[Libreoffice-commits] .: 28 commits - sw/source

Jan Holesovsky kendy at kemper.freedesktop.org
Thu Jul 28 09:41:49 PDT 2011


 sw/source/filter/rtf/swparrtf.cxx            |   14 ++++++--
 sw/source/filter/ww8/attributeoutputbase.hxx |    3 +
 sw/source/filter/ww8/docxattributeoutput.cxx |   17 ---------
 sw/source/filter/ww8/ww8atr.cxx              |   47 ++++++++++++++++++---------
 4 files changed, 47 insertions(+), 34 deletions(-)

New commits:
commit e63d5d1e183d7d2347484b811912201fb468367c
Merge: 8a1e355... 04e3570...
Author: Jan Holesovsky <kendy at suse.cz>
Date:   Thu Jul 28 18:40:13 2011 +0200

    Merge branch 'master' of git://anongit.freedesktop.org/libreoffice/writer

commit 8a1e355e1fb1f64ca5b2763d975fcfd9cdfcd374
Merge: 49707cf... 2489ca4...
Author: Jan Holesovsky <kendy at suse.cz>
Date:   Thu Jul 28 18:36:05 2011 +0200

    Merge commit 'libreoffice-3.4.2.3'
    
    Conflicts:
    	sw/qa/core/data/ww8/pass/CVE-2008-4841-1.doc
    	sw/source/core/docnode/ndcopy.cxx
    	sw/source/filter/ww8/ww8par.cxx
    	sw/source/filter/ww8/ww8par.hxx
    	sw/source/filter/ww8/ww8scan.cxx
    	sw/source/filter/ww8/ww8scan.hxx

commit 2489ca4fb15ddb62bd62eb7b53d39581cbaef24f
Author: Petr Mladek <pmladek at suse.cz>
Date:   Mon Jul 25 20:28:46 2011 +0200

    Version 3.4.2.3, tag libreoffice-3.4.2.3 (3.4.2-rc3)
commit 0b9515702ab474da6ae7700828563275f9cda968
Author: Petr Mladek <pmladek at suse.cz>
Date:   Tue Jul 19 17:08:03 2011 +0200

    Version 3.4.2.2, tag libreoffice-3.4.2.2 (3.4.2-rc2)
commit da18e058e54024bfb1a8694e0a316423a57f154b
Author: Miklos Vajna <vmiklos at frugalware.org>
Date:   Fri Jul 15 18:11:43 2011 +0200

    starmath: check for edit window when inline editing is enabled
    
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>
    Signed-off-by: Petr Mladek <pmladek at suse.cz>
    Signed-off-by: Jonas Finnemann Jensen <jopsen at gmail.com>

diff --git a/starmath/source/view.cxx b/starmath/source/view.cxx
index 662911e..c924e31 100644
--- a/starmath/source/view.cxx
+++ b/starmath/source/view.cxx
@@ -224,7 +224,8 @@ void SmGraphicWindow::GetFocus()
 {
     if (!IsInlineEditEnabled())
         return;
-    pViewShell->GetEditWindow()->Flush();
+    if (pViewShell->GetEditWindow())
+        pViewShell->GetEditWindow()->Flush();
     //Let view shell know what insertions should be done in visual editor
     pViewShell->SetInsertIntoEditWindow(false);
     SetIsCursorVisible(true);
commit 33f8e4826ca01860cef7f85ab5f4ccb298ec371d
Author: Miklos Vajna <vmiklos at frugalware.org>
Date:   Thu Jul 14 16:44:32 2011 +0200

    starmath: check for existing edit window
    
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>
    Signed-off-by: Petr Mladek <pmladek at suse.cz>
    Signed-off-by: Jonas Finnemann Jensen <jopsen at gmail.com>

diff --git a/starmath/source/view.cxx b/starmath/source/view.cxx
index 3a099c3..662911e 100644
--- a/starmath/source/view.cxx
+++ b/starmath/source/view.cxx
@@ -195,6 +195,8 @@ void SmGraphicWindow::MouseButtonDown(const MouseEvent& rMEvt)
 
         if (pNode)
         {	SmEditWindow  *pEdit = pViewShell->GetEditWindow();
+            if (!pEdit)
+                return;
             const SmToken  aToken (pNode->GetToken());
 
             // set selection to the beginning of the token
commit bae73094a02deaad5f23027869151a866e6287e7
Author: Jan Holesovsky <kendy at suse.cz>
Date:   Wed Jul 13 20:17:35 2011 +0200

    Fix counting the paragraphs, fdo#36816.
    
    Signed-off-by: Noel Power <noel.power at novell.com>
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>

diff --git a/sw/source/core/txtnode/txtedt.cxx b/sw/source/core/txtnode/txtedt.cxx
index 08d0c6b..d54875a 100644
--- a/sw/source/core/txtnode/txtedt.cxx
+++ b/sw/source/core/txtnode/txtedt.cxx
@@ -1803,6 +1803,10 @@ void SwTxtNode::CountWords( SwDocStat& rStat,
     {   // not counting hidden paras
         return;
     }
+
+    // count of non-empty paras
+    ++rStat.nPara;
+
     // Shortcut when counting whole paragraph and current count is clean
     if ( isCountAll && !IsWordCountDirty() )
     {
@@ -1842,8 +1846,6 @@ void SwTxtNode::CountWords( SwDocStat& rStat,
     sal_uInt32 nTmpChars = 0;        // count of all chars
     sal_uInt32 nTmpCharsExcludingSpaces = 0;  // all non-white chars
 
-    ++rStat.nPara;      // count of non-empty paras
-
     // count words in masked and expanded text:
     if( pBreakIt->GetBreakIter().is() )
     {
commit 7563bc73db5e50a956e659a207f5c5d0b3fcb378
Author: Petr Mladek <pmladek at suse.cz>
Date:   Tue Jul 12 16:41:14 2011 +0200

    Branch libreoffice-3-4-2
    
    This is 'libreoffice-3-4-2' - the stable branch for the 3.4.2 release.
    Only very safe changes, reviewed by three people are allowed.
    
    If you want to commit more complicated fix for the next 3.4.x release,
    please use the 'libreoffice-3-4' branch.
    
    If you want to build something cool, unstable, and risky, use master.
commit 7ebbf957db581ffd9e95adf65d88481a3cce67d4
Author: Petr Mladek <pmladek at suse.cz>
Date:   Tue Jul 12 15:49:44 2011 +0200

    Version 3.4.2.1, tag libreoffice-3.4.2.1 (3.4.2-rc1)
commit 5746d502a21087350a17f4b9045f7c095cd17ba9
Author: Cédric Bosdonnat <cedric.bosdonnat.ooo at free.fr>
Date:   Fri Jul 8 14:49:14 2011 +0200

    n#695479: basic handling of lines in RTF import
    
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>

diff --git a/sw/source/filter/rtf/swparrtf.cxx b/sw/source/filter/rtf/swparrtf.cxx
index 1b5c076..49a6f77 100644
--- a/sw/source/filter/rtf/swparrtf.cxx
+++ b/sw/source/filter/rtf/swparrtf.cxx
@@ -1173,7 +1173,7 @@ void SwRTFParser::ReadShpTxt(String& s)
 }
 
 /*
- * Very basic support for the "Buchhalternase".
+ * Very basic support for the Z-line.
  */
 void SwRTFParser::ReadDrawingObject()
 {
@@ -1185,6 +1185,9 @@ void SwRTFParser::ReadDrawingObject()
     ::basegfx::B2DPoint aPoint;
     bool bPolygonActive(false);
 
+    SwFmtHoriOrient aHori( 0, text::HoriOrientation::NONE, text::RelOrientation::PAGE_FRAME );
+    SwFmtVertOrient aVert( 0, text::VertOrientation::NONE, text::RelOrientation::PAGE_FRAME );
+
     while (level>0 && IsParserWorking())
     {
         nToken = GetNextToken();
@@ -1196,6 +1199,12 @@ void SwRTFParser::ReadDrawingObject()
             case '{':
                 level++;
                 break;
+            case RTF_DOBXMARGIN:
+                aHori.SetRelationOrient( text::RelOrientation::PAGE_PRINT_AREA );
+                break;
+            case RTF_DOBYMARGIN:
+                aVert.SetRelationOrient( text::RelOrientation::PAGE_PRINT_AREA );
+                break;
             case RTF_DPX:
                 aRect.setX(nTokenValue);
                 break;
@@ -1208,6 +1217,7 @@ void SwRTFParser::ReadDrawingObject()
             case RTF_DPYSIZE:
                 aRect.setHeight(nTokenValue);
                 break;
+            case RTF_DPLINE:
             case RTF_DPPOLYCOUNT:
                 bPolygonActive = true;
                 break;
@@ -1244,9 +1254,7 @@ void SwRTFParser::ReadDrawingObject()
         aAnchor.SetAnchor( pPam->GetPoint() );
         aFlySet.Put( aAnchor );
 
-        SwFmtHoriOrient aHori( 0, text::HoriOrientation::NONE, text::RelOrientation::PAGE_FRAME );
         aFlySet.Put( aHori );
-        SwFmtVertOrient aVert( 0, text::VertOrientation::NONE, text::RelOrientation::PAGE_FRAME );
         aFlySet.Put( aVert );
 
         pDoc->GetOrCreateDrawModel();
commit 92c1de7d394bf02e8a344a81844b6534114c3343
Author: marc-andre at atc.tcs.com <marc-andre at atc.tcs.com>
Date:   Fri Jul 8 14:23:34 2011 +0530

    Fixed a segmentation fault in some edge cases
    (cherry picked from commit 79f14410f2db7d186c8b7ee94b09e8e362e74dfd)

diff --git a/sw/source/filter/ww8/ww8par6.cxx b/sw/source/filter/ww8/ww8par6.cxx
index 79ff1d5..e393472 100644
--- a/sw/source/filter/ww8/ww8par6.cxx
+++ b/sw/source/filter/ww8/ww8par6.cxx
@@ -917,6 +917,7 @@ void wwSectionManager::CreateSep(const long nTxtPos, bool /*bMustHaveBreak*/)
         aNewSection.maSep.fEvenlySpaced =
             ReadBSprm(pSep, (eVer <= ww::eWW7 ? 138 : 0x3005), 1) ? true : false;
 
+        const sal_uInt8 numrgda = SAL_N_ELEMENTS(aNewSection.maSep.rgdxaColumnWidthSpacing);
         if (aNewSection.maSep.ccolM1 > 0 && !aNewSection.maSep.fEvenlySpaced)
         {
             aNewSection.maSep.rgdxaColumnWidthSpacing[0] = 0;
@@ -930,7 +931,8 @@ void wwSectionManager::CreateSep(const long nTxtPos, bool /*bMustHaveBreak*/)
                 OSL_ENSURE( pSW, "+Sprm 136 (bzw. 0xF203) (ColWidth) fehlt" );
                 sal_uInt16 nWidth = pSW ? SVBT16ToShort(pSW + 1) : 1440;
 
-                aNewSection.maSep.rgdxaColumnWidthSpacing[++nIdx] = nWidth;
+                if (++nIdx < numrgda)
+                    aNewSection.maSep.rgdxaColumnWidthSpacing[nIdx] = nWidth;
 
                 if (i < nCols-1)
                 {
@@ -941,7 +943,8 @@ void wwSectionManager::CreateSep(const long nTxtPos, bool /*bMustHaveBreak*/)
                     if( pSD )
                     {
                         nWidth = SVBT16ToShort(pSD + 1);
-                        aNewSection.maSep.rgdxaColumnWidthSpacing[++nIdx] = nWidth;
+                        if (++nIdx < numrgda)
+                            aNewSection.maSep.rgdxaColumnWidthSpacing[nIdx] = nWidth;
                     }
                 }
             }
commit 54a88fdf62d8e7507e7c3822e5fdddfeeeaa335b
Author: marc-andre at atc.tcs.com <marc-andre at atc.tcs.com>
Date:   Wed Jul 6 13:15:42 2011 +0530

    Fixed core dump and invalid memory access for some edge cases
    (cherry picked from commit b991a2fb76e2859d7f04793ad7ad3a0596d8d630)
    
