintrag jedes Fkp
-            WW8_CP nFc;
-            *pSt >> nFc;
+            // erster FC-Eintrag jedes Fkp
+            if (checkSeek(rSt, ( nPN + i ) << 9 ))
+                continue;
+            WW8_CP nFc(0);
+            rSt >> nFc;
             pPLCF_PosArray[i] = nFc;
+            failure = rSt.GetError();
         }
-
-        failure = pSt->GetError();
     }
 
     if (!failure)
     {
-        sal_Size nLastFkpPos = ( ( nPN + nIMax - 1 ) << 9 );
-        pSt->Seek( nLastFkpPos + 511 );     // Anz. Fkp-Eintraege des letzten Fkp
+        do
+        {
+            failure = true;
+
+            sal_Size nLastFkpPos = ( ( nPN + nIMax - 1 ) << 9 );
+            // Anz. Fkp-Eintraege des letzten Fkp
+            if (!checkSeek(rSt, nLastFkpPos + 511))
+                break;
 
-        sal_uInt8 nb;
-        *pSt >> nb;
-        pSt->Seek( nLastFkpPos + nb * 4 );  // letzer FC-Eintrag des letzten Fkp
+            sal_uInt8 nb(0);
+            rSt >> nb;
+            // letzer FC-Eintrag des letzten Fkp
+            if (!checkSeek(rSt, nLastFkpPos + nb * 4))
+                break;
 
-        WW8_CP nFc;
-        *pSt >> nFc;
-        pPLCF_PosArray[nIMax] = nFc;        // Ende des letzten Fkp
+            WW8_CP nFc(0);
+            rSt >> nFc;
+            pPLCF_PosArray[nIMax] = nFc;        // Ende des letzten Fkp
 
-        failure = pSt->GetError();
+            failure = rSt.GetError();
+        } while(0);
     }
 
     if (!failure)
@@ -2358,9 +2370,11 @@ WW8PLCFpcd::WW8PLCFpcd(SvStream* pSt, sal_uInt32 nFilePos,
     const sal_uInt32 nValidMin=4;
 
     sal_Size nOldPos = pSt->Tell();
+    sal_Size nRemainingSize = pSt->remainingSize();
 
-    bool bValid = (nPLCF >= nValidMin) && checkSeek(*pSt, nFilePos);
-    nPLCF = bValid ? std::max(nPLCF, nValidMin) : nValidMin;
+    bool bValid = checkSeek(*pSt, nFilePos) && (nRemainingSize >= nValidMin) &&
+        (nPLCF >= nValidMin);
+    nPLCF = bValid ? std::min(nRemainingSize, static_cast<sal_Size>(nPLCF)) : nValidMin;
 
     pPLCF_PosArray = new sal_Int32[ ( nPLCF + 3 ) / 4 ];    // Pointer auf Pos-Array
     pPLCF_PosArray[0] = 0;
@@ -2923,12 +2937,12 @@ WW8PLCFx_Fc_FKP::WW8PLCFx_Fc_FKP(SvStream* pSt, SvStream* pTblSt,
     long nLenStruct = (8 > rFib.nVersion) ? 2 : 4;
     if (ePl == CHP)
     {
-        pPLCF = new WW8PLCF(pTblSt, rFib.fcPlcfbteChpx, rFib.lcbPlcfbteChpx,
+        pPLCF = new WW8PLCF(*pTblSt, rFib.fcPlcfbteChpx, rFib.lcbPlcfbteChpx,
             nLenStruct, GetStartFc(), rFib.pnChpFirst, rFib.cpnBteChp);
     }
     else
     {
-        pPLCF = new WW8PLCF(pTblSt, rFib.fcPlcfbtePapx, rFib.lcbPlcfbtePapx,
+        pPLCF = new WW8PLCF(*pTblSt, rFib.fcPlcfbtePapx, rFib.lcbPlcfbtePapx,
             nLenStruct, GetStartFc(), rFib.pnPapFirst, rFib.cpnBtePap);
     }
 }
@@ -3416,7 +3430,7 @@ WW8PLCFx_SEPX::WW8PLCFx_SEPX(SvStream* pSt, SvStream* pTblSt,
     pStrm(pSt), nArrMax(256), nSprmSiz(0)
 {
     pPLCF =   rFib.lcbPlcfsed
-            ? new WW8PLCF(pTblSt, rFib.fcPlcfsed, rFib.lcbPlcfsed, 
+            ? new WW8PLCF(*pTblSt, rFib.fcPlcfsed, rFib.lcbPlcfsed,
               GetFIBVersion() <= ww::eWW2 ? 6 : 12, nStartCp)
             : 0;
 
@@ -3596,8 +3610,8 @@ WW8PLCFx_SubDoc::WW8PLCFx_SubDoc(SvStream* pSt, ww::WordVersion eVersion,
 {
     if( nLenRef && nLenTxt )
     {
-        pRef = new WW8PLCF( pSt, nFcRef, nLenRef, nStruct, nStartCp );
-        pTxt = new WW8PLCF( pSt, nFcTxt, nLenTxt, 0, nStartCp );
+        pRef = new WW8PLCF(*pSt, nFcRef, nLenRef, nStruct, nStartCp);
+        pTxt = new WW8PLCF(*pSt, nFcTxt, nLenTxt, 0, nStartCp);
     }
 }
 
