[Libreoffice-commits] .: 7 commits - sw/qa sw/source

Caolán McNamara caolan at kemper.freedesktop.org
Fri Mar 4 08:31:52 PST 2011


 sw/qa/core/CVE/CVE-2007-0245-1.rtf |   21 +++++++++++
 sw/qa/core/CVE/CVE-2009-0200-1.doc |binary
 sw/qa/core/CVE/CVE-2009-0201-1.doc |binary
 sw/qa/core/CVE/CVE-2010-3452-1.rtf |    1 
 sw/qa/core/CVE/CVE-2010-3453-1.doc |binary
 sw/qa/core/filters-test.cxx        |   25 +++++++++++++
 sw/source/core/docnode/ndtbl.cxx   |    7 ++-
 sw/source/filter/ww8/ww8par2.cxx   |   69 +++++++++++++++++++------------------
 8 files changed, 88 insertions(+), 35 deletions(-)

New commits:
commit e1ddda43b338168b9feb88d9fb70a14243ed6e19
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Mar 4 15:42:20 2011 +0000

    handle 0 width tables gracefully

diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index fabef51..e023656 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -2239,41 +2239,44 @@ void WW8TabDesc::CalcDefaults()
                 }
             }
         }
-        /*
-        Similiar to graphics and other elements word does not totally
-        factor the width of the border into its calculations of size, we
-        do so we must adjust out widths and other dimensions to fit.  It
-        appears that what occurs is that the last cell's right margin if
-        the margin width that is not calculated into winwords table
-        dimensions, so in that case increase the table to include the
-        extra width of the right margin.
-        */
-        if ( pIo->bVer67 ?
-         !(SVBT16ToShort(pR->pTCs[pR->nWwCols-1].rgbrc[3].aBits1) & 0x20)
-       : !(SVBT16ToShort(pR->pTCs[pR->nWwCols-1].rgbrc[3].aBits2) & 0x2000))
+        if (pR->nWwCols)
         {
-            short nThickness = pR->pTCs[pR->nWwCols-1].rgbrc[3].
-                DetermineBorderProperties(pIo->bVer67);
-            pR->nCenter[pR->nWwCols] = pR->nCenter[pR->nWwCols] + nThickness;
-            if (nThickness > nRightMaxThickness)
-                nRightMaxThickness = nThickness;
-        }
+            /*
+            Similiar to graphics and other elements word does not totally
+            factor the width of the border into its calculations of size, we
+            do so we must adjust out widths and other dimensions to fit.  It
+            appears that what occurs is that the last cell's right margin if
+            the margin width that is not calculated into winwords table
+            dimensions, so in that case increase the table to include the
+            extra width of the right margin.
+            */
+            if ( pIo->bVer67 ?
+             !(SVBT16ToShort(pR->pTCs[pR->nWwCols-1].rgbrc[3].aBits1) & 0x20)
+           : !(SVBT16ToShort(pR->pTCs[pR->nWwCols-1].rgbrc[3].aBits2) & 0x2000))
+            {
+                short nThickness = pR->pTCs[pR->nWwCols-1].rgbrc[3].
+                    DetermineBorderProperties(pIo->bVer67);
+                pR->nCenter[pR->nWwCols] = pR->nCenter[pR->nWwCols] + nThickness;
+                if (nThickness > nRightMaxThickness)
+                    nRightMaxThickness = nThickness;
+            }
 