    Signed-off-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/core/doc/docnew.cxx b/sw/source/core/doc/docnew.cxx
index 6cc62a1..111afa7 100644
--- a/sw/source/core/doc/docnew.cxx
+++ b/sw/source/core/doc/docnew.cxx
@@ -909,39 +909,40 @@ void SwDoc::UpdateLinks( sal_Bool bUI )
 {
     SfxObjectCreateMode eMode;
     sal_uInt16 nLinkMode = getLinkUpdateMode( true );
-    sal_uInt16 nUpdateDocMode = GetDocShell()->GetUpdateDocMode();
-    if( GetDocShell() &&
-            (nLinkMode != NEVER ||  document::UpdateDocMode::FULL_UPDATE == nUpdateDocMode) &&
-        GetLinkManager().GetLinks().Count() &&
-        SFX_CREATE_MODE_INTERNAL !=
-                    ( eMode = GetDocShell()->GetCreateMode()) &&
-        SFX_CREATE_MODE_ORGANIZER != eMode &&
-        SFX_CREATE_MODE_PREVIEW != eMode &&
-        !GetDocShell()->IsPreview() )
-    {
-        ViewShell* pVSh = 0;
-        sal_Bool bAskUpdate = nLinkMode == MANUAL;
-        sal_Bool bUpdate = sal_True;
-        switch(nUpdateDocMode)
-        {
-            case document::UpdateDocMode::NO_UPDATE:   bUpdate = sal_False;break;
-            case document::UpdateDocMode::QUIET_UPDATE:bAskUpdate = sal_False; break;
-            case document::UpdateDocMode::FULL_UPDATE: bAskUpdate = sal_True; break;
-        }
-        if( bUpdate && (bUI || !bAskUpdate) )
+    if ( GetDocShell()) {
+        sal_uInt16 nUpdateDocMode = GetDocShell()->GetUpdateDocMode();
+        if( (nLinkMode != NEVER ||  document::UpdateDocMode::FULL_UPDATE == nUpdateDocMode) &&
+            GetLinkManager().GetLinks().Count() &&
+            SFX_CREATE_MODE_INTERNAL !=
+                        ( eMode = GetDocShell()->GetCreateMode()) &&
+            SFX_CREATE_MODE_ORGANIZER != eMode &&
+            SFX_CREATE_MODE_PREVIEW != eMode &&
+            !GetDocShell()->IsPreview() )
         {
-            SfxMedium* pMedium = GetDocShell()->GetMedium();
-            SfxFrame* pFrm = pMedium ? pMedium->GetLoadTargetFrame() : 0;
-            Window* pDlgParent = pFrm ? &pFrm->GetWindow() : 0;
-            if( GetCurrentViewShell() && !GetEditShell( &pVSh ) && !pVSh )	//swmod 071108//swmod 071225
+            ViewShell* pVSh = 0;
+            sal_Bool bAskUpdate = nLinkMode == MANUAL;
+            sal_Bool bUpdate = sal_True;
+            switch(nUpdateDocMode)
             {
-                ViewShell aVSh( *this, 0, 0 );
+                case document::UpdateDocMode::NO_UPDATE:   bUpdate = sal_False;break;
+                case document::UpdateDocMode::QUIET_UPDATE:bAskUpdate = sal_False; break;
+                case document::UpdateDocMode::FULL_UPDATE: bAskUpdate = sal_True; break;
+            }
+            if( bUpdate && (bUI || !bAskUpdate) )
+            {
+                SfxMedium* pMedium = GetDocShell()->GetMedium();
+                SfxFrame* pFrm = pMedium ? pMedium->GetLoadTargetFrame() : 0;
+                Window* pDlgParent = pFrm ? &pFrm->GetWindow() : 0;
+                if( GetCurrentViewShell() && !GetEditShell( &pVSh ) && !pVSh )	//swmod 071108//swmod 071225
+                {
+                    ViewShell aVSh( *this, 0, 0 );
 
-                SET_CURR_SHELL( &aVSh );
-                GetLinkManager().UpdateAllLinks( bAskUpdate , sal_True, sal_False, pDlgParent );
+                    SET_CURR_SHELL( &aVSh );
+                    GetLinkManager().UpdateAllLinks( bAskUpdate , sal_True, sal_False, pDlgParent );
+                }
+                else
+                    GetLinkManager().UpdateAllLinks( bAskUpdate, sal_True, sal_False, pDlgParent );
             }
-            else
-                GetLinkManager().UpdateAllLinks( bAskUpdate, sal_True, sal_False, pDlgParent );
         }
     }
 
diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index 2f108cf..c2e2670 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -762,7 +762,7 @@ bool WW8ListManager::ReadLVL(SwNumFmt& rNumFmt, SfxItemSet*& rpItemSet,
     for(nLevelB = 0; nLevelB <= nLevel; ++nLevelB)
     {
         sal_uInt8 nPos = aOfsNumsXCH[nLevelB];
-        if (nPos && sNumString.GetChar(nPos-1) < nMaxLevel)
+        if (nPos && nPos < sNumString.Len()  && sNumString.GetChar(nPos-1) < nMaxLevel)
         {
             if (rNotReallyThere[nLevelB])
                 aOfsNumsXCH[nLevelB] = 0;
commit 408ffebd26be78170a602104d260ccb0a116b209
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 4 10:13:32 2011 +0100

    Related: #i115768# use cached data values instead of pointer to sprm cache
    
    use cached data value in case underlying sprm cache goes away
    
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>

diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index 2fb1cee..8a803db 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -245,13 +245,12 @@ struct WW8FlyPara
                                 // enthaltene Grafik anders als zeichengebunden
                                 // zu positionieren
     bool mbVertSet;             // true if vertical positioning has been set
-    sal_uInt8 nOrigSp29;
 
     WW8FlyPara(bool bIsVer67, const WW8FlyPara* pSrc = 0);
     bool operator==(const WW8FlyPara& rSrc) const;
-    void Read(const sal_uInt8* pSprm29, WW8PLCFx_Cp_FKP* pPap);
-    void ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo);
-    void Read(const sal_uInt8* pSprm29, WW8RStyle* pStyle);
+    void Read(sal_uInt8 nSprm29, WW8PLCFx_Cp_FKP* pPap);
+    void ReadFull(sal_uInt8 nSprm29, SwWW8ImplReader* pIo);
+    void Read(sal_uInt8 nSprm29, WW8RStyle* pStyle);
     void ApplyTabPos(const WW8_TablePos *pTabPos);
     bool IsEmpty() const;
 };
@@ -880,14 +879,15 @@ struct ApoTestResults
 {
     bool mbStartApo;
     bool mbStopApo;
-    const sal_uInt8* mpSprm37;
-    const sal_uInt8* mpSprm29;
+    bool m_bHasSprm37;
+    bool m_bHasSprm29;
+    sal_uInt8 m_nSprm29;
     WW8FlyPara* mpStyleApo;
-    ApoTestResults() :
-        mbStartApo(false), mbStopApo(false), mpSprm37(0), mpSprm29(0),
-        mpStyleApo(0) {}
+    ApoTestResults()
+        : mbStartApo(false), mbStopApo(false), m_bHasSprm37(false)
+        , m_bHasSprm29(false), m_nSprm29(0), mpStyleApo(0) {}
     bool HasStartStop() const { return (mbStartApo || mbStopApo); }
-    bool HasFrame() const { return (mpSprm29 || mpSprm37 || mpStyleApo); }
+    bool HasFrame() const { return (m_bHasSprm29 || m_bHasSprm37 || mpStyleApo); }
 };
 
 struct ANLDRuleMap
diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index 0ee1b97..0e0b46d 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -549,8 +549,10 @@ ApoTestResults SwWW8ImplReader::TestApo(int nCellLevel, bool bTableRowEnd,
     to see if we are still in that frame.
     */
 
-    aRet.mpSprm37 = pPlcxMan->HasParaSprm( bVer67 ? 37 : 0x2423 );
-    aRet.mpSprm29 = pPlcxMan->HasParaSprm( bVer67 ? 29 : 0x261B );
+    aRet.m_bHasSprm37 = pPlcxMan->HasParaSprm( bVer67 ? 37 : 0x2423 );
+    const sal_uInt8 *pSrpm29 = pPlcxMan->HasParaSprm( bVer67 ? 29 : 0x261B );
+    aRet.m_bHasSprm29 = pSrpm29 != NULL;
+    aRet.m_nSprm29 = pSrpm29 ? *pSrpm29 : 0;
 
     // Is there some frame data here
     bool bNowApo = aRet.HasFrame() || pTopLevelTable;
diff --git a/sw/source/filter/ww8/ww8par6.cxx b/sw/source/filter/ww8/ww8par6.cxx
index 01520a3..79ff1d5 100644
--- a/sw/source/filter/ww8/ww8par6.cxx
+++ b/sw/source/filter/ww8/ww8par6.cxx
@@ -1616,11 +1616,8 @@ bool WW8FlyPara::operator==(const WW8FlyPara& rSrc) const
 }
 
 // Read fuer normalen Text
-void WW8FlyPara::Read(const sal_uInt8* pSprm29, WW8PLCFx_Cp_FKP* pPap)
+void WW8FlyPara::Read(sal_uInt8 nOrigSp29, WW8PLCFx_Cp_FKP* pPap)
 {
-    if (pSprm29)
-        nOrigSp29 = *pSprm29;                           // PPC ( Bindung )
-
     const sal_uInt8* pS = 0;
     if( bVer67 )
     {
@@ -1671,12 +1668,12 @@ void WW8FlyPara::Read(const sal_uInt8* pSprm29, WW8PLCFx_Cp_FKP* pPap)
         nSp29 = nOrigSp29;
 }
 
-void WW8FlyPara::ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo)
+void WW8FlyPara::ReadFull(sal_uInt8 nOrigSp29, SwWW8ImplReader* pIo)
 {
     WW8PLCFMan* pPlcxMan = pIo->pPlcxMan;
     WW8PLCFx_Cp_FKP* pPap = pPlcxMan->GetPapPLCF();
 
-    Read(pSprm29, pPap);    // Lies Apo-Parameter
+    Read(nOrigSp29, pPap);    // Lies Apo-Parameter
 
     do{             // Block zum rausspringen
         if( nSp45 != 0 /* || nSp28 != 0 */ )
@@ -1722,7 +1719,7 @@ void WW8FlyPara::ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo)
 
             WW8FlyPara aF(bVer67, pNowStyleApo);
                                                 // Neuer FlaPara zum Vergleich
-            aF.Read( pS, pPap );                // WWPara fuer neuen Para
+            aF.Read( *pS, pPap );               // WWPara fuer neuen Para
             if( !( aF == *this ) )              // selber APO ? ( oder neuer ? )
                 bGrafApo = true;                // nein -> 1-zeiliger APO
                                                 //      -> Grafik-APO
@@ -1736,11 +1733,8 @@ void WW8FlyPara::ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo)
 
 
 // Read fuer Apo-Defs in Styledefs
-void WW8FlyPara::Read(const sal_uInt8* pSprm29, WW8RStyle* pStyle)
+void WW8FlyPara::Read(sal_uInt8 nOrigSp29, WW8RStyle* pStyle)
 {
-    if (pSprm29)
-        nOrigSp29 = *pSprm29;                           // PPC ( Bindung )
-
     const sal_uInt8* pS = 0;
     if (bVer67)
     {
@@ -2315,7 +2309,7 @@ WW8FlyPara *SwWW8ImplReader::ConstructApo(const ApoTestResults &rApo,
 
     // APO-Parameter ermitteln und Test auf bGrafApo
     if (rApo.HasFrame())
-        pRet->ReadFull(rApo.mpSprm29, this);
+        pRet->ReadFull(rApo.m_nSprm29, this);
 
     pRet->ApplyTabPos(pTabPos);
 
@@ -2592,7 +2586,7 @@ bool SwWW8ImplReader::TestSameApo(const ApoTestResults &rApo,
     WW8FlyPara aF(bVer67, rApo.mpStyleApo);
     // WWPara fuer akt. Para
     if (rApo.HasFrame())
-        aF.Read(rApo.mpSprm29, pPlcxMan->GetPapPLCF());
+        aF.Read(rApo.m_nSprm29, pPlcxMan->GetPapPLCF());
     aF.ApplyTabPos(pTabPos);
 
     return aF == *pWFlyPara;
@@ -4867,7 +4861,7 @@ void SwWW8ImplReader::Read_ApoPPC( sal_uInt16, const sal_uInt8* pData, short )
         SwWW8StyInf& rSI = vColl[nAktColl];
         WW8FlyPara* pFly = rSI.pWWFly ? rSI.pWWFly : new WW8FlyPara(bVer67);
         vColl[nAktColl].pWWFly = pFly;
-        pFly->Read(pData, pStyles);
+        pFly->Read(*pData, pStyles);
         if (pFly->IsEmpty())
             delete vColl[nAktColl].pWWFly, vColl[nAktColl].pWWFly = 0;
     }
commit a7df8e169565031d8587d9bde048b2f45279c6d8
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 4 10:37:54 2011 +0100

    Related: #i86988# make abo levels safer
    
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>

diff --git a/sw/qa/core/data/ww8/pass/CVE-2006-3493-1.doc b/sw/qa/core/data/ww8/pass/CVE-2006-3493-1.doc
new file mode 100644
index 0000000..af452dd
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2006-3493-1.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2006-6628-1.doc b/sw/qa/core/data/ww8/pass/CVE-2006-6628-1.doc
new file mode 100644
index 0000000..240ea77
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2006-6628-1.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2007-1347-1.doc b/sw/qa/core/data/ww8/pass/CVE-2007-1347-1.doc
new file mode 100644
index 0000000..d25e62a
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2007-1347-1.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2008-2752-1.doc b/sw/qa/core/data/ww8/pass/CVE-2008-2752-1.doc
new file mode 100644
index 0000000..f51fa8f
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2008-2752-1.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2008-2752-2.doc b/sw/qa/core/data/ww8/pass/CVE-2008-2752-2.doc
new file mode 100644
index 0000000..7ce7a07
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2008-2752-2.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2008-2752-3.doc b/sw/qa/core/data/ww8/pass/CVE-2008-2752-3.doc
new file mode 100644
index 0000000..8b04872
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2008-2752-3.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2008-2752-4.doc b/sw/qa/core/data/ww8/pass/CVE-2008-2752-4.doc
new file mode 100644
index 0000000..148a30d
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2008-2752-4.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2008-4841-1.doc b/sw/qa/core/data/ww8/pass/CVE-2008-4841-1.doc
new file mode 120000
index 0000000..f099938
--- /dev/null
+++ b/sw/qa/core/data/ww8/pass/CVE-2008-4841-1.doc
@@ -0,0 +1 @@
+CVE-2009-0259-1.doc
\ No newline at end of file
diff --git a/sw/qa/core/data/ww8/pass/CVE-2009-0259-1.doc b/sw/qa/core/data/ww8/pass/CVE-2009-0259-1.doc
new file mode 100644
index 0000000..0942b6d
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2009-0259-1.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2010-3200-1.doc b/sw/qa/core/data/ww8/pass/CVE-2010-3200-1.doc
new file mode 100644
index 0000000..596aec9
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2010-3200-1.doc differ
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 0ff27b1..880384b 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -5661,6 +5661,8 @@ bool SwWW8ImplReader::InEqualApo(int nLvl) const
     //the table.
     if (nLvl)
         --nLvl;
+    if (nLvl < 0 || static_cast<size_t>(nLvl) >= maApos.size())
+        return false;
     return maApos[nLvl];
 }
 
commit ab28696e17a913c0f4be5c7daebeb1f3fc4827d8
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jul 4 01:26:18 2011 +0100

    valgrind: init nTypeFace
    
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>

diff --git a/starmath/source/mathtype.hxx b/starmath/source/mathtype.hxx
index c29c665..6660b77 100644
--- a/starmath/source/mathtype.hxx
+++ b/starmath/source/mathtype.hxx
@@ -64,14 +64,16 @@ class MathType
 public:
     MathType(String &rIn) : 
         rRet(rIn), nHAlign(0), nVAlign(0), nDefaultSize(12),
-        nLSize(0), nDSize(0), nCurSize(0), nLastSize(0), bIsSilent(sal_False)
+        nLSize(0), nDSize(0), nCurSize(0), nLastSize(0), bIsSilent(sal_False),
+        nTypeFace(0)
     {
         Init();
     }
 