@@ -6523,7 +6537,7 @@ const WW8_FFN* WW8Fonts::GetFont( sal_uInt16 nNum ) const
 // -> dann liefert GetTextPos() vielleicht auch ein richtiges Ergebnis
 
 WW8PLCF_HdFt::WW8PLCF_HdFt( SvStream* pSt, WW8Fib& rFib, WW8Dop& rDop )
-    : aPLCF( pSt, rFib.fcPlcfhdd , rFib.lcbPlcfhdd , 0 )
+    : aPLCF(*pSt, rFib.fcPlcfhdd , rFib.lcbPlcfhdd , 0)
 {
     nIdxOffset = 0;
 
diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx
index 039b5e3..2f83cba 100644
--- a/sw/source/filter/ww8/ww8scan.hxx
+++ b/sw/source/filter/ww8/ww8scan.hxx
@@ -286,24 +286,24 @@ private:
     sal_Int32 nIdx;
     int nStru;
 
-    void ReadPLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF );
+    void ReadPLCF(SvStream& rSt, WW8_FC nFilePos, sal_uInt32 nPLCF);
 
     /*
         Falls im Dok ein PLC fehlt und die FKPs solo dastehen,
         machen wir uns hiermit einen PLC:
     */
-    void GeneratePLCF( SvStream* pSt, sal_Int32 nPN, sal_Int32 ncpN );
+    void GeneratePLCF(SvStream& rSt, sal_Int32 nPN, sal_Int32 ncpN);
 
     void MakeFailedPLCF();
 public:
-    WW8PLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct, 
-        WW8_CP nStartPos = -1 );
+    WW8PLCF(SvStream& rSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
+        WW8_CP nStartPos = -1);
 
     /*
         folgender Ctor generiert ggfs. einen PLC aus nPN und ncpN
     */
-    WW8PLCF( SvStream* pSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct, 
-        WW8_CP nStartPos, sal_Int32 nPN, sal_Int32 ncpN );
+    WW8PLCF(SvStream& rSt, WW8_FC nFilePos, sal_Int32 nPLCF, int nStruct,
+        WW8_CP nStartPos, sal_Int32 nPN, sal_Int32 ncpN);
 
     ~WW8PLCF(){ delete[] pPLCF_PosArray; }
     sal_Int32 GetIdx() const { return nIdx; }
commit 1570e35b88db93ee5a33809fa4e80054a3f417bf
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Jul 16 23:33:03 2011 +0100

    clip silly allocs

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 09608bd..d5f31a8 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -2031,9 +2031,11 @@ WW8PLCFspecial::WW8PLCFspecial(SvStream* pSt, sal_uInt32 nFilePos,
     const sal_uInt32 nValidMin=4;
 
     sal_Size nOldPos = pSt->Tell();
+    sal_Size nRemainingSize = pSt->remainingSize();
 
-    bool bValid = (nPLCF >= nValidMin) && checkSeek(*pSt, nFilePos);
-    nPLCF = bValid ? std::max(nPLCF, nValidMin) : nValidMin;
+    bool bValid = checkSeek(*pSt, nFilePos) && (nRemainingSize >= nValidMin) &&
+        (nPLCF >= nValidMin);
+    nPLCF = bValid ? std::min(nRemainingSize, static_cast<sal_Size>(nPLCF)) : nValidMin;
 
     // Pointer auf Pos- u. Struct-Array
     pPLCF_PosArray = new sal_Int32[ ( nPLCF + 3 ) / 4 ];
commit b7aae6df48abf695bbf9068fc6639f9f78aa3ff2
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jul 15 23:52:01 2011 +0100

    if the offset doesn't exist, don't bother

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 60e1bcd..09608bd 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -3853,122 +3853,126 @@ void WW8ReadSTTBF(bool bVer8, SvStream& rStrm, sal_uInt32 nStart, sal_Int32 nLen
     sal_uInt16 nExtraLen, rtl_TextEncoding eCS, std::vector<String> &rArray,
     std::vector<ww::bytes>* pExtraArray, ::std::vector<String>* pValueArray)
 {
-    if(nLen==0)     // Handle Empty STTBF
+    if (nLen==0)     // Handle Empty STTBF
         return;
 
-    sal_uLong nOldPos = rStrm.Tell();
-    rStrm.Seek( nStart );
-
-    sal_uInt16 nLen2;
-    rStrm >> nLen2; // bVer67: total length of structure
-                    // bVer8 : count of strings
-
-    if( bVer8 )
+    sal_Size nOldPos = rStrm.Tell();
+    if (checkSeek(rStrm, nStart))
     {
-        sal_uInt16 nStrings;
-        bool bUnicode = (0xFFFF == nLen2);
-        if( bUnicode )
-            rStrm >> nStrings;
-        else
-            nStrings = nLen2;
-
-        rStrm >> nExtraLen;
+        sal_uInt16 nLen2(0);
+        rStrm >> nLen2; // bVer67: total length of structure
+                        // bVer8 : count of strings
 
-        for( sal_uInt16 i=0; i < nStrings; i++ )
+        if( bVer8 )
         {
-            if( bUnicode )
-                rArray.push_back(WW8Read_xstz(rStrm, 0, false));
+            sal_uInt16 nStrings(0);
+            bool bUnicode = (0xFFFF == nLen2);
+            if (bUnicode)
+                rStrm >> nStrings;
             else
-            {
-                sal_uInt8 nBChar;
-                rStrm >> nBChar;
-                ByteString aTmp;
-                SafeReadString(aTmp,nBChar,rStrm);
-                rArray.push_back(String(aTmp, eCS));
-            }
+                nStrings = nLen2;
+
+            rStrm >> nExtraLen;
 
-            // Skip the extra data
-            if( nExtraLen )
+            for (sal_uInt16 i=0; i < nStrings; ++i)
             {
-                if (pExtraArray)
+                if (bUnicode)
+                    rArray.push_back(WW8Read_xstz(rStrm, 0, false));
+                else
+                {
+                    sal_uInt8 nBChar(0);
+                    rStrm >> nBChar;
+                    ByteString aTmp;
+                    SafeReadString(aTmp,nBChar,rStrm);
+                    rArray.push_back(String(aTmp, eCS));
+                }
+
+                // Skip the extra data
+                if (nExtraLen)
                 {
-                    ww::bytes extraData;
-                    sal_uInt8 iTmp;
-                    for(int j = 0; j < nExtraLen; ++j)
+                    if (pExtraArray)
                     {
-                        rStrm >> iTmp;
-                        extraData.push_back(iTmp);
+                        ww::bytes extraData;
+                        for (sal_uInt16 j = 0; j < nExtraLen; ++j)
+                        {
+                            sal_uInt8 iTmp(0);
+                            rStrm >> iTmp;
+                            extraData.push_back(iTmp);
+                        }
+                        pExtraArray->push_back(extraData);
                     }
-                    pExtraArray->push_back(extraData);
+                    else
+                        rStrm.SeekRel( nExtraLen );
                 }
-                else
-                    rStrm.SeekRel( nExtraLen );
             }
-        }
-        // read the value of the document variables, if requested.
-        if (pValueArray)
-        {
-                for( sal_uInt16 i=0; i < nStrings; i++ )
+            // read the value of the document variables, if requested.
+            if (pValueArray)
+            {
+                for (sal_uInt16 i=0; i < nStrings; ++i)
                 {
-                        if( bUnicode )
-                                pValueArray->push_back(WW8Read_xstz(rStrm, 0, false));
-                        else
-                        {
-                                sal_uInt8 nBChar;
-                                rStrm >> nBChar;
-                                ByteString aTmp;
-                                SafeReadString(aTmp,nBChar,rStrm);
-                                pValueArray->push_back(String(aTmp, eCS));
-                        }
+                    if( bUnicode )
+                        pValueArray->push_back(WW8Read_xstz(rStrm, 0, false));
+                    else
+                    {
+                        sal_uInt8 nBChar(0);
+                        rStrm >> nBChar;
+                        ByteString aTmp;
+                        SafeReadString(aTmp,nBChar,rStrm);
+                        pValueArray->push_back(String(aTmp, eCS));
+                    }
                 }
+            }
         }
-    }
-    else
-    {
-        sal_uInt8 nBChar;
-        if( nLen2 != nLen )
-        {
-            OSL_ENSURE( nLen2 == nLen, "Fib length and read length are different" );
-            if (nLen > USHRT_MAX)
-                nLen = USHRT_MAX;
-            else if (nLen < 2 )
-                nLen = 2;
-            nLen2 = static_cast<sal_uInt16>(nLen);
-        }
-        sal_uLong nRead = 0;
-        for( nLen2 -= 2; nRead < nLen2;  )
+        else
         {
-            rStrm >> nBChar; ++nRead;
-            if (nBChar)
+            if( nLen2 != nLen )
             {
-                ByteString aTmp;
-                nRead += SafeReadString(aTmp,nBChar,rStrm);
-                rArray.push_back(String(aTmp, eCS));
+                OSL_ENSURE(nLen2 == nLen,
+                    "Fib length and read length are different");
+                if (nLen > USHRT_MAX)
+                    nLen = USHRT_MAX;
+                else if (nLen < 2 )
+                    nLen = 2;
+                nLen2 = static_cast<sal_uInt16>(nLen);
             }
-            else
-                rArray.push_back(aEmptyStr);
-
-            // Skip the extra data (for bVer67 versions this must come from external knowledge)
-            if (nExtraLen)
+            sal_uLong nRead = 0;
+            for( nLen2 -= 2; nRead < nLen2;  )
             {
-                if (pExtraArray)
+                sal_uInt8 nBChar(0);
+                rStrm >> nBChar;
+                ++nRead;
+                if (nBChar)
                 {
-                    ww::bytes extraData;
-                    for(int i =0;i < nExtraLen;i++)
+                    ByteString aTmp;
+                    nRead += SafeReadString(aTmp,nBChar,rStrm);
+                    rArray.push_back(String(aTmp, eCS));
+                }
+                else
+                    rArray.push_back(aEmptyStr);
+
+                // Skip the extra data (for bVer67 versions this must come from
+                // external knowledge)
+                if (nExtraLen)
+                {
+                    if (pExtraArray)
                     {
-                        sal_uInt8 iTmp;
-                        rStrm >> iTmp;
-                        extraData.push_back(iTmp);
+                        ww::bytes extraData;
+                        for (sal_uInt16 i=0;i < nExtraLen;++i)
+                        {
+                            sal_uInt8 iTmp(0);
+                            rStrm >> iTmp;
+                            extraData.push_back(iTmp);
+                        }
+                        pExtraArray->push_back(extraData);
                     }
-                    pExtraArray->push_back(extraData);
+                    else
+                        rStrm.SeekRel( nExtraLen );
+                    nRead+=nExtraLen;
                 }
-                else
-                    rStrm.SeekRel( nExtraLen );
-                nRead+=nExtraLen;
             }
         }
     }
-    rStrm.Seek( nOldPos );
+    rStrm.Seek(nOldPos);
 }
 