     MathType(String &rIn,SmNode *pIn) : 
         rRet(rIn), pTree(pIn), nHAlign(2), nVAlign(0), nInsertion(0), nDefaultSize(12),
-        nLSize(0), nDSize(0), nCurSize(0), nLastSize(0), nSpec(0), bIsSilent(sal_False)
+        nLSize(0), nDSize(0), nCurSize(0), nLastSize(0), nSpec(0), bIsSilent(sal_False),
+        nTypeFace(0)
     {
         Init();
     }
commit 4f7ce10128216e93ef8953fa396be6dca23eb335
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jun 20 23:43:32 2011 +0100

    Resolves: #i105349# protect against missing insertion position
    
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>

diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index bbc99af..2f108cf 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -1780,10 +1780,12 @@ void SwWW8ImplReader::RegisterNumFmtOnTxtNode(sal_uInt16 nActLFO,
 
     if (pLstManager) // sind die Listendeklarationen gelesen?
     {
-        std::vector<sal_uInt8> aParaSprms;
         SwTxtNode* pTxtNd = pPaM->GetNode()->GetTxtNode();
-        OSL_ENSURE(pTxtNd, "Kein Text-Node an PaM-Position");
+        OSL_ENSURE(pTxtNd, "No Text-Node at PaM-Position");
+        if (!pTxtNd)
+            return;
 
+        std::vector<sal_uInt8> aParaSprms;
         const SwNumRule* pRule = bSetAttr ?
             pLstManager->GetNumRuleForActivation( nActLFO, nActLevel,
                 aParaSprms, pTxtNd) : 0;
commit cf65ab392673024f34eedb27f6002b6da86504c3
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jun 23 12:45:44 2011 +0100

    Resolves: #i95550# handle wrong text len gracefully
    
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 163b078..0ff27b1 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -2627,9 +2627,6 @@ bool SwWW8ImplReader::ReadPlainChars(WW8_CP& rPos, long nEnd, long nCpOfs)
     // Unicode-Flag neu setzen und notfalls File-Pos korrigieren
     // merke: Seek kostet nicht viel, da inline geprueft wird,
     //        ob die korrekte FilePos nicht schon erreicht ist.
-    WW8_FC nStreamPos = pSBase->WW8Cp2Fc(nCpOfs+rPos, &bIsUnicode);
-    pStrm->Seek( nStreamPos );
-
     xub_StrLen nLen;
     if (nEnd - rPos <= (STRING_MAXLEN-1))
         nLen = writer_cast<xub_StrLen>(nEnd - rPos);
@@ -2639,6 +2636,16 @@ bool SwWW8ImplReader::ReadPlainChars(WW8_CP& rPos, long nEnd, long nCpOfs)
     if (!nLen)
         return true;
 
+    sal_Size nRequestedPos = pSBase->WW8Cp2Fc(nCpOfs+rPos, &bIsUnicode);
+    sal_Size nSeekedPos = pStrm->Seek(nRequestedPos);
+    OSL_ENSURE(nRequestedPos == nSeekedPos, "Document claimed to have more text than available");
+    if (nRequestedPos != nSeekedPos)
+    {
+        //Swallow missing range, e.g. #i95550#
+        rPos+=nLen;
+        return true;
+    }
+
     const CharSet eSrcCharSet = bVer67 ? GetCurrentCharSet() :
         RTL_TEXTENCODING_MS_1252;
     const CharSet eSrcCJKCharSet = bVer67 ? GetCurrentCJKCharSet() :
commit 410105ca3c9ec448e162d66a072ffd2b2b42424f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Jun 18 00:39:59 2011 +0100

    handle truncated stream
    
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index ce86fd2..163b078 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -5358,7 +5358,7 @@ sal_uLong SwWW8ImplReader::LoadDoc( SwPaM& rPaM,WW8Glossary *pGloss)
         m_bRegardHindiDigits = aVal[ 12 ] > 0;
     }
 
-    sal_uInt16 nMagic;
+    sal_uInt16 nMagic(0);
     *pStrm >> nMagic;
 
     // beachte: 6 steht fuer "6 ODER 7",  7 steht fuer "NUR 7"
commit 0e34784737d4f654aba92932680c521a9430f63f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jun 17 23:48:50 2011 +0100

    merge these sprm finders and do it right
    
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>

diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index bda689b..0ee1b97 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -3699,21 +3699,7 @@ const sal_uInt8* WW8RStyle::HasParaSprm( sal_uInt16 nId ) const
     if( !pParaSprms || !nSprmsLen )
         return 0;
 
-    const sal_uInt8* pSprms = pParaSprms;
-    sal_uInt16 i, x;
-
-    for( i=0; i < nSprmsLen; )
-    {
-        sal_uInt16 nAktId = maSprmParser.GetSprmId(pSprms);
-        // Sprm found ?
-        if( nAktId == nId )
-            return pSprms + maSprmParser.DistanceToData(nId);
-
-        x = maSprmParser.GetSprmSize(nAktId, pSprms);
-        i = i + x;
-        pSprms += x;
-    }
-    return 0;                               // Sprm not found
+    return maSprmParser.findSprmData(nId, pParaSprms, nSprmsLen);
 }
 
 void WW8RStyle::ImportSprms(sal_uInt8 *pSprms, short nLen, bool bPap)
diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index c1062da..bbc99af 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -470,20 +470,7 @@ SV_IMPL_PTRARR( WW8LFOInfos, WW8LFOInfo_Ptr );
 sal_uInt8* WW8ListManager::GrpprlHasSprm(sal_uInt16 nId, sal_uInt8& rSprms,
     sal_uInt8 nLen)
 {
-    sal_uInt8* pSprms = &rSprms;
-    sal_uInt16 nRemLen=nLen;
-    while (nRemLen > (maSprmParser.getVersion()?1:0))
-    {
-        sal_uInt16 nAktId = maSprmParser.GetSprmId(pSprms);
-        if( nAktId == nId ) // Sprm found
-            return pSprms + maSprmParser.DistanceToData(nId);
-
-        // gib Zeiger auf Daten
-        sal_uInt16 nSize = maSprmParser.GetSprmSize(nAktId, pSprms);
-        pSprms += nSize;
-        nRemLen -= nSize;
-    }
-    return 0;                           // Sprm not found
+    return maSprmParser.findSprmData(nId, &rSprms, nLen);
 }
 
 class ListWithId : public std::unary_function<const WW8LSTInfo *, bool>
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index dbb8d2c..3db9bf6 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -7280,6 +7280,27 @@ sal_uInt16 wwSprmParser::DistanceToData(sal_uInt16 nId) const
     return 1 + mnDelta + SprmDataOfs(nId);
 }
 
+sal_uInt8* wwSprmParser::findSprmData(sal_uInt16 nId, sal_uInt8* pSprms,
+    sal_uInt16 nLen) const
+{
+    while (nLen > (getVersion()?1:0))
+    {
+        sal_uInt16 nAktId = GetSprmId(pSprms);
+        if (nAktId == nId) // Sprm found
+            return pSprms + DistanceToData(nId);
+
+        // gib Zeiger auf Daten
+        sal_uInt16 nSize = GetSprmSize(nAktId, pSprms);
+        OSL_ENSURE(nSize <= nLen, "sprm longer than remaining bytes");
+        //Clip to available size if wrong
+        nSize = std::min(nSize, nLen);
+        pSprms += nSize;
+        nLen -= nSize;
+    }
+    // Sprm not found
+    return 0;
+}
+
 SEPr::SEPr() :
     bkc(2), fTitlePage(0), fAutoPgn(0), nfcPgn(0), fUnlocked(0), cnsPgn(0),
     fPgnRestart(0), fEndNote(1), lnc(0), grpfIhdt(0), nLnnMod(0), dxaLnn(0),
diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx
index 0bb532a..7d809d8 100644
--- a/sw/source/filter/ww8/ww8scan.hxx
+++ b/sw/source/filter/ww8/ww8scan.hxx
@@ -145,6 +145,11 @@ public:
     /// The minimum acceptable sprm len possible for this type of parser
     int MinSprmLen() const { return (IsSevenMinus(meVersion)) ? 2 : 3; }
 
+    /// Returns the offset to data of the first sprm of id nId, 0
+    //  if not found. nLen must be the <= length of pSprms
+    sal_uInt8* findSprmData(sal_uInt16 nId, sal_uInt8* pSprms, sal_uInt16 nLen)
+        const;
+
     inline int getVersion() const { return meVersion; } //cmc, I'm dubious about the usage of this, how can it be 0
 };
 
commit deba57d90339fa6083a54495aa410872ffa5e15e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Jul 2 21:34:14 2011 +0100

    Resolves: fdo#34023 hang on load of .doc
    
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>

diff --git a/sw/source/filter/ww8/ww8toolbar.cxx b/sw/source/filter/ww8/ww8toolbar.cxx
index 0f4a644..20bfcf3 100644
--- a/sw/source/filter/ww8/ww8toolbar.cxx
+++ b/sw/source/filter/ww8/ww8toolbar.cxx
@@ -906,12 +906,13 @@ bool Tcg255::Read(SvStream *pS)
 {
     OSL_TRACE("Tcg255::Read() stream pos 0x%x", pS->Tell() );
     nOffSet = pS->Tell();
-    sal_uInt8 nId = 0; //
+    sal_uInt8 nId = 0x40;
     *pS >> nId;
     while (  nId != 0x40  )
     {
         if ( !processSubStruct( nId, pS ) )
             return false;
+        nId = 0x40;
         *pS >> nId;
     }
     return true;
@@ -948,9 +949,10 @@ bool Tcg255SubStruct::Read(SvStream *pS)
     return true;
 }
 
-PlfMcd::PlfMcd( bool bReadId ): Tcg255SubStruct( bReadId ), rgmcd( NULL )
+PlfMcd::PlfMcd( bool bReadId ): Tcg255SubStruct( bReadId ), iMac(0), rgmcd( NULL )
 {
 }
+
 PlfMcd::~PlfMcd()
 {
     if ( rgmcd )
commit b00c51c9fb1a69431248e3bfa3d8e9265e69a83c
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Jul 2 01:55:56 2011 +0100

    Related: fdo#37057 use standard sprm iterator
    
    Signed-off-by: Michael Meeks <michael.meeks at novell.com>

diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index 4ab1be3..bda689b 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -3727,11 +3727,11 @@ void WW8RStyle::ImportSprms(sal_uInt8 *pSprms, short nLen, bool bPap)
         nSprmsLen = nLen;
     }
 
-    while ( nLen > 0 )
+    WW8SprmIter aSprmIter(pSprms, nLen, maSprmParser);
+    while (const sal_uInt8* pSprm = aSprmIter.GetSprms())
     {
-        sal_uInt16 nL1 = pIo->ImportSprm(pSprms);
-        nLen = nLen - nL1;
-        pSprms += nL1;
+        pIo->ImportSprm(pSprm);
+        aSprmIter.advance();
     }
 
     pParaSprms = 0;
commit c703b311c907b4c97850b5c81ae6a9d3ef47954c
Author: Petr Mladek <pmladek at suse.cz>
Date:   Fri Jul 8 10:46:57 2011 +0200

    More conservative fix for aliasing problems (fdo#33781)
    
    Inspired by i#99665. It solves the problem where the aliasing caused
    problems. It modifies the current aliasing using "byte or" (operator |)
     and restores the original aliasing at the end of the "if" block.
    
    Signed-off-by: Roland Baudin <roland65 at free.fr>

diff --git a/sw/source/core/doc/notxtfrm.cxx b/sw/source/core/doc/notxtfrm.cxx
index 580000d..15708c7 100644
--- a/sw/source/core/doc/notxtfrm.cxx
+++ b/sw/source/core/doc/notxtfrm.cxx
@@ -819,9 +819,10 @@ void SwNoTxtFrm::PaintPicture( OutputDevice* pOut, const SwRect &rGrfArea ) cons
     if( pGrfNd )
     {
         // Fix for bug fdo#33781
+        const sal_uInt16 nFormerAntialiasingAtOutput( pOut->GetAntialiasing() );
         if (pShell->Imp()->GetDrawView()->IsAntiAliasing())
         {
-            pOut->SetAntialiasing( ANTIALIASING_ENABLE_B2DDRAW );
+            pOut->SetAntialiasing( nFormerAntialiasingAtOutput | ANTIALIASING_ENABLE_B2DDRAW );
         }
 
         sal_Bool bForceSwap = sal_False, bContinue = sal_True;
@@ -938,8 +939,12 @@ void SwNoTxtFrm::PaintPicture( OutputDevice* pOut, const SwRect &rGrfArea ) cons
             if( bSwapped && bPrn )
                 bForceSwap = sal_True;
         }
+
         if( bForceSwap )
             pGrfNd->SwapOut();
+
+        if ( pShell->Imp()->GetDrawView()->IsAntiAliasing() )
+            pOut->SetAntialiasing( nFormerAntialiasingAtOutput );
     }
     else if( bIsChart
         //charts must be painted resolution dependent!! #i82893#, #i75867#
@@ -953,20 +958,17 @@ void SwNoTxtFrm::PaintPicture( OutputDevice* pOut, const SwRect &rGrfArea ) cons
     else if( pOLENd )
     {
         // Fix for bug fdo#33781
+        const sal_uInt16 nFormerAntialiasingAtOutput( pOut->GetAntialiasing() );
         if (pShell->Imp()->GetDrawView()->IsAntiAliasing())
         {
-            pOut->SetAntialiasing( ANTIALIASING_ENABLE_B2DDRAW );
-        }
+            sal_uInt16 nNewAntialiasingAtOutput = nFormerAntialiasingAtOutput | ANTIALIASING_ENABLE_B2DDRAW;
 
-        // #i99665#
-        // Adjust AntiAliasing mode at output device for chart OLE
-        const sal_uInt16 nFormerAntialiasingAtOutput( pOut->GetAntialiasing() );
-        if ( pOLENd->IsChart() &&
-             pShell->Imp()->GetDrawView()->IsAntiAliasing() )
-        {
-            const sal_uInt16 nAntialiasingForChartOLE =
-                    nFormerAntialiasingAtOutput | ANTIALIASING_PIXELSNAPHAIRLINE;
-            pOut->SetAntialiasing( nAntialiasingForChartOLE );
+            // #i99665#
+            // Adjust AntiAliasing mode at output device for chart OLE
+            if ( pOLENd->IsChart() )
+                nNewAntialiasingAtOutput |= ANTIALIASING_PIXELSNAPHAIRLINE;
+
+            pOut->SetAntialiasing( nNewAntialiasingAtOutput );
         }
         // <--
 
@@ -1012,13 +1014,8 @@ void SwNoTxtFrm::PaintPicture( OutputDevice* pOut, const SwRect &rGrfArea ) cons
             ((SwFEShell*)pShell)->ConnectObj( pOLENd->GetOLEObj().GetObject(), pFly->Prt(), pFly->Frm());
         }
 
-        // #i99665#
-        if ( pOLENd->IsChart() &&
-             pShell->Imp()->GetDrawView()->IsAntiAliasing() )
-        {
+        if ( pShell->Imp()->GetDrawView()->IsAntiAliasing() )
             pOut->SetAntialiasing( nFormerAntialiasingAtOutput );
-        }
-        // <--
     }
 }
 
commit 262261c39dc68ba7fb8d846fb3dacfa6b4fc98ba
Author: Roland Baudin <roland65 at free.fr>
Date:   Fri Jun 17 19:39:55 2011 +0000

    Additional fix for bug fdo#33781
    
    Signed-off-by: Petr Mladek <pmladek at suse.cz>

diff --git a/sw/source/core/doc/notxtfrm.cxx b/sw/source/core/doc/notxtfrm.cxx
index a5e4f2f..580000d 100644
--- a/sw/source/core/doc/notxtfrm.cxx
+++ b/sw/source/core/doc/notxtfrm.cxx
@@ -952,6 +952,12 @@ void SwNoTxtFrm::PaintPicture( OutputDevice* pOut, const SwRect &rGrfArea ) cons
     }
     else if( pOLENd )
     {
+        // Fix for bug fdo#33781
+        if (pShell->Imp()->GetDrawView()->IsAntiAliasing())
+        {
+            pOut->SetAntialiasing( ANTIALIASING_ENABLE_B2DDRAW );
+        }
+
         // #i99665#
         // Adjust AntiAliasing mode at output device for chart OLE
         const sal_uInt16 nFormerAntialiasingAtOutput( pOut->GetAntialiasing() );
commit b904df34c21c1b24a5b6942d608c8a1cc8dc82df
Author: Jan Holesovsky <kendy at suse.cz>
Date:   Fri Jul 1 16:35:39 2011 +0200

    Copy fieldmark properties when copying/pasting, fdo#38374.

diff --git a/sw/source/core/docnode/ndcopy.cxx b/sw/source/core/docnode/ndcopy.cxx
index acdb9a9..0176ada 100644
--- a/sw/source/core/docnode/ndcopy.cxx
+++ b/sw/source/core/docnode/ndcopy.cxx
@@ -186,14 +186,25 @@ namespace
             // Explicitly try to get exactly the same name as in the source
             // because NavigatorReminders, DdeBookmarks etc. ignore the proposed name
             pDestDoc->getIDocumentMarkAccess()->renameMark(pNewMark, pMark->GetName());
+
+            // copying additional attributes for bookmarks or fieldmarks
             ::sw::mark::IBookmark* const pNewBookmark =
                 dynamic_cast< ::sw::mark::IBookmark* const >(pNewMark);
-            if(pNewBookmark) /* copying additional attributes for bookmarks */
+            if(pNewBookmark)
             {
                 const ::sw::mark::IBookmark* const pOldBookmark = dynamic_cast< const ::sw::mark::IBookmark* >(pMark);
                 pNewBookmark->SetKeyCode(pOldBookmark->GetKeyCode());
                 pNewBookmark->SetShortName(pOldBookmark->GetShortName());
             }
+            ::sw::mark::IFieldmark* const pNewFieldmark =
+                dynamic_cast< ::sw::mark::IFieldmark* const >(pNewMark);
+            if(pNewFieldmark)
+            {
+                const ::sw::mark::IFieldmark* const pOldFieldmark = dynamic_cast< const ::sw::mark::IFieldmark* >(pMark);
+                pNewFieldmark->SetFieldname(pOldFieldmark->GetFieldname());
+                pNewFieldmark->SetFieldHelptext(pOldFieldmark->GetFieldHelptext());
+            }
+
             ::sfx2::Metadatable const*const pMetadatable(
                     dynamic_cast< ::sfx2::Metadatable const* >(pMark));
             ::sfx2::Metadatable      *const pNewMetadatable(
commit 6010e8f26a962c2812a8f85886a6bf1559fdae0b
Author: Jan Holesovsky <kendy at suse.cz>
Date:   Fri Jul 1 10:04:37 2011 +0200

    Fix the computation of grid character pitch, fdo#37516.

diff --git a/sw/source/filter/ww8/attributeoutputbase.hxx b/sw/source/filter/ww8/attributeoutputbase.hxx
index 25fc965..84e58f7 100644
--- a/sw/source/filter/ww8/attributeoutputbase.hxx
+++ b/sw/source/filter/ww8/attributeoutputbase.hxx
@@ -539,6 +539,9 @@ protected:
     /// Sfx item RES_KEEP
     virtual void FormatKeep( const SvxFmtKeepItem& ) = 0;
 
+    /// Compute the grid character pitch
+    sal_uInt32 GridCharacterPitch( const SwTextGridItem& rGrid ) const;
+
     /// Sfx item RES_TEXTGRID
     virtual void FormatTextGrid( const SwTextGridItem& ) = 0;
 
diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx b/sw/source/filter/ww8/docxattributeoutput.cxx
index 9fd3150..693549c 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -4041,23 +4041,8 @@ void DocxAttributeOutput::FormatTextGrid( const SwTextGridItem& rGrid )
     pGridAttrList->add( FSNS( XML_w, XML_linePitch ),
             OString::valueOf( sal_Int32( nHeight ) ).getStr( ) );
 
-    MSWordStyles * pStyles = m_rExport.pStyles;
-    SwFmt * pSwFmt = pStyles->GetSwFmt();
-
-    sal_uInt32 nPageCharSize = 0;
-
-    if (pSwFmt != NULL)
-    {
-        nPageCharSize = ItemGet<SvxFontHeightItem>
-        (*pSwFmt, RES_CHRATR_FONTSIZE).GetHeight();
-    }
-
-    sal_uInt16 nPitch = rGrid.IsSquaredMode() ? rGrid.GetBaseHeight() :
-        rGrid.GetBaseWidth( );
-    sal_Int32 nCharSpace = ( nPitch - nPageCharSize ) * 4096 / 20;
-
     pGridAttrList->add( FSNS( XML_w, XML_charSpace ),
-            OString::valueOf( sal_Int32( nCharSpace ) ).getStr( ) );
+            OString::valueOf( sal_Int32( GridCharacterPitch( rGrid ) ) ).getStr( ) );
 
     m_pSerializer->singleElementNS( XML_w, XML_docGrid, pGridAttrList );
 }
diff --git a/sw/source/filter/ww8/ww8atr.cxx b/sw/source/filter/ww8/ww8atr.cxx
index 63ee393..6e61641 100644
--- a/sw/source/filter/ww8/ww8atr.cxx
+++ b/sw/source/filter/ww8/ww8atr.cxx
@@ -3641,6 +3641,37 @@ void WW8AttributeOutput::SectionBreak( sal_uInt8 nC, const WW8_SepInfo* /*pSecti
     m_rWW8Export.ReplaceCr( nC );
 }
 
+sal_uInt32 AttributeOutputBase::GridCharacterPitch( const SwTextGridItem& rGrid ) const
+{
+    MSWordStyles * pStyles = GetExport().pStyles;
+    SwFmt * pSwFmt = pStyles->GetSwFmt();
+
+    sal_uInt32 nPageCharSize = 0;
+
+    if (pSwFmt != NULL)
+    {
+        nPageCharSize = ItemGet<SvxFontHeightItem>
+            (*pSwFmt, RES_CHRATR_FONTSIZE).GetHeight();
+    }
+    sal_uInt16 nPitch = rGrid.IsSquaredMode() ? rGrid.GetBaseHeight() :
+        rGrid.GetBaseWidth( );
+
+    sal_Int32 nCharWidth = nPitch - nPageCharSize;
+    sal_Int32 nFraction = nCharWidth % 20;
+    if ( nCharWidth < 0 )
+        nFraction = 20 + nFraction;
+    nFraction = ( nFraction * 0xFFF ) / 20;
+    nFraction = ( nFraction & 0x00000FFF );
+
+    sal_Int32 nMain = nCharWidth / 20;
+    if ( nCharWidth < 0 )
+        nMain -= 1;
+    nMain = nMain * 0x1000;
+    nMain = ( nMain & 0xFFFFF000 );
+
+    return sal_uInt32( nFraction + nMain );
+}
+
 void WW8AttributeOutput::FormatTextGrid( const SwTextGridItem& rGrid )
 {
     if ( m_rWW8Export.bOutPageDescs && m_rWW8Export.bWrtWW8 )
@@ -3670,22 +3701,8 @@ void WW8AttributeOutput::FormatTextGrid( const SwTextGridItem& rGrid )
         m_rWW8Export.InsUInt16( NS_sprm::LN_SDyaLinePitch );
         m_rWW8Export.InsUInt16( nHeight );
 
-        MSWordStyles * pStyles = m_rWW8Export.pStyles;
-        SwFmt * pSwFmt = pStyles->GetSwFmt();
-
-        sal_uInt32 nPageCharSize = 0;
-
-        if (pSwFmt != NULL)
-        {
-            nPageCharSize = ItemGet<SvxFontHeightItem>
-            (*pSwFmt, RES_CHRATR_FONTSIZE).GetHeight();
-        }
-        sal_uInt16 nPitch = rGrid.IsSquaredMode() ? rGrid.GetBaseHeight() :
-            rGrid.GetBaseWidth( );
-        sal_Int32 nCharSpace = ( nPitch - nPageCharSize ) * 4096 / 20;
-
         m_rWW8Export.InsUInt16( NS_sprm::LN_SDxtCharSpace );
-        m_rWW8Export.InsUInt32( nCharSpace );
+        m_rWW8Export.InsUInt32( GridCharacterPitch( rGrid ) );
     }
 }
 
commit ce50a165755bf80921cb461395890f89e9a22e37
Author: Luboš Luňák <l.lunak at suse.cz>
Date:   Mon Jun 27 11:57:46 2011 +0200

    avoid infinite loop when writting out docs with bookmarks (bnc#700370)
    
    The next position is either next attribute or next bookmark, whichever
    comes first.
    ACK by Cedric.

diff --git a/sw/source/filter/ww8/wrtw8nds.cxx b/sw/source/filter/ww8/wrtw8nds.cxx
index ca502d4..02659bf 100644
--- a/sw/source/filter/ww8/wrtw8nds.cxx
+++ b/sw/source/filter/ww8/wrtw8nds.cxx
@@ -1622,7 +1622,7 @@ xub_StrLen MSWordExportBase::GetNextPos( SwWW8AttrIter* aAttrIter, const SwTxtNo
     xub_StrLen nNextPos = aAttrIter->WhereNext();
     xub_StrLen nNextBookmark = nNextPos;
 
-    if( nNextBookmark > nAktPos )//no need to search for bookmarks otherwise
+    if( nNextBookmark > nAktPos ) //no need to search for bookmarks otherwise (checked in UpdatePosition())
     {
         GetSortedBookmarks( rNode, nAktPos, nNextBookmark - nAktPos );
         NearestBookmark( nNextBookmark, nAktPos, false );
@@ -1634,9 +1634,9 @@ void MSWordExportBase::UpdatePosition( SwWW8AttrIter* aAttrIter, xub_StrLen nAkt
 {
     xub_StrLen nNextPos;
 
-    // go to next attribute if no bookmark is found and if the next attribute position if at the current position
+    // go to next attribute if no bookmark is found or if the bookmark is behind the next attribute position
     bool bNextBookmark = NearestBookmark( nNextPos, nAktPos, true );
-    if( !bNextBookmark && nAktPos >= aAttrIter->WhereNext() )
+    if( !bNextBookmark || nNextPos > aAttrIter->WhereNext() )
         aAttrIter->NextPos();
 }
 
commit 39d4ce1b676e659e8de0e0752516d22aa5777953
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jun 24 14:22:22 2011 +0100