 WW8PLCFx_Book::WW8PLCFx_Book(SvStream* pTblSt, const WW8Fib& rFib)
commit a2dc470f1bd045028b020c9a743d881165491aff
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jul 15 23:23:27 2011 +0100

    defer allocating dest until we know the source exists

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 2a9f8ce..60e1bcd 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -1590,7 +1590,7 @@ void WW8ScannerBase::DeletePieceTable()
 }
 
 WW8ScannerBase::WW8ScannerBase( SvStream* pSt, SvStream* pTblSt,
-    SvStream* pDataSt, const WW8Fib* pWwFib )
+    SvStream* pDataSt, WW8Fib* pWwFib )
     : pWw8Fib(pWwFib), pMainFdoa(0), pHdFtFdoa(0), pMainTxbx(0),
     pMainTxbxBkd(0), pHdFtTxbx(0), pHdFtTxbxBkd(0), pMagicTables(0),
     pSubdocs(0), pExtendedAtrds(0), pPieceGrpprls(0)
@@ -1696,14 +1696,19 @@ WW8ScannerBase::WW8ScannerBase( SvStream* pSt, SvStream* pTblSt,
                 pSubdocs = new WW8PLCFspecial( pTblSt,
                     pWwFib->fcPlcfwkb, pWwFib->lcbPlcfwkb, 12);
             }
-        // Extended ATRD
+            // Extended ATRD
             if (pWwFib->fcAtrdExtra && pWwFib->lcbAtrdExtra)
             {
-                pExtendedAtrds = new sal_uInt8[pWwFib->lcbAtrdExtra];
-        long nOldPos = pTblSt->Tell();
-        pTblSt->Seek(pWwFib->fcAtrdExtra);
-        pTblSt->Read(pExtendedAtrds, pWwFib->lcbAtrdExtra);
-            pTblSt->Seek(nOldPos);
+                sal_Size nOldPos = pTblSt->Tell();
+                if (checkSeek(*pTblSt, pWwFib->fcAtrdExtra))
+                {
+                    pExtendedAtrds = new sal_uInt8[pWwFib->lcbAtrdExtra];
+                    pWwFib->lcbAtrdExtra = pTblSt->Read(pExtendedAtrds,
+                        pWwFib->lcbAtrdExtra);
+                }
+                else
+                    pWwFib->lcbAtrdExtra = 0;
+                pTblSt->Seek(nOldPos);
             }
 
             break;
diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx
index 135355e..039b5e3 100644
--- a/sw/source/filter/ww8/ww8scan.hxx
+++ b/sw/source/filter/ww8/ww8scan.hxx
@@ -927,7 +927,7 @@ friend class SwWW8FltControlStack;
 #endif
 
 private:
-    const WW8Fib* pWw8Fib;
+    WW8Fib* pWw8Fib;
     WW8PLCFx_Cp_FKP*  pChpPLCF;         // Character-Attrs
     WW8PLCFx_Cp_FKP*  pPapPLCF;         // Para-Attrs
     WW8PLCFx_SEPX*    pSepPLCF;         // Section-Attrs
@@ -963,7 +963,7 @@ private:
     void DeletePieceTable();
 public:
     WW8ScannerBase( SvStream* pSt, SvStream* pTblSt, SvStream* pDataSt,
-        const WW8Fib* pWwF );
+        WW8Fib* pWwF );
     ~WW8ScannerBase();
     bool AreThereFootnotes() const { return pFtnPLCF->Count() > 0; };
     bool AreThereEndnotes()  const { return pEdnPLCF->Count() > 0; };
commit ac85be1a5c89b2e0b8baf1325c38914386b9bb0e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jul 15 22:17:15 2011 +0100

    horrifically hard to find bug, deleted paras referenced by uncommitted props

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 104cdfc..750182e 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -3597,6 +3597,7 @@ SwWW8ImplReader::SwWW8ImplReader(sal_uInt8 nVersionPara, SvStorage* pStorage,
     pDataStream(0),
     rDoc(rD),
     maSectionManager(*this),
+    m_aExtraneousParas(rD),
     maInsertedTables(rD),
     maSectionNameGenerator(rD,CREATE_CONST_ASC("WW")),
     maGrfNameGenerator(bNewDoc,String('G')),
@@ -4084,6 +4085,21 @@ void wwSectionManager::InsertSegments()
     }
 }
 
+void wwExtraneousParas::delete_all_from_doc()
+{
+    typedef std::vector<SwTxtNode*>::iterator myParaIter;
+    myParaIter aEnd = m_aTxtNodes.end();
+    for (myParaIter aI = m_aTxtNodes.begin(); aI != aEnd; ++aI)
+    {
+        SwTxtNode *pTxtNode = *aI;
+        SwNodeIndex aIdx(*pTxtNode);
+        SwPosition aPos(aIdx);
+        SwPaM aTest(aPos);
+        m_rDoc.DelFullPara(aTest);
+    }
+    m_aTxtNodes.clear();
+}
+
 void SwWW8ImplReader::StoreMacroCmds()
 {
     if (pWwFib->lcbCmds)
@@ -4711,6 +4727,11 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss, const SwPosition &rPos)
     DeleteAnchorStk();
     DeleteRefStks();
 