    Resolves: fdo#38623 imported .doc crashes layout
    
    Signed-off-by: Jan Holesovsky <kendy at suse.cz>

diff --git a/sw/source/core/layout/ftnfrm.cxx b/sw/source/core/layout/ftnfrm.cxx
index ce57fec..a8e1b46 100644
--- a/sw/source/core/layout/ftnfrm.cxx
+++ b/sw/source/core/layout/ftnfrm.cxx
@@ -2701,7 +2701,7 @@ void SwPageFrm::UpdateFtnNum()
                             SwPageFrm* pPage = pTmpBoss->FindPageFrm();
                             pFtn = NULL;
                             lcl_NextFtnBoss( pTmpBoss, pPage, sal_False );
-                            SwFtnContFrm *pCont = pTmpBoss->FindNearestFtnCont();
+                            SwFtnContFrm *pCont = pTmpBoss ? pTmpBoss->FindNearestFtnCont() : NULL;
                             if ( pCont )
                                 pFtn = (SwFtnFrm*)pCont->Lower();
                         }
commit 87d003eb1e16a84e0bb478cb4ffc20ba9c2b2182
Author: Marc-André Laverdière <marc-andre at atc.tcs.com>
Date:   Tue Jun 21 12:16:57 2011 +0100

    switch to using a vector for styles, and add many range checks
    (cherry picked from commit 28a56883c2887c44d8892d80bf0ee90ebdc58b48)
    
    Signed-off-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index f1f2745..ce86fd2 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -958,9 +958,9 @@ void SwWW8ImplReader::Read_StyleCode( sal_uInt16, const sal_uInt8* pData, short
         nColl = *pData;
     else
         nColl = SVBT16ToShort(pData);
-    if (nColl < nColls)
+    if (nColl < vColl.size())
     {
-        SetTxtFmtCollAndListLevel( *pPaM, pCollA[nColl] );
+        SetTxtFmtCollAndListLevel( *pPaM, vColl[nColl] );
         bCpxStyle = true;
     }
 }
@@ -1210,8 +1210,8 @@ const SfxPoolItem* SwWW8FltControlStack::GetFmtAttr(const SwPosition& rPos,
                 SfxItemState eState = SFX_ITEM_DEFAULT;
                 if (const SfxItemSet *pSet = pNd->GetpSwAttrSet())
                     eState = pSet->GetItemState(RES_LR_SPACE, false);
-                if (eState != SFX_ITEM_SET && rReader.pCollA != NULL)
-                    pItem = &(rReader.pCollA[rReader.nAktColl].maWordLR);
+                if (eState != SFX_ITEM_SET && !rReader.vColl.empty() && rReader.nAktColl < rReader.vColl.size())
+                    pItem = &(rReader.vColl[rReader.nAktColl].maWordLR);
             }
 
             /*
@@ -1371,16 +1371,18 @@ void SwWW8ImplReader::Read_Tab(sal_uInt16 , const sal_uInt8* pData, short nLen)
 
     const SwTxtFmtColl* pSty = 0;
     sal_uInt16 nTabBase;
-    if (pAktColl)               // StyleDef
+    if (pAktColl && nAktColl < vColl.size())               // StyleDef
     {
-        nTabBase = pCollA[nAktColl].nBase;
-        if (nTabBase < nColls)              // Based On
-            pSty = (const SwTxtFmtColl*)pCollA[nTabBase].pFmt;
+        nTabBase = vColl[nAktColl].nBase;
+        if (nTabBase < vColl.size())              // Based On
+            pSty = (const SwTxtFmtColl*)vColl[nTabBase].pFmt;
     }
     else
     {                                       // Text
         nTabBase = nAktColl;
-        pSty = (const SwTxtFmtColl*)pCollA[nAktColl].pFmt;
+        if (nAktColl < vColl.size())
+            pSty = (const SwTxtFmtColl*)vColl[nAktColl].pFmt;
+        //TODO figure else here
     }
 
     bool bFound = false;
@@ -1397,11 +1399,11 @@ void SwWW8ImplReader::Read_Tab(sal_uInt16 , const sal_uInt8* pData, short nLen)
 
             sal_uInt16 nOldTabBase = nTabBase;
             // If based on another
-            if (nTabBase < nColls)
-                nTabBase = pCollA[nTabBase].nBase;
+            if (nTabBase < vColl.size())
+                nTabBase = vColl[nTabBase].nBase;
 
             if (
-                    nTabBase < nColls &&
+                    nTabBase < vColl.size() &&
                     nOldTabBase != nTabBase &&
                     nTabBase != ww::stiNil
                )
@@ -1409,7 +1411,9 @@ void SwWW8ImplReader::Read_Tab(sal_uInt16 , const sal_uInt8* pData, short nLen)
                 // #i61789: Stop searching when next style is the same as the
                 // current one (prevent loop)
                 aLoopWatch.insert(reinterpret_cast<size_t>(pSty));
-                pSty = (const SwTxtFmtColl*)pCollA[nTabBase].pFmt;
+                if (nTabBase < vColl.size())
+                   pSty = (const SwTxtFmtColl*)vColl[nTabBase].pFmt;
+                //TODO figure out the else branch
 
                 if (aLoopWatch.find(reinterpret_cast<size_t>(pSty)) !=
                     aLoopWatch.end())
@@ -2393,10 +2397,10 @@ CharSet SwWW8ImplReader::GetCurrentCharSet()
     {
         if (!maFontSrcCharSets.empty())
             eSrcCharSet = maFontSrcCharSets.top();
-        if ((eSrcCharSet == RTL_TEXTENCODING_DONTKNOW) && (nCharFmt != -1))
-            eSrcCharSet = pCollA[nCharFmt].GetCharSet();
-        if ((eSrcCharSet == RTL_TEXTENCODING_DONTKNOW) && StyleExists(nAktColl))
-            eSrcCharSet = pCollA[nAktColl].GetCharSet();
+        if ((eSrcCharSet == RTL_TEXTENCODING_DONTKNOW) && (nCharFmt != -1) && nCharFmt >= 0 && (size_t)nCharFmt < vColl.size() )
+            eSrcCharSet = vColl[nCharFmt].GetCharSet();
+        if ((eSrcCharSet == RTL_TEXTENCODING_DONTKNOW) && StyleExists(nAktColl) && nAktColl < vColl.size())
+            eSrcCharSet = vColl[nAktColl].GetCharSet();
         if (eSrcCharSet == RTL_TEXTENCODING_DONTKNOW)
         { // patch from cmc for #i52786#
             /*
@@ -2453,12 +2457,12 @@ CharSet SwWW8ImplReader::GetCurrentCJKCharSet()
     {
         if (!maFontSrcCJKCharSets.empty())
             eSrcCharSet = maFontSrcCJKCharSets.top();
-        if (pCollA != NULL)
+        if (!vColl.empty())
         {
-            if ((eSrcCharSet == RTL_TEXTENCODING_DONTKNOW) && (nCharFmt != -1))
-                eSrcCharSet = pCollA[nCharFmt].GetCJKCharSet();
-            if (eSrcCharSet == RTL_TEXTENCODING_DONTKNOW)
-                eSrcCharSet = pCollA[nAktColl].GetCJKCharSet();
+            if ((eSrcCharSet == RTL_TEXTENCODING_DONTKNOW) && (nCharFmt != -1) && nCharFmt >= 0 && (size_t)nCharFmt < vColl.size() )
+                eSrcCharSet = vColl[nCharFmt].GetCJKCharSet();
+            if (eSrcCharSet == RTL_TEXTENCODING_DONTKNOW && nAktColl < vColl.size())
+                eSrcCharSet = vColl[nAktColl].GetCJKCharSet();
         }
         if (eSrcCharSet == RTL_TEXTENCODING_DONTKNOW)
         { // patch from cmc for #i52786#
@@ -3179,7 +3183,7 @@ void SwWW8ImplReader::ProcessAktCollChange(WW8PLCFManResult& rRes,
     nAktColl = pPlcxMan->GetColl();
 
     // Invalid Style-Id
-    if (nAktColl >= nColls || !pCollA[nAktColl].pFmt || !pCollA[nAktColl].bColl)
+    if (nAktColl >= vColl.size() || !vColl[nAktColl].pFmt || !vColl[nAktColl].bColl)
     {
         nAktColl = 0;
         bParaAutoBefore = false;
@@ -3187,10 +3191,13 @@ void SwWW8ImplReader::ProcessAktCollChange(WW8PLCFManResult& rRes,
     }
     else
     {
-        bParaAutoBefore = pCollA[nAktColl].bParaAutoBefore;
-        bParaAutoAfter = pCollA[nAktColl].bParaAutoAfter;
+        bParaAutoBefore = vColl[nAktColl].bParaAutoBefore;
+        bParaAutoAfter = vColl[nAktColl].bParaAutoAfter;
     }
 
+    if (nOldColl >= vColl.size())
+        nOldColl = 0; //guess! TODO make sure this is what we want
+
     bool bTabRowEnd = false;
     if( pStartAttr && bCallProcessSpecial && !bInHyperlink )
     {
@@ -3203,10 +3210,10 @@ void SwWW8ImplReader::ProcessAktCollChange(WW8PLCFManResult& rRes,
 
     if (!bTabRowEnd && StyleExists(nAktColl))
     {
-        SetTxtFmtCollAndListLevel( *pPaM, pCollA[ nAktColl ]);
-        ChkToggleAttr(pCollA[ nOldColl ].n81Flags, pCollA[ nAktColl ].n81Flags);
-        ChkToggleBiDiAttr(pCollA[nOldColl].n81BiDiFlags,
-            pCollA[nAktColl].n81BiDiFlags);
+        SetTxtFmtCollAndListLevel( *pPaM, vColl[ nAktColl ]);
+        ChkToggleAttr(vColl[ nOldColl ].n81Flags, vColl[ nAktColl ].n81Flags);
+        ChkToggleBiDiAttr(vColl[nOldColl].n81BiDiFlags,
+            vColl[nAktColl].n81BiDiFlags);
     }
 }
 
@@ -3342,8 +3349,8 @@ void SwWW8ImplReader::ReadAttrs(WW8_CP& rNext, WW8_CP& rTxtPos, bool& rbStartLin
 // nicht im Plcx.Fkp.papx eingetragen, d.h. ( nFlags & MAN_MASK_NEW_PAP )
 // ist false. Deshalb muss als Sonderbehandlung hier die Vorlage gesetzt
 // werden.
-        if (!bCpxStyle && nAktColl < nColls)
-            SetTxtFmtCollAndListLevel(*pPaM, pCollA[nAktColl]);
+        if (!bCpxStyle && nAktColl < vColl.size())
+            SetTxtFmtCollAndListLevel(*pPaM, vColl[nAktColl]);
         rbStartLine = false;
     }
 }
@@ -3598,7 +3605,6 @@ SwWW8ImplReader::SwWW8ImplReader(sal_uInt8 nVersionPara, SvStorage* pStorage,
     pAktColl = 0;
     pLstManager = 0;
     pAktItemSet = 0;
-    pCollA = 0;
     pDfltTxtFmtColl = 0;
     pStandardFmtColl = 0;
     pHdFt = 0;
@@ -3608,7 +3614,7 @@ SwWW8ImplReader::SwWW8ImplReader(sal_uInt8 nVersionPara, SvStorage* pStorage,
     pFmtOfJustInsertedApo = 0;
     pPreviousNumPaM = 0;
     pPrevNumRule = 0;
-    nColls = nAktColl = 0;
+    nAktColl = 0;
     nObjLocFc = nPicLocFc = 0;
     nInTable=0;
     bReadNoTbl = bPgSecBreak = bSpec = bObj = bTxbxFlySection
@@ -4427,7 +4433,7 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss, const SwPosition &rPos)
     ::SetProgressState(nProgress, mpDocShell);    // Update
     pStyles->PostProcessStyles();
 
-    if (pCollA)
+    if (!vColl.empty())
         SetOutLineStyles();
 
     pSBase = new WW8ScannerBase(pStrm,pTableStream,pDataStream,pWwFib);
@@ -4654,8 +4660,7 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss, const SwPosition &rPos)
     maInsertedTables.DelAndMakeTblFrms();
     maSectionManager.InsertSegments();
 
-    if (pCollA)
-        delete[] pCollA;
+    vColl.clear();
 
     DELETEZ( pStyles );
 
@@ -5149,16 +5154,16 @@ void SwWW8ImplReader::SetOutLineStyles()
         pick the one that affects most styles. If we're not importing a new
         document, we got to stick with what is already there.
         */
-        // use index in text format collection array <pCollA>
+        // use index in text format collection array <vColl>
         // as key of the outline numbering map <aRuleMap>
         // instead of the memory pointer of the outline numbering rule
         // to assure that, if two outline numbering rule affect the same
         // count of text formats, always the same outline numbering rule is chosen.
         std::map<sal_uInt16, int>aRuleMap;
         typedef std::map<sal_uInt16, int>::iterator myIter;
-        for (sal_uInt16 nI = 0; nI < nColls; ++nI)
+        for (sal_uInt16 nI = 0; nI < vColl.size(); ++nI)
         {
-            SwWW8StyInf& rSI = pCollA[ nI ];
+            SwWW8StyInf& rSI = vColl[ nI ];
             if (
                 (MAXLEVEL > rSI.nOutlineLevel) && rSI.pOutlineNumrule &&
                 rSI.pFmt
@@ -5181,7 +5186,10 @@ void SwWW8ImplReader::SetOutLineStyles()
             if (aIter->second > nMax)
             {
                 nMax = aIter->second;
-                mpChosenOutlineNumRule = pCollA[ aIter->first ].pOutlineNumrule;
+                if(aIter->first < vColl.size())
+                    mpChosenOutlineNumRule = vColl[ aIter->first ].pOutlineNumrule;
+                else
+                    mpChosenOutlineNumRule = 0; //TODO make sure this is what we want
             }
         }
         // <--
@@ -5208,9 +5216,9 @@ void SwWW8ImplReader::SetOutLineStyles()
 
     sal_uInt16 nOldFlags = nFlagsStyleOutlLevel;
 
-    for (sal_uInt16 nI = 0; nI < nColls; ++nI)
+    for (sal_uInt16 nI = 0; nI < vColl.size(); ++nI)
     {
-        SwWW8StyInf& rSI = pCollA[nI];
+        SwWW8StyInf& rSI = vColl[nI];
 
         if (rSI.IsOutlineNumbered())
         {
diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index e666861..2fb1cee 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -50,6 +50,12 @@
 #include <xmloff/odffields.hxx>
 #include <IMark.hxx>
 
+#include <swtypes.hxx>  // enum RndStdIds
+#include <fmtfsize.hxx>
+#include <fmtornt.hxx>
+#include <fmtsrnd.hxx>
+#include <editeng/lrspitem.hxx>
+
 class SwDoc;
 class SwPaM;
 class SfxPoolItem;
@@ -64,7 +70,6 @@ class SwNumRule;
 class SwFrmFmt;
 class Writer;
 class SwFmtFld;
-class SwWW8StyInf;
 class WW8Fib;
 class WW8PLCFMan;
 struct WW8PLCFManResult;
@@ -177,6 +182,7 @@ struct WW8OleMap
     }
 };
 
+
 class SwWW8ImplReader;
 struct WW8LSTInfo;
 class WW8ListManager
@@ -223,6 +229,128 @@ private:
     sal_uInt16 nLastLFOPosition;
 };
 
+struct WW8FlyPara
+{                       // WinWord-Attribute
+                        // Achtung: *Nicht* umsortieren, da Teile mit
+                        // memcmp verglichen werden
+    bool bVer67;
+    sal_Int16 nSp26, nSp27;         // rohe Position
+    sal_Int16 nSp45, nSp28;         // Breite / Hoehe
+    sal_Int16 nLeMgn, nRiMgn, nUpMgn, nLoMgn;           // Raender
+    sal_uInt8 nSp29;                 // rohe Bindung + Alignment
+    sal_uInt8 nSp37;                 // Wrap-Mode ( 1 / 2; 0 = no Apo ? )
+    WW8_BRC5 brc;               // Umrandung Top, Left, Bottom, Right, Between
+    bool bBorderLines;          // Umrandungslinien
+    bool bGrafApo;              // true: Dieser Rahmen dient allein dazu, die
+                                // enthaltene Grafik anders als zeichengebunden
+                                // zu positionieren
+    bool mbVertSet;             // true if vertical positioning has been set
+    sal_uInt8 nOrigSp29;
+
+    WW8FlyPara(bool bIsVer67, const WW8FlyPara* pSrc = 0);
+    bool operator==(const WW8FlyPara& rSrc) const;
+    void Read(const sal_uInt8* pSprm29, WW8PLCFx_Cp_FKP* pPap);
+    void ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo);
+    void Read(const sal_uInt8* pSprm29, WW8RStyle* pStyle);
+    void ApplyTabPos(const WW8_TablePos *pTabPos);
+    bool IsEmpty() const;
+};
+
+class SwWW8StyInf
+{
+    String      sWWStyleName;
+    sal_uInt16      nWWStyleId;
+public:
+    rtl_TextEncoding eLTRFontSrcCharSet;    // rtl_TextEncoding fuer den Font
+    rtl_TextEncoding eRTLFontSrcCharSet;    // rtl_TextEncoding fuer den Font
+    rtl_TextEncoding eCJKFontSrcCharSet;    // rtl_TextEncoding fuer den Font
+    SwFmt*      pFmt;
+    WW8FlyPara* pWWFly;
+    SwNumRule*  pOutlineNumrule;
+    long        nFilePos;
+    sal_uInt16      nBase;
+    sal_uInt16      nFollow;
+    sal_uInt16      nLFOIndex;
+    sal_uInt8        nListLevel;
+    sal_uInt8        nOutlineLevel;      // falls Gliederungs-Style
+    sal_uInt16  n81Flags;           // Fuer Bold, Italic, ...
+    sal_uInt16  n81BiDiFlags;       // Fuer Bold, Italic, ...
+    SvxLRSpaceItem maWordLR;
+    bool bValid;            // leer oder Valid
+    bool bImported;         // fuers rekursive Importieren
+    bool bColl;             // true-> pFmt ist SwTxtFmtColl
+    bool bImportSkipped;    // nur true bei !bNewDoc && vorh. Style
+    bool bHasStyNumRule;    // true-> Benannter NumRule in Style
+    bool bHasBrokenWW6List; // true-> WW8+ style has a WW7- list
+    bool bListReleventIndentSet; //true if this style's indent has
+                                 //been explicitly set, it's set to the value
+                                 //of pFmt->GetItemState(RES_LR_SPACE, false)
+                                 //if it was possible to get the ItemState
+                                 //for L of the LR space independantly
+    bool bParaAutoBefore;   // For Auto spacing before a paragraph
+    bool bParaAutoAfter;    // For Auto Spacing after a paragraph
+
+    SwWW8StyInf() :
+        sWWStyleName( aEmptyStr ),
+        nWWStyleId( 0 ),
+        eLTRFontSrcCharSet(0),
+        eRTLFontSrcCharSet(0),
+        eCJKFontSrcCharSet(0),
+        pFmt( 0 ),
+        pWWFly( 0 ),
+        pOutlineNumrule( 0 ),
+        nFilePos( 0 ),
+        nBase( 0 ),
+        nFollow( 0 ),
+        nLFOIndex( USHRT_MAX ),
+        nListLevel(WW8ListManager::nMaxLevel),
+        nOutlineLevel( MAXLEVEL ),
+        n81Flags( 0 ),
+        n81BiDiFlags(0),
+        maWordLR( RES_LR_SPACE ),
+        bValid(false),
+        bImported(false),
+        bColl(false),
+        bImportSkipped(false),
+        bHasStyNumRule(false),
+        bHasBrokenWW6List(false),
+        bListReleventIndentSet(false),
+        bParaAutoBefore(false),
+        bParaAutoAfter(false)
+
+    {}
+
+    ~SwWW8StyInf()
+    {
+        delete pWWFly;
+    }
+
+    void SetOrgWWIdent( const String& rName, const sal_uInt16 nId )
+    {
+        sWWStyleName = rName;
+        nWWStyleId = nId;
+    }
+    sal_uInt16 GetWWStyleId() const { return nWWStyleId; }
+    const String& GetOrgWWName() const
+    {
+        return sWWStyleName;
+    }
+    bool IsOutline() const
+    {
+        return (pFmt && (MAXLEVEL > nOutlineLevel));
+    }
+    bool IsOutlineNumbered() const
+    {
+        return pOutlineNumrule && IsOutline();
+    }
+    const SwNumRule* GetOutlineNumrule() const
+    {
+        return pOutlineNumrule;
+    }
+    CharSet GetCharSet() const;
+    CharSet GetCJKCharSet() const;
+};
+
 //-----------------------------------------
 //            Stack
 //-----------------------------------------
@@ -948,7 +1076,7 @@ private:
                             // ( ist ausserhalb einer Style-Def immer 0 )
     SfxItemSet* pAktItemSet;// gerade einzulesende Zeichenattribute
                             // (ausserhalb des WW8ListManager Ctor's immer 0)
-    SwWW8StyInf* pCollA;    // UEbersetzungs-Array der Styles
+    std::vector<SwWW8StyInf> vColl;
     const SwTxtFmtColl* pDfltTxtFmtColl;    // Default
     SwFmt* pStandardFmtColl;// "Standard"
 
@@ -1000,7 +1128,6 @@ private:
     rtl_TextEncoding eStructCharSet;  // rtl_TextEncoding for structures
     rtl_TextEncoding eHardCharSet;    // Hard rtl_TextEncoding-Attribute
     sal_uInt16 nProgress;           // %-Angabe fuer Progressbar
-    sal_uInt16 nColls;              // Groesse des Arrays
     sal_uInt16 nAktColl;            // gemaess WW-Zaehlung
     sal_uInt16 nFldNum;             // laufende Nummer dafuer
     sal_uInt16 nLFOPosition;
@@ -1089,7 +1216,7 @@ private:
 
     const SprmReadInfo& GetSprmReadInfo(sal_uInt16 nId) const;
 
-    bool StyleExists(int nColl) const { return (nColl < nColls); }
+    bool StyleExists(unsigned int nColl) const { return (nColl < vColl.size()); }
     SwWW8StyInf *GetStyle(sal_uInt16 nColl) const;
     void AppendTxtNode(SwPosition& rPos);
 
diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index 9e8324b..4ab1be3 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -526,8 +526,8 @@ ApoTestResults SwWW8ImplReader::TestApo(int nCellLevel, bool bTableRowEnd,
     ApoTestResults aRet;
     // Frame in Style Definition (word appears to ignore them if inside an
     // text autoshape)
-    if (!bTxbxFlySection)
-        aRet.mpStyleApo = StyleExists(nAktColl) ? pCollA[nAktColl].pWWFly : 0;
+    if (!bTxbxFlySection && nAktColl < vColl.size())
+        aRet.mpStyleApo = StyleExists(nAktColl) ? vColl[nAktColl].pWWFly : 0;
 
     /*
     #i1140#
@@ -838,7 +838,7 @@ void SwWW8ImplReader::Read_ANLevelNo( sal_uInt16, const sal_uInt8* pData, short
 void SwWW8ImplReader::Read_ANLevelDesc( sal_uInt16, const sal_uInt8* pData, short nLen ) // Sprm 12
 {
     {
-        SwWW8StyInf * pStyInf = GetStyle(nAktColl);    
+        SwWW8StyInf * pStyInf = GetStyle(nAktColl);
         if( !pAktColl || nLen <= 0                  // nur bei Styledef
             || (pStyInf && !pStyInf->bColl)              // CharFmt -> ignorieren
             || ( nIniFlags & WW8FL_NO_OUTLINE ) ){
@@ -3664,11 +3664,11 @@ bool SwWW8ImplReader::IsInvalidOrToBeMergedTabCell() const
 sal_uInt16 SwWW8ImplReader::StyleUsingLFO( sal_uInt16 nLFOIndex ) const
 {
     sal_uInt16 nRes = USHRT_MAX;
-    if( pCollA )
+    if( !vColl.empty() )
     {
         for(sal_uInt16 nI = 0; nI < pStyles->GetCount(); nI++ )
-            if(    pCollA[ nI ].bValid
-                && (nLFOIndex == pCollA[ nI ].nLFOIndex) )
+            if(    vColl[ nI ].bValid
+                && (nLFOIndex == vColl[ nI ].nLFOIndex) )
                 nRes = nI;
     }
     return nRes;
@@ -3677,13 +3677,13 @@ sal_uInt16 SwWW8ImplReader::StyleUsingLFO( sal_uInt16 nLFOIndex ) const
 const SwFmt* SwWW8ImplReader::GetStyleWithOrgWWName( String& rName ) const
 {
     SwFmt* pRet = 0;
-    if( pCollA )
+    if( !vColl.empty() )
     {
         for(sal_uInt16 nI = 0; nI < pStyles->GetCount(); nI++ )
-            if(    pCollA[ nI ].bValid
-                && (rName.Equals( pCollA[ nI ].GetOrgWWName())) )
+            if(    vColl[ nI ].bValid
+                && (rName.Equals( vColl[ nI ].GetOrgWWName())) )
             {
-                pRet = pCollA[ nI ].pFmt;
+                pRet = vColl[ nI ].pFmt;
                 break;
             }
     }
@@ -3838,8 +3838,7 @@ WW8RStyle::WW8RStyle(WW8Fib& _rFib, SwWW8ImplReader* pI)
     : WW8Style(*pI->pTableStream, _rFib), maSprmParser(_rFib.GetFIBVersion()),
     pIo(pI), pStStrm(pI->pTableStream), pStyRule(0), nWwNumLevel(0)
 {
-    pIo->nColls = cstd;
-    pIo->pCollA = cstd ? new SwWW8StyInf[ cstd ] : NULL; // Style-UEbersetzung WW->SW
+    pIo->vColl.resize(cstd);
 }
 
 void WW8RStyle::Set1StyleDefaults()
@@ -3931,7 +3930,7 @@ bool WW8RStyle::PrepareStyle(SwWW8StyInf &rSI, ww::sti eSti, sal_uInt16 nThisSty
     sal_uInt16 j = rSI.nBase;
     if (j != nThisStyle && j < cstd )
     {
-        SwWW8StyInf* pj = &pIo->pCollA[j];
+        SwWW8StyInf* pj = &pIo->vColl[j];
         if (rSI.pFmt && pj->pFmt && rSI.bColl == pj->bColl)
         {
             rSI.pFmt->SetDerivedFrom( pj->pFmt );  // ok, Based on eintragen
@@ -3971,7 +3970,7 @@ void WW8RStyle::PostStyle(SwWW8StyInf &rSI, bool bOldNoImp)
     pIo->nCharFmt = -1;
 
     // If Style basiert auf Nichts oder Basis ignoriert
-    if ((rSI.nBase >= cstd || pIo->pCollA[rSI.nBase].bImportSkipped) && rSI.bColl)
+    if ((rSI.nBase >= cstd || pIo->vColl[rSI.nBase].bImportSkipped) && rSI.bColl)
     {
         //! Char-Styles funktionieren aus
         // unerfindlichen Gruenden nicht
@@ -3992,7 +3991,10 @@ void WW8RStyle::PostStyle(SwWW8StyInf &rSI, bool bOldNoImp)
 
 void WW8RStyle::Import1Style( sal_uInt16 nNr )
 {
-    SwWW8StyInf &rSI = pIo->pCollA[nNr];
+    if (nNr >= pIo->vColl.size())
+        return;
+
+    SwWW8StyInf &rSI = pIo->vColl[nNr];
 
     if( rSI.bImported || !rSI.bValid )
         return;
@@ -4002,7 +4004,7 @@ void WW8RStyle::Import1Style( sal_uInt16 nNr )
                                                 //
     // gueltig und nicht NIL und noch nicht Importiert
 