+    //remove extra paragraphs after attribute ctrl
+    //stacks etc. are destroyed, and before fields
+    //are updated
+    m_aExtraneousParas.delete_all_from_doc();
+
     UpdateFields();
 
     // delete the pam before the call for hide all redlines (Bug 73683)
diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index df9736a..5a941ba 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -57,6 +57,8 @@
 #include <editeng/lrspitem.hxx>
 #include <oox/ole/olehelper.hxx>
 
+#include <boost/noncopyable.hpp>
+
 class SwDoc;
 class SwPaM;
 class SfxPoolItem;
@@ -839,6 +841,33 @@ public:
     sal_uInt32 GetTextAreaWidth() const;
 };
 
+//Various writer elements like frames start off containing a blank paragraph,
+//sometimes this paragraph turns out to be extraneous, e.g. the frame should
+//only contain a table with no trailing paragraph.
+//
+//We want to remove these extra paragraphs, but removing them during the parse
+//is problematic, because we don't want to remove any paragraphs that are still
+//addressed by property entries in a SwFltControlStack which have not yet been
+//committed to the document.
+//
+//Safest thing is to not delete SwTxtNodes from a document during import, and
+//remove these extraneous paragraphs at the end after all SwFltControlStack are
+//destroyed.
+class wwExtraneousParas : private ::boost::noncopyable
+{
+private:
+    /*
+    A vector of SwTxtNodes to erase from a document after import is complete
+    */
+    std::vector<SwTxtNode*> m_aTxtNodes;
+    SwDoc& m_rDoc;
+public:
+    wwExtraneousParas(SwDoc &rDoc) : m_rDoc(rDoc) {}
+    ~wwExtraneousParas() { delete_all_from_doc(); }
+    void push_back(SwTxtNode *pTxtNode) { m_aTxtNodes.push_back(pTxtNode); }
+    void delete_all_from_doc();
+};
+
 class wwFrameNamer
 {
 private:
@@ -1007,6 +1036,13 @@ private:
     wwSectionManager maSectionManager;
 
     /*
+    A vector of surplus-to-requirements paragraph in the final document,
+    that exist because of quirks of the SwDoc document model and/or API,
+    which need to be removed.
+    */
+    wwExtraneousParas m_aExtraneousParas;
+
+    /*
     A map of of tables to their follow nodes for use in inserting tables into
     already existing document, i.e. insert file
     */
diff --git a/sw/source/filter/ww8/ww8par6.cxx b/sw/source/filter/ww8/ww8par6.cxx
index ed43304..9870083 100644
--- a/sw/source/filter/ww8/ww8par6.cxx
+++ b/sw/source/filter/ww8/ww8par6.cxx
@@ -2272,7 +2272,12 @@ SwTwips SwWW8ImplReader::MoveOutsideFly(SwFrmFmt *pFlyFmt,
                         aIdx++;
                         if (aIdx == aEnd && pNd && !pNd->GetTxt().Len())
                         {
-                            rDoc.DelFullPara( *pPaM );
+                            //An extra pre-created by writer unused paragraph
+                            //
+                            //delete after import is complete rather than now
+                            //to avoid the complication of managing uncommitted
+                            //ctrlstack properties that refer to it.
+                            m_aExtraneousParas.push_back(pNd);
 
                             SwTable& rTable = pTable->GetTable();
                             SwFrmFmt* pTblFmt = rTable.GetFrmFmt();
commit d349886cd73c76f2d01af00d00e170d9d888426e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jul 14 22:07:08 2011 +0100

    callcatcher: remove unused methods

diff --git a/sw/source/filter/inc/msfilter.hxx b/sw/source/filter/inc/msfilter.hxx
index 68ab860..69885d1 100644
--- a/sw/source/filter/inc/msfilter.hxx
+++ b/sw/source/filter/inc/msfilter.hxx
@@ -318,7 +318,6 @@ namespace sw
         public:
             String msPrimary;
             String msSecondary;
-            bool HasDistinctSecondary() const;
             FontMapExport(const String &rFontDescription);
         };
         
diff --git a/sw/source/filter/ww8/writerwordglue.cxx b/sw/source/filter/ww8/writerwordglue.cxx
index 944bf62..e0cf390 100644
--- a/sw/source/filter/ww8/writerwordglue.cxx
+++ b/sw/source/filter/ww8/writerwordglue.cxx
@@ -467,13 +467,6 @@ namespace sw
                 msSecondary = GetFontToken(rFamilyName, 1);
         }
 