-    if( rSI.nBase < cstd && !pIo->pCollA[rSI.nBase].bImported )
+    if( rSI.nBase < cstd && !pIo->vColl[rSI.nBase].bImported )
         Import1Style( rSI.nBase );
 
     pStStrm->Seek( rSI.nFilePos );
@@ -4045,13 +4047,16 @@ void WW8RStyle::Import1Style( sal_uInt16 nNr )
 
 void WW8RStyle::RecursiveReg(sal_uInt16 nNr)
 {
-    SwWW8StyInf &rSI = pIo->pCollA[nNr];
+    if (nNr >= pIo->vColl.size())
+        return;
+
+    SwWW8StyInf &rSI = pIo->vColl[nNr];
     if( rSI.bImported || !rSI.bValid )
         return;
 
     rSI.bImported = true;
 
-    if( rSI.nBase < cstd && !pIo->pCollA[rSI.nBase].bImported )
+    if( rSI.nBase < cstd && !pIo->vColl[rSI.nBase].bImported )
         RecursiveReg(rSI.nBase);
 
     pIo->RegisterNumFmtOnStyle(nNr);
@@ -4071,7 +4076,7 @@ void WW8RStyle::PostProcessStyles()
      formats and use it to mark handled ones
     */
     for (i=0; i < cstd; ++i)
-        pIo->pCollA[i].bImported = false;
+        pIo->vColl[i].bImported = false;
 
     /*
      Register the num formats and tabstop changes on the styles recursively.
@@ -4086,7 +4091,7 @@ void WW8RStyle::PostProcessStyles()
     */
     for (i=0; i < cstd; ++i)
     {
-        if (pIo->pCollA[i].bValid)
+        if (pIo->vColl[i].bValid)
         {
             RecursiveReg(i);
         }
@@ -4098,7 +4103,7 @@ void WW8RStyle::ScanStyles()        // untersucht Style-Abhaengigkeiten
     for (sal_uInt16 i = 0; i < cstd; ++i)
     {
         short nSkip;
-        SwWW8StyInf &rSI = pIo->pCollA[i];
+        SwWW8StyInf &rSI = pIo->vColl[i];
 
         rSI.nFilePos = pStStrm->Tell();        // merke FilePos
         WW8_STD* pStd = Read1Style( nSkip, 0, 0 );  // read STD
@@ -4355,9 +4360,9 @@ void WW8RStyle::ImportOldFormatStyles()
 {
     for (sal_uInt16 i=0; i < cstd; ++i)
     {
-        pIo->pCollA[i].bColl = true;
+        pIo->vColl[i].bColl = true;
         //every chain must end eventually at the null style (style code 222)
-        pIo->pCollA[i].nBase = 222;
+        pIo->vColl[i].nBase = 222;
     }
 
     rtl_TextEncoding eStructChrSet = WW8Fib::GetFIBCharset(
@@ -4377,7 +4382,10 @@ void WW8RStyle::ImportOldFormatStyles()
         nByteCount++;
 
         sal_uInt8 stc = static_cast< sal_uInt8 >((stcp - cstcStd) & 255);
-        SwWW8StyInf &rSI = pIo->pCollA[stc];
+        if (stc >=pIo->vColl.size())
+            continue;
+
+        SwWW8StyInf &rSI = pIo->vColl[stc];
         if (nCount != 0xFF)    // undefined style
         {
             String sName;
@@ -4507,7 +4515,7 @@ void WW8RStyle::ImportOldFormatStyles()
         if (stc == stcBase)
             stcBase = 222;
 
-        SwWW8StyInf &rSI = pIo->pCollA[stc];
+        SwWW8StyInf &rSI = pIo->vColl[stc];
         rSI.nBase = stcBase;
 
         ww::sti eSti = ww::GetCanonicalStiFromStc(stc);
@@ -4518,7 +4526,7 @@ void WW8RStyle::ImportOldFormatStyles()
         rSI.bValid = true;
 
         if (ww::StandardStiIsCharStyle(eSti) && !aPAPXOffsets[stcp].mnSize)
-            pIo->pCollA[stc].bColl = false;
+            pIo->vColl[stc].bColl = false;
 
         bool bOldNoImp = PrepareStyle(rSI, eSti, stc, stcNext);
 
@@ -4539,7 +4547,7 @@ void WW8RStyle::ImportNewFormatStyles()
     ScanStyles();                       // Scanne Based On
 
     for (sal_uInt16 i = 0; i < cstd; ++i) // import Styles
-        if (pIo->pCollA[i].bValid)
+        if (pIo->vColl[i].bValid)
             Import1Style( i );
 }
 
@@ -4565,11 +4573,11 @@ void WW8RStyle::Import()
     for (sal_uInt16 i = 0; i < cstd; ++i)
     {
         // Follow chain
-        SwWW8StyInf* pi = &pIo->pCollA[i];
+        SwWW8StyInf* pi = &pIo->vColl[i];
         sal_uInt16 j = pi->nFollow;
         if( j < cstd )
         {
-            SwWW8StyInf* pj = &pIo->pCollA[j];
+            SwWW8StyInf* pj = &pIo->vColl[j];
             if ( j != i                             // sinnvoller Index ?
                  && pi->pFmt                        // Format ok ?
                  && pj->pFmt                        // Derived-Format ok ?
@@ -4589,8 +4597,9 @@ void WW8RStyle::Import()
 //
     // fuer z.B. Tabellen wird ein immer gueltiger Std-Style gebraucht
 
-    if( pIo->StyleExists(0) && pIo->pCollA[0].pFmt && pIo->pCollA[0].bColl && pIo->pCollA[0].bValid )
-        pIo->pDfltTxtFmtColl = (SwTxtFmtColl*)pIo->pCollA[0].pFmt;
+    if( pIo->StyleExists(0) && !pIo->vColl.empty() &&
+        pIo->vColl[0].pFmt && pIo->vColl[0].bColl && pIo->vColl[0].bValid )
+        pIo->pDfltTxtFmtColl = (SwTxtFmtColl*)pIo->vColl[0].pFmt;
     else
         pIo->pDfltTxtFmtColl = pIo->rDoc.GetDfltTxtFmtColl();
 
diff --git a/sw/source/filter/ww8/ww8par2.hxx b/sw/source/filter/ww8/ww8par2.hxx
index 2dba225..dae3e95 100644
--- a/sw/source/filter/ww8/ww8par2.hxx
+++ b/sw/source/filter/ww8/ww8par2.hxx
@@ -53,32 +53,6 @@ private:
     SfxItemSet aChrSet,aParSet;
 };
 
-struct WW8FlyPara
-{                       // WinWord-Attribute
-                        // Achtung: *Nicht* umsortieren, da Teile mit
-                        // memcmp verglichen werden
-    bool bVer67;
-    sal_Int16 nSp26, nSp27;         // rohe Position
-    sal_Int16 nSp45, nSp28;         // Breite / Hoehe
-    sal_Int16 nLeMgn, nRiMgn, nUpMgn, nLoMgn;           // Raender
-    sal_uInt8 nSp29;                 // rohe Bindung + Alignment
-    sal_uInt8 nSp37;                 // Wrap-Mode ( 1 / 2; 0 = no Apo ? )
-    WW8_BRC5 brc;               // Umrandung Top, Left, Bottom, Right, Between
-    bool bBorderLines;          // Umrandungslinien
-    bool bGrafApo;              // true: Dieser Rahmen dient allein dazu, die
-                                // enthaltene Grafik anders als zeichengebunden
-                                // zu positionieren
-    bool mbVertSet;             // true if vertical positioning has been set
-    sal_uInt8 nOrigSp29;
-
-    WW8FlyPara(bool bIsVer67, const WW8FlyPara* pSrc = 0);
-    bool operator==(const WW8FlyPara& rSrc) const;
-    void Read(const sal_uInt8* pSprm29, WW8PLCFx_Cp_FKP* pPap);
-    void ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo);
-    void Read(const sal_uInt8* pSprm29, WW8RStyle* pStyle);
-    void ApplyTabPos(const WW8_TablePos *pTabPos);
-    bool IsEmpty() const;
-};
 
 struct WW8SwFlyPara
 {
@@ -122,101 +96,6 @@ struct WW8SwFlyPara
     SwWW8FltAnchorStack *pOldAnchorStck;
 };
 
-class SwWW8StyInf
-{
-    String      sWWStyleName;
-    sal_uInt16      nWWStyleId;
-public:
-    rtl_TextEncoding eLTRFontSrcCharSet;    // rtl_TextEncoding fuer den Font
-    rtl_TextEncoding eRTLFontSrcCharSet;    // rtl_TextEncoding fuer den Font
-    rtl_TextEncoding eCJKFontSrcCharSet;    // rtl_TextEncoding fuer den Font
-    SwFmt*      pFmt;
-    WW8FlyPara* pWWFly;
-    SwNumRule*  pOutlineNumrule;
-    long        nFilePos;
-    sal_uInt16      nBase;
-    sal_uInt16      nFollow;
-    sal_uInt16      nLFOIndex;
-    sal_uInt8        nListLevel;
-    sal_uInt8        nOutlineLevel;      // falls Gliederungs-Style
-    sal_uInt16  n81Flags;           // Fuer Bold, Italic, ...
-    sal_uInt16  n81BiDiFlags;       // Fuer Bold, Italic, ...
-    SvxLRSpaceItem maWordLR;
-    bool bValid;            // leer oder Valid
-    bool bImported;         // fuers rekursive Importieren
-    bool bColl;             // true-> pFmt ist SwTxtFmtColl
-    bool bImportSkipped;    // nur true bei !bNewDoc && vorh. Style
-    bool bHasStyNumRule;    // true-> Benannter NumRule in Style
-    bool bHasBrokenWW6List; // true-> WW8+ style has a WW7- list
-    bool bListReleventIndentSet; //true if this style's indent has
-                                 //been explicitly set, it's set to the value
-                                 //of pFmt->GetItemState(RES_LR_SPACE, false)
-                                 //if it was possible to get the ItemState
-                                 //for L of the LR space independantly
-    bool bParaAutoBefore;   // For Auto spacing before a paragraph
-    bool bParaAutoAfter;    // For Auto Spacing after a paragraph
-
-    SwWW8StyInf() :
-        sWWStyleName( aEmptyStr ),
-        nWWStyleId( 0 ),
-        eLTRFontSrcCharSet(0),
-        eRTLFontSrcCharSet(0),
-        eCJKFontSrcCharSet(0),
-        pFmt( 0 ),
-        pWWFly( 0 ),
-        pOutlineNumrule( 0 ),
-        nFilePos( 0 ),
-        nBase( 0 ),
-        nFollow( 0 ),
-        nLFOIndex( USHRT_MAX ),
-        nListLevel(WW8ListManager::nMaxLevel),
-        nOutlineLevel( MAXLEVEL ),
-        n81Flags( 0 ),
-        n81BiDiFlags(0),
-        maWordLR( RES_LR_SPACE ),
-        bValid(false),
-        bImported(false),
-        bColl(false),
-        bImportSkipped(false),
-        bHasStyNumRule(false),
-        bHasBrokenWW6List(false),
-        bListReleventIndentSet(false),
-        bParaAutoBefore(false),
-        bParaAutoAfter(false)
-
-    {}
-
-    ~SwWW8StyInf()
-    {
-        delete pWWFly;
-    }
-
-    void SetOrgWWIdent( const String& rName, const sal_uInt16 nId )
-    {
-        sWWStyleName = rName;
-        nWWStyleId = nId;
-    }
-    sal_uInt16 GetWWStyleId() const { return nWWStyleId; }
-    const String& GetOrgWWName() const
-    {
-        return sWWStyleName;
-    }
-    bool IsOutline() const
-    {
-        return (pFmt && (MAXLEVEL > nOutlineLevel));
-    }
-    bool IsOutlineNumbered() const
-    {
-        return pOutlineNumrule && IsOutline();
-    }
-    const SwNumRule* GetOutlineNumrule() const
-    {
-        return pOutlineNumrule;
-    }
-    CharSet GetCharSet() const;
-    CharSet GetCJKCharSet() const;
-};
-
 class WW8RStyle: public WW8Style
 {
 friend class SwWW8ImplReader;
diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index e01547c..c1062da 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -1702,7 +1702,10 @@ void SetStyleIndent(SwWW8StyInf &rStyle, const SwNumFmt &rFmt)
 void SwWW8ImplReader::SetStylesList(sal_uInt16 nStyle, sal_uInt16 nActLFO,
     sal_uInt8 nActLevel)
 {
-    SwWW8StyInf &rStyleInf = pCollA[nStyle];
+    if (nStyle >= vColl.size())
+        return;
+
+    SwWW8StyInf &rStyleInf = vColl[nStyle];
     if (rStyleInf.bValid)
     {
         OSL_ENSURE(pAktColl, "Cannot be called outside of style import");
@@ -1738,7 +1741,11 @@ void SwWW8ImplReader::SetStylesList(sal_uInt16 nStyle, sal_uInt16 nActLFO,
 
 void SwWW8ImplReader::RegisterNumFmtOnStyle(sal_uInt16 nStyle)
 {
-    SwWW8StyInf &rStyleInf = pCollA[nStyle];
+
+    if (nStyle >= vColl.size())
+        return;
+
+    SwWW8StyInf &rStyleInf = vColl[nStyle];
     if (rStyleInf.bValid && rStyleInf.pFmt)
     {
         //Save old pre-list modified indent, which are the word indent values
@@ -2033,8 +2040,8 @@ void SwWW8ImplReader::Read_LFOPosition(sal_uInt16, const sal_uInt8* pData,
             indentation.  Setting this flag will allow us to recover from this
             braindeadness
             */
-            if (pAktColl && (nLFOPosition == 2047-1))
-                pCollA[nAktColl].bHasBrokenWW6List = true;
+            if (pAktColl && (nLFOPosition == 2047-1) && nAktColl < vColl.size())
+                vColl[nAktColl].bHasBrokenWW6List = true;
 
             // die Streamdaten sind hier 1 basiert, wir ziehen EINS ab
             if (USHRT_MAX > nLFOPosition)
diff --git a/sw/source/filter/ww8/ww8par5.cxx b/sw/source/filter/ww8/ww8par5.cxx
index 691fef9..50f2719 100644
--- a/sw/source/filter/ww8/ww8par5.cxx
+++ b/sw/source/filter/ww8/ww8par5.cxx
@@ -2777,9 +2777,9 @@ bool SwWW8ImplReader::AddExtraOutlinesAsExtraStyles(SwTOXBase& rBase)
     bool bExtras = false;
     //This is the case if the winword outline numbering is set while the
     //writer one is not
-    for (sal_uInt16 nI = 0; nI < nColls; ++nI)
+    for (sal_uInt16 nI = 0; nI < vColl.size(); ++nI)
     {
-        SwWW8StyInf& rSI = pCollA[nI];
+        SwWW8StyInf& rSI = vColl[nI];
         if (rSI.IsOutline())
         {
             const SwTxtFmtColl *pFmt = (const SwTxtFmtColl*)(rSI.pFmt);
@@ -3284,9 +3284,9 @@ eF_ResT SwWW8ImplReader::Read_F_Tox( WW8FieldDesc* pF, String& rStr )
                             // the entry correctly, but I currently have no clue how to obtain
                             // the tab stop position. It is _not_ set at the paragraph style.
                             SwForm* pForm = 0;
-                            for (sal_uInt16 nI = 0; nI < nColls; ++nI)
+                            for (sal_uInt16 nI = 0; nI < vColl.size(); ++nI)
                             {
-                                const SwWW8StyInf& rSI = pCollA[nI];
+                                const SwWW8StyInf& rSI = vColl[nI];
                                 if (rSI.IsOutlineNumbered())
                                 {
                                     sal_uInt16 nStyleLevel = rSI.nOutlineLevel;
diff --git a/sw/source/filter/ww8/ww8par6.cxx b/sw/source/filter/ww8/ww8par6.cxx
index 756f757..01520a3 100644
--- a/sw/source/filter/ww8/ww8par6.cxx
+++ b/sw/source/filter/ww8/ww8par6.cxx
@@ -284,10 +284,10 @@ void SwWW8ImplReader::SetDocumentGrid(SwFrmFmt &rFmt, const wwSection &rSection)
     sal_uInt32 nCharWidth=240;
     for (sal_uInt16 nI = 0; nI < pStyles->GetCount(); ++nI)
     {
-        if (pCollA[nI].bValid && pCollA[nI].pFmt &&
-            pCollA[nI].GetWWStyleId() == 0)
+        if (vColl[nI].bValid && vColl[nI].pFmt &&
+            vColl[nI].GetWWStyleId() == 0)
         {
-            nCharWidth = ItemGet<SvxFontHeightItem>(*(pCollA[nI].pFmt),
+            nCharWidth = ItemGet<SvxFontHeightItem>(*(vColl[nI].pFmt),
                 RES_CHRATR_CJK_FONTSIZE).GetHeight();
             break;
         }
@@ -1714,9 +1714,9 @@ void WW8FlyPara::ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo)
             WW8FlyPara *pNowStyleApo=0;
             sal_uInt16 nColl = pPap->GetIstd();
             ww::sti eSti = eVer < ww::eWW6 ? ww::GetCanonicalStiFromStc( static_cast< sal_uInt8 >(nColl) ) : static_cast<ww::sti>(nColl);
-            while (eSti != ww::stiNil && 0 == (pNowStyleApo = pIo->pCollA[nColl].pWWFly))
+            while (eSti != ww::stiNil && nColl < pIo->vColl.size() && 0 == (pNowStyleApo = pIo->vColl[nColl].pWWFly))
             {
-                nColl = pIo->pCollA[nColl].nBase;
+                nColl = pIo->vColl[nColl].nBase;
                 eSti = eVer < ww::eWW6 ? ww::GetCanonicalStiFromStc( static_cast< sal_uInt8 >(nColl) ) : static_cast<ww::sti>(nColl);
             }
 
@@ -2664,10 +2664,10 @@ const SfxPoolItem* SwWW8ImplReader::GetFmtAttr( sal_uInt16 nWhich )
         pRet = pCtrlStck->GetStackAttr(*pPaM->GetPoint(), nWhich);
         if (!pRet)
         {
-            if (nAktColl < nColls && pCollA[nAktColl].pFmt &&
-                pCollA[nAktColl].bColl)
+            if (nAktColl < vColl.size() && vColl[nAktColl].pFmt &&
+                vColl[nAktColl].bColl)
             {
-                pRet = &(pCollA[nAktColl].pFmt->GetFmtAttr(nWhich));
+                pRet = &(vColl[nAktColl].pFmt->GetFmtAttr(nWhich));
             }
         }
         if (!pRet)
@@ -2790,7 +2790,7 @@ void SwWW8ImplReader::Read_Symbol(sal_uInt16, const sal_uInt8* pData, short nLen
 
 SwWW8StyInf *SwWW8ImplReader::GetStyle(sal_uInt16 nColl) const
 {
-    return nColl < nColls ? &pCollA[nColl] : 0;
+    return const_cast<SwWW8StyInf *>(nColl < vColl.size() ? &vColl[nColl] : 0);
 }
 
 /***************************************************************************
@@ -2874,8 +2874,8 @@ void SwWW8ImplReader::Read_BoldUsw( sal_uInt16 nId, const sal_uInt8* pData, shor
         {
             // The style based on has Bit 7 set ?
             if (
-                pSI->nBase < nColls && (*pData & 0x80) &&
-                (pCollA[pSI->nBase].n81Flags & nMask)
+                pSI->nBase < vColl.size() && (*pData & 0x80) &&
+                (vColl[pSI->nBase].n81Flags & nMask)
                )
             {
                 bOn = !bOn;                     // umdrehen
@@ -2955,9 +2955,9 @@ void SwWW8ImplReader::Read_BoldBiDiUsw(sal_uInt16 nId, const sal_uInt8* pData,
     {
         if (pSI)
         {
-            if( pSI->nBase < nColls             // Style Based on
+            if( pSI->nBase < vColl.size()             // Style Based on
                 && ( *pData & 0x80 )            // Bit 7 gesetzt ?
-                && ( pCollA[pSI->nBase].n81BiDiFlags & nMask ) ) // BasisMaske ?
+                && ( vColl[pSI->nBase].n81BiDiFlags & nMask ) ) // BasisMaske ?
                     bOn = !bOn;                     // umdrehen
 
             if( bOn )
@@ -3522,19 +3522,19 @@ bool SwWW8ImplReader::SetNewFontAttr(sal_uInt16 nFCode, bool bSetEnums,
 
     if( bSetEnums )
     {
-        if( pAktColl ) // StyleDef
+        if( pAktColl && nAktColl < vColl.size() ) // StyleDef
         {
             switch(nWhich)
             {
                 default:
                 case RES_CHRATR_FONT:
-                    pCollA[nAktColl].eLTRFontSrcCharSet = eSrcCharSet;
+                    vColl[nAktColl].eLTRFontSrcCharSet = eSrcCharSet;
                     break;
                 case RES_CHRATR_CTL_FONT:
-                    pCollA[nAktColl].eRTLFontSrcCharSet = eSrcCharSet;
+                    vColl[nAktColl].eRTLFontSrcCharSet = eSrcCharSet;
                     break;
                 case RES_CHRATR_CJK_FONT:
-                    pCollA[nAktColl].eCJKFontSrcCharSet = eSrcCharSet;
+                    vColl[nAktColl].eCJKFontSrcCharSet = eSrcCharSet;
                     break;
             }
         }
@@ -3762,11 +3762,11 @@ void SwWW8ImplReader::Read_CColl( sal_uInt16, const sal_uInt8* pData, short nLen
     }
     sal_uInt16 nId = SVBT16ToShort( pData );    // Style-Id (NICHT Sprm-Id!)
 
-    if( nId >= nColls || !pCollA[nId].pFmt  // ungueltige Id ?
-        || pCollA[nId].bColl )              // oder Para-Style ?
+    if( nId >= vColl.size() || !vColl[nId].pFmt  // ungueltige Id ?
+        || vColl[nId].bColl )              // oder Para-Style ?
         return;                             // dann ignorieren
 
-    NewAttr( SwFmtCharFmt( (SwCharFmt*)pCollA[nId].pFmt ) );
+    NewAttr( SwFmtCharFmt( (SwCharFmt*)vColl[nId].pFmt ) );
     nCharFmt = (short) nId;
 }
 
@@ -3961,9 +3961,9 @@ void SwWW8ImplReader::Read_LR( sal_uInt16 nId, const sal_uInt8* pData, short nLe
         case 0x840F:
         case 0x845E:
             aLR.SetTxtLeft( nPara );
-            if (pAktColl)
+            if (pAktColl && nAktColl < vColl.size())
             {        
-                pCollA[nAktColl].bListReleventIndentSet = true;
+                vColl[nAktColl].bListReleventIndentSet = true;
             }
             bLeftIndentSet = true;  // #i105414#
             break;
@@ -3982,22 +3982,22 @@ void SwWW8ImplReader::Read_LR( sal_uInt16 nId, const sal_uInt8* pData, short nLe
             been removed then we will factor the original list applied hanging
             into our calculation.
             */
-            if (pPlcxMan && pCollA[nAktColl].bHasBrokenWW6List)
+            if (pPlcxMan && nAktColl < vColl.size() && vColl[nAktColl].bHasBrokenWW6List)
             {
                 const sal_uInt8 *pIsZeroed = pPlcxMan->GetPapPLCF()->HasSprm(0x460B);
                 if (pIsZeroed && *pIsZeroed == 0)
                 {
                     const SvxLRSpaceItem &rLR =
-                        ItemGet<SvxLRSpaceItem>(*(pCollA[nAktColl].pFmt),
+                        ItemGet<SvxLRSpaceItem>(*(vColl[nAktColl].pFmt),
                         RES_LR_SPACE);
                     nPara = nPara - rLR.GetTxtFirstLineOfst();
                 }
             }
 
             aLR.SetTxtFirstLineOfst(nPara);
-            if (pAktColl)
+            if (pAktColl && nAktColl < vColl.size())
             {        
-                pCollA[nAktColl].bListReleventIndentSet = true;
+                vColl[nAktColl].bListReleventIndentSet = true;
             }
             bFirstLinOfstSet = true; // #i103711#
             break;
@@ -4110,15 +4110,15 @@ void SwWW8ImplReader::Read_ParaAutoBefore(sal_uInt16, const sal_uInt8 *pData, sh
         SvxULSpaceItem aUL(*(const SvxULSpaceItem*)GetFmtAttr(RES_UL_SPACE));
         aUL.SetUpper(GetParagraphAutoSpace(pWDop->fDontUseHTMLAutoSpacing));
         NewAttr(aUL);
-        if (pAktColl)
-            pCollA[nAktColl].bParaAutoBefore = true;
+        if (pAktColl && nAktColl < vColl.size())
+            vColl[nAktColl].bParaAutoBefore = true;
         else
             bParaAutoBefore = true;
     }
     else
     {
-        if (pAktColl)
-            pCollA[nAktColl].bParaAutoBefore = false;
+        if (pAktColl && nAktColl < vColl.size())
+            vColl[nAktColl].bParaAutoBefore = false;
         else
             bParaAutoBefore = false;
     }
@@ -4137,15 +4137,15 @@ void SwWW8ImplReader::Read_ParaAutoAfter(sal_uInt16, const sal_uInt8 *pData, sho
         SvxULSpaceItem aUL(*(const SvxULSpaceItem*)GetFmtAttr(RES_UL_SPACE));
         aUL.SetLower(GetParagraphAutoSpace(pWDop->fDontUseHTMLAutoSpacing));
         NewAttr(aUL);
-        if (pAktColl)
-            pCollA[nAktColl].bParaAutoAfter = true;
+        if (pAktColl && nAktColl < vColl.size())
+            vColl[nAktColl].bParaAutoAfter = true;
         else
             bParaAutoAfter = true;
     }
     else
     {
-        if (pAktColl)
-            pCollA[nAktColl].bParaAutoAfter = false;
+        if (pAktColl && nAktColl < vColl.size())
+            vColl[nAktColl].bParaAutoAfter = false;
         else
             bParaAutoAfter = false;
     }
@@ -4862,14 +4862,14 @@ void SwWW8ImplReader::Read_BreakBefore( sal_uInt16, const sal_uInt8* pData, shor
 
 void SwWW8ImplReader::Read_ApoPPC( sal_uInt16, const sal_uInt8* pData, short )
 {
-    if (pAktColl) // only for Styledef, sonst anders geloest
+    if (pAktColl && nAktColl < vColl.size()) // only for Styledef, sonst anders geloest
     {
-        SwWW8StyInf& rSI = pCollA[nAktColl];
+        SwWW8StyInf& rSI = vColl[nAktColl];
         WW8FlyPara* pFly = rSI.pWWFly ? rSI.pWWFly : new WW8FlyPara(bVer67);
-        pCollA[nAktColl].pWWFly = pFly;
+        vColl[nAktColl].pWWFly = pFly;
         pFly->Read(pData, pStyles);
         if (pFly->IsEmpty())
-            delete pCollA[nAktColl].pWWFly, pCollA[nAktColl].pWWFly = 0;
+            delete vColl[nAktColl].pWWFly, vColl[nAktColl].pWWFly = 0;
     }
 }
 


More information about the Libreoffice-commits mailing list