-        bool FontMapExport::HasDistinctSecondary() const
-        {
-            if (msSecondary.Len() && msSecondary != msPrimary)
-                return true;
-            return false;
-        }
-
         bool ItemSort::operator()(sal_uInt16 nA, sal_uInt16 nB) const
         {
             /*
commit a4e8592c1ff63798910d807c1a13b442bf465e6b
Author: Michael Meeks <michael.meeks at novell.com>
Date:   Mon Jul 18 11:08:12 2011 +0100

    adapt to new InsertAutomaticEntryColor method

diff --git a/sw/source/ui/misc/pggrid.cxx b/sw/source/ui/misc/pggrid.cxx
index 4fc9e26..4f00f42 100644
--- a/sw/source/ui/misc/pggrid.cxx
+++ b/sw/source/ui/misc/pggrid.cxx
@@ -144,13 +144,12 @@ SwTextGridPage::SwTextGridPage(Window *pParent, const SfxItemSet &rSet) :
     Link aModifyLk = LINK(this, SwTextGridPage, GridModifyHdl);
     aColorLB.SetSelectHdl(aModifyLk);
     aPrintCB.SetClickHdl(aModifyLk);
-    aRubyBelowCB.SetClickHdl(aModifyLk);   
-
+    aRubyBelowCB.SetClickHdl(aModifyLk);
 
     aDisplayCB.SetClickHdl(LINK(this, SwTextGridPage, DisplayGridHdl));
 
     XColorTable& rColorTbl = XColorTable::GetStdColorTable();
-    aColorLB.InsertAutomaticEntry();
+    aColorLB.InsertAutomaticEntryColor( Color( COL_AUTO ) );
     for( sal_uInt16 i = 0; i < rColorTbl.Count(); ++i )
     {
         XColorEntry* pEntry = rColorTbl.GetColor( i );
commit 94959497c0a9fe956f0b12a35ae98148db25bd62
Author: Miklos Vajna <vmiklos at frugalware.org>
Date:   Fri Jul 15 18:11:43 2011 +0200

    starmath: check for edit window when inline editing is enabled

diff --git a/starmath/source/view.cxx b/starmath/source/view.cxx
index b3d77ff..414138a 100644
--- a/starmath/source/view.cxx
+++ b/starmath/source/view.cxx
@@ -224,7 +224,8 @@ void SmGraphicWindow::GetFocus()
 {
     if (!IsInlineEditEnabled())
         return;
-    pViewShell->GetEditWindow()->Flush();
+    if (pViewShell->GetEditWindow())
+        pViewShell->GetEditWindow()->Flush();
     //Let view shell know what insertions should be done in visual editor
     pViewShell->SetInsertIntoEditWindow(false);
     SetIsCursorVisible(true);
commit 0f00ab3bc9004d56488e28ca55c4a62a435876f7
Author: Miklos Vajna <vmiklos at frugalware.org>
Date:   Thu Jul 14 16:44:32 2011 +0200

    starmath: check for existing edit window

diff --git a/starmath/source/view.cxx b/starmath/source/view.cxx
index 79bfd82..b3d77ff 100644
--- a/starmath/source/view.cxx
+++ b/starmath/source/view.cxx
@@ -195,6 +195,8 @@ void SmGraphicWindow::MouseButtonDown(const MouseEvent& rMEvt)
 
         if (pNode)
         {	SmEditWindow  *pEdit = pViewShell->GetEditWindow();
+            if (!pEdit)
+                return;
             const SmToken  aToken (pNode->GetToken());
 
             // set selection to the beginning of the token
commit 95351a519bec2833f5d936c20e3916a4e283b0f6
Author: Noel Power <noel.power at novell.com>
Date:   Fri Jul 15 16:11:37 2011 +0100

    fix for bnc#693477 ensure table alignment is preserved

diff --git a/sw/source/filter/ww8/ww8par6.cxx b/sw/source/filter/ww8/ww8par6.cxx
index 131d49f..ed43304 100644
--- a/sw/source/filter/ww8/ww8par6.cxx
+++ b/sw/source/filter/ww8/ww8par6.cxx
@@ -2283,7 +2283,8 @@ SwTwips SwWW8ImplReader::MoveOutsideFly(SwFrmFmt *pFlyFmt,
                                 aSize.SetHeightSizeType(ATT_MIN_SIZE);
                                 aSize.SetHeight(MINLAY);
                                 pFlyFmt->SetFmtAttr(aSize);
-                                pTblFmt->SetFmtAttr(SwFmtHoriOrient(0,text::HoriOrientation::FULL));
+                                SwFmtHoriOrient aHori = pTblFmt->GetHoriOrient();
+                                pTblFmt->SetFmtAttr(SwFmtHoriOrient(0, aHori.GetHoriOrient() ) );
                                 nRetWidth = aSize.GetWidth();
                             }
                         }
commit 433833e8a77dad2dcc272c867c858beacea2ebc6
Author: Matúš Kukan <matus.kukan at gmail.com>
Date:   Fri Jul 15 16:40:20 2011 +0200

    Add prefixes for component_getFactory methods

diff --git a/starmath/source/detreg.cxx b/starmath/source/detreg.cxx
index b6f7733..d7f6f64 100644
--- a/starmath/source/detreg.cxx
+++ b/starmath/source/detreg.cxx
@@ -42,7 +42,7 @@ using namespace ::com::sun::star::lang;
 
 extern "C" {
 
-SAL_DLLPUBLIC_EXPORT void* SAL_CALL component_getFactory( const sal_Char* pImplementationName,
+SAL_DLLPUBLIC_EXPORT void* SAL_CALL smd_component_getFactory( const sal_Char* pImplementationName,
                                      void* pServiceManager,
                                      void* /*pRegistryKey*/ )
 {
diff --git a/starmath/source/register.cxx b/starmath/source/register.cxx
index cb8d546..7d44e2b 100644
--- a/starmath/source/register.cxx
+++ b/starmath/source/register.cxx
@@ -112,7 +112,7 @@ extern Reference< XInterface > SAL_CALL
 
 extern "C" {
 
-SAL_DLLPUBLIC_EXPORT void* SAL_CALL component_getFactory( const sal_Char* pImplementationName,
+SAL_DLLPUBLIC_EXPORT void* SAL_CALL sm_component_getFactory( const sal_Char* pImplementationName,
                                      void* pServiceManager,
                                      void* /*pRegistryKey*/ )
 {
diff --git a/starmath/util/sm.component b/starmath/util/sm.component
index 8047662..407f067 100644
--- a/starmath/util/sm.component
+++ b/starmath/util/sm.component
@@ -26,7 +26,7 @@
 *
 **********************************************************************-->
 
-<component loader="com.sun.star.loader.SharedLibrary"
+<component loader="com.sun.star.loader.SharedLibrary" prefix="sm"
     xmlns="http://openoffice.org/2010/uno-components">
   <implementation name="com.sun.star.comp.Math.FormulaDocument">
     <service name="com.sun.star.formula.FormulaProperties"/>
diff --git a/starmath/util/smd.component b/starmath/util/smd.component
index 9f56686..70adf5a 100644
--- a/starmath/util/smd.component
+++ b/starmath/util/smd.component
@@ -26,7 +26,7 @@
 *
 **********************************************************************-->
 
-<component loader="com.sun.star.loader.SharedLibrary"
+<component loader="com.sun.star.loader.SharedLibrary" prefix="smd"
     xmlns="http://openoffice.org/2010/uno-components">
   <implementation name="com.sun.star.comp.math.FormatDetector">
     <service name="com.sun.star.frame.ExtendedTypeDetection"/>
diff --git a/sw/source/filter/ww8/docxexportfilter.cxx b/sw/source/filter/ww8/docxexportfilter.cxx
index 62daec9..38faf1c 100644
--- a/sw/source/filter/ww8/docxexportfilter.cxx
+++ b/sw/source/filter/ww8/docxexportfilter.cxx
@@ -143,7 +143,7 @@ extern "C"
     { 0, 0, 0, 0, 0, 0 }
 };
 
-SAL_DLLPUBLIC_EXPORT void* SAL_CALL component_getFactory( const sal_Char* pImplName, void* pServiceManager, void* pRegistryKey )
+SAL_DLLPUBLIC_EXPORT void* SAL_CALL msword_component_getFactory( const sal_Char* pImplName, void* pServiceManager, void* pRegistryKey )
 {
     return ::cppu::component_getFactoryHelper( pImplName, pServiceManager, pRegistryKey, entries );
 }
diff --git a/sw/source/ui/uno/detreg.cxx b/sw/source/ui/uno/detreg.cxx
index 0b64aa5..3e47120 100644
--- a/sw/source/ui/uno/detreg.cxx
+++ b/sw/source/ui/uno/detreg.cxx
@@ -37,7 +37,7 @@ using namespace ::com::sun::star::lang;
 
 extern "C" {
 
-SAL_DLLPUBLIC_EXPORT void* SAL_CALL component_getFactory(
+SAL_DLLPUBLIC_EXPORT void* SAL_CALL swd_component_getFactory(
     const sal_Char* pImplementationName,
     void* pServiceManager,
     void* /*pRegistryKey*/ )
diff --git a/sw/source/ui/uno/unofreg.cxx b/sw/source/ui/uno/unofreg.cxx
index a9d6d96..38f3b5b 100644
--- a/sw/source/ui/uno/unofreg.cxx
+++ b/sw/source/ui/uno/unofreg.cxx
@@ -160,7 +160,7 @@ static ::cppu::ImplementationEntry const entries[] = {
     { 0, 0, 0, 0, 0, 0 }
 };
 
-SAL_DLLPUBLIC_EXPORT void * SAL_CALL component_getFactory(
+SAL_DLLPUBLIC_EXPORT void * SAL_CALL sw_component_getFactory(
     const sal_Char * pImplName,
     void * pServiceManager,
     void * pRegistryKey )
diff --git a/sw/source/ui/vba/service.cxx b/sw/source/ui/vba/service.cxx
index 7568106..7bdc724 100644
--- a/sw/source/ui/vba/service.cxx
+++ b/sw/source/ui/vba/service.cxx
@@ -63,18 +63,15 @@ namespace vbaeventshelper
 extern sdecl::ServiceDecl const serviceDecl;
 }
 
-extern "C"
+extern "C" SAL_DLLPUBLIC_EXPORT void * SAL_CALL vbaswobj_component_getFactory(
+    const sal_Char * pImplName, lang::XMultiServiceFactory * pServiceManager,
+    registry::XRegistryKey * pRegistryKey )
 {
-    SAL_DLLPUBLIC_EXPORT void * SAL_CALL component_getFactory( 
-        const sal_Char * pImplName, lang::XMultiServiceFactory * pServiceManager,
-        registry::XRegistryKey * pRegistryKey )
-    {
-        OSL_TRACE("In component_getFactory for %s", pImplName );
-    void* pRet =  component_getFactoryHelper(
-            pImplName, pServiceManager, pRegistryKey, globals::serviceDecl, document::serviceDecl, wrapformat::serviceDecl, vbaeventshelper::serviceDecl );
+    void* pRet = component_getFactoryHelper(pImplName, pServiceManager,
+            pRegistryKey, globals::serviceDecl, document::serviceDecl,
+            wrapformat::serviceDecl, vbaeventshelper::serviceDecl );
     OSL_TRACE("Ret is 0x%x", pRet);
     return pRet;
-    }
 }
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/util/msword.component b/sw/util/msword.component
index 54e638e..5457603 100644
--- a/sw/util/msword.component
+++ b/sw/util/msword.component
@@ -25,7 +25,8 @@
 * for a copy of the LGPLv3 License.
 *
 **********************************************************************-->
-<component xmlns="http://openoffice.org/2010/uno-components" loader="com.sun.star.loader.SharedLibrary">
+<component loader="com.sun.star.loader.SharedLibrary" prefix="msword"
+    xmlns="http://openoffice.org/2010/uno-components">
   <implementation name="com.sun.star.comp.Writer.RtfExport">
     <service name="com.sun.star.comp.Writer.RtfExport"/>
   </implementation>
diff --git a/sw/util/sw.component b/sw/util/sw.component
index 7f73777..643576c 100644
--- a/sw/util/sw.component
+++ b/sw/util/sw.component
@@ -25,7 +25,8 @@
 * for a copy of the LGPLv3 License.
 *
 **********************************************************************-->
-<component xmlns="http://openoffice.org/2010/uno-components" loader="com.sun.star.loader.SharedLibrary">
+<component loader="com.sun.star.loader.SharedLibrary" prefix="sw"
+    xmlns="http://openoffice.org/2010/uno-components">
   <implementation name="SwXAutoTextContainer">
     <service name="com.sun.star.text.AutoTextContainer"/>
   </implementation>
diff --git a/sw/util/swd.component b/sw/util/swd.component
index c89c007..74182f7 100644
--- a/sw/util/swd.component
+++ b/sw/util/swd.component
@@ -26,7 +26,7 @@
 *
 **********************************************************************-->
 
-<component loader="com.sun.star.loader.SharedLibrary"
+<component loader="com.sun.star.loader.SharedLibrary" prefix="swd"
     xmlns="http://openoffice.org/2010/uno-components">
   <implementation name="com.sun.star.comp.writer.FormatDetector">
     <service name="com.sun.star.frame.ExtendedTypeDetection"/>
diff --git a/sw/util/vbaswobj.component b/sw/util/vbaswobj.component
index e6c6fe4..b281a4b 100644
--- a/sw/util/vbaswobj.component
+++ b/sw/util/vbaswobj.component
@@ -26,7 +26,7 @@
 *
 **********************************************************************-->
 
-<component loader="com.sun.star.loader.SharedLibrary"
+<component loader="com.sun.star.loader.SharedLibrary" prefix="vbaswobj"
     xmlns="http://openoffice.org/2010/uno-components">
   <implementation name="SwVbaDocument">
     <service name="ooo.vba.word.Document"/>
commit ad0a10837aa240ab6cd693f9eb4cbb9705315982
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jul 14 15:20:28 2011 +0100

    If nFib is 0x00D9 or greater, then cQuickSaves MUST be 0xF

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index b0a2912..2a9f8ce 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -5600,6 +5600,9 @@ WW8Fib::WW8Fib(sal_uInt8 nVer)
         nProduct = 0xc02d;
     }
 
+    //If nFib is 0x00D9 or greater, then cQuickSaves MUST be 0xF
+    cQuickSaves = nFib >= 0x00D9 ? 0xF : 0;
+
     // --> #i90932# 
     lid = 0x409; // LANGUAGE_ENGLISH_US
 
commit 7dd8caa00b410d48ba8a8f8e194fa45bc0280f68
Author: Nigel Hawkins <n.hawkins at gmx.com>
Date:   Thu Jul 14 06:37:51 2011 +0100

    Fix "signed/unsigned comparison" warning in itrcrsr.cxx.

diff --git a/sw/source/core/text/itrcrsr.cxx b/sw/source/core/text/itrcrsr.cxx
index ee7307a..3c4bebd 100644
--- a/sw/source/core/text/itrcrsr.cxx
+++ b/sw/source/core/text/itrcrsr.cxx
@@ -539,7 +539,7 @@ void SwTxtCursor::_GetCharRect( SwRect* pOrig, const xub_StrLen nOfst,
         SwTwips nLastBidiPorWidth = 0;
         std::deque<sal_uInt16>* pKanaComp = pCurr->GetpKanaComp();
         MSHORT nSpaceIdx = 0;
-        MSHORT nKanaIdx = 0;
+        size_t nKanaIdx = 0;
         long nSpaceAdd = pCurr->IsSpaceAdd() ? pCurr->GetLLSpaceAdd( 0 ) : 0;
 
         sal_Bool bNoTxt = sal_True;
commit 933ea1547678bd89053929623b55c9dead84a164
Author: Jan Holesovsky <kendy at suse.cz>
Date:   Wed Jul 13 20:17:35 2011 +0200

    Fix counting the paragraphs, fdo#36816.
    
    Signed-off-by: Noel Power <noel.power at novell.com>

diff --git a/sw/source/core/txtnode/txtedt.cxx b/sw/source/core/txtnode/txtedt.cxx
index 9ea7e4c..114d541 100644
--- a/sw/source/core/txtnode/txtedt.cxx
+++ b/sw/source/core/txtnode/txtedt.cxx

... etc. - the rest is truncated


More information about the Libreoffice-commits mailing list