-        /*
-        The left space of the table is in nMinLeft, but again this
-        does not consider the margin thickness to its left in the
-        placement value, so get the thickness of the left border,
-        half is placed to the left of the nominal left side, and
-        half to the right.
-        */
-        if ( pIo->bVer67 ?
-              !(SVBT16ToShort(pR->pTCs[0].rgbrc[1].aBits1) & 0x20)
-            : !(SVBT16ToShort(pR->pTCs[0].rgbrc[1].aBits2) & 0x2000))
-        {
-            short nThickness = pR->pTCs[0].rgbrc[1].
-                DetermineBorderProperties(pIo->bVer67);
-            if (nThickness > nLeftMaxThickness)
-                nLeftMaxThickness = nThickness;
+            /*
+            The left space of the table is in nMinLeft, but again this
+            does not consider the margin thickness to its left in the
+            placement value, so get the thickness of the left border,
+            half is placed to the left of the nominal left side, and
+            half to the right.
+            */
+            if ( pIo->bVer67 ?
+                  !(SVBT16ToShort(pR->pTCs[0].rgbrc[1].aBits1) & 0x20)
+                : !(SVBT16ToShort(pR->pTCs[0].rgbrc[1].aBits2) & 0x2000))
+            {
+                short nThickness = pR->pTCs[0].rgbrc[1].
+                    DetermineBorderProperties(pIo->bVer67);
+                if (nThickness > nLeftMaxThickness)
+                    nLeftMaxThickness = nThickness;
+            }
         }
     }
     nSwWidth = nSwWidth + nRightMaxThickness;
commit 1854a5341e618a03d1a6b1583a4d597a4e2cc64d
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Mar 4 15:15:05 2011 +0000

    regression test for CVE-2009-0201-1.doc

diff --git a/sw/qa/core/CVE/CVE-2009-0201-1.doc b/sw/qa/core/CVE/CVE-2009-0201-1.doc
new file mode 100644
index 0000000..bc6182d
Binary files /dev/null and b/sw/qa/core/CVE/CVE-2009-0201-1.doc differ
diff --git a/sw/qa/core/filters-test.cxx b/sw/qa/core/filters-test.cxx
index 9582234..cb13149 100644
--- a/sw/qa/core/filters-test.cxx
+++ b/sw/qa/core/filters-test.cxx
@@ -141,6 +141,11 @@ void FiltersTest::testCVEs()
         m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2009-0200-1.doc")));
     CPPUNIT_ASSERT_MESSAGE("CVE-2009-0200 regression", bResult == true);
 
+    bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("MS Word 97")),
+        rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("CWW8")),
+        m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2009-0201-1.doc")));
+    CPPUNIT_ASSERT_MESSAGE("CVE-2009-0201 regression", bResult == true);
+
     bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("Rich Text Format")),
         rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("RTF")),
         m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2010-3451-1.rtf")));
commit e83af92ed96a14bcaa095b3c882de1463fa479ef
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Mar 4 15:13:30 2011 +0000

    Regression test for CVE-2009-0200

diff --git a/sw/qa/core/CVE/CVE-2009-0200-1.doc b/sw/qa/core/CVE/CVE-2009-0200-1.doc
new file mode 100644
index 0000000..a142fec
Binary files /dev/null and b/sw/qa/core/CVE/CVE-2009-0200-1.doc differ
diff --git a/sw/qa/core/filters-test.cxx b/sw/qa/core/filters-test.cxx
index 93b50b6..9582234 100644
--- a/sw/qa/core/filters-test.cxx
+++ b/sw/qa/core/filters-test.cxx
@@ -136,6 +136,11 @@ void FiltersTest::testCVEs()
         m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2007-0245-1.rtf")));
     CPPUNIT_ASSERT_MESSAGE("CVE-2007-0245 regression", bResult == true);
 
+    bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("MS Word 97")),
+        rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("CWW8")),
+        m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2009-0200-1.doc")));
+    CPPUNIT_ASSERT_MESSAGE("CVE-2009-0200 regression", bResult == true);
+
     bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("Rich Text Format")),
         rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("RTF")),
         m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2010-3451-1.rtf")));
commit be450557e0591dcbd7fe74ba5609923fceef3df3
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Mar 4 15:10:36 2011 +0000

    Regression test for CVE-2007-0245

diff --git a/sw/qa/core/CVE/CVE-2007-0245-1.rtf b/sw/qa/core/CVE/CVE-2007-0245-1.rtf
new file mode 100644
index 0000000..a166c56
--- /dev/null
+++ b/sw/qa/core/CVE/CVE-2007-0245-1.rtf
@@ -0,0 +1,21 @@
+{\rtf1\ansi\ansicpg1252\uc1\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang2057\deflangfe2057{\fonttbl{\f0\froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f37\froman\fcharset238\fprq2 Times New Roman CE;}
+{\f38\froman\fcharset204\fprq2 Times New Roman Cyr;}{\f40\froman\fcharset161\fprq2 Times New Roman Greek;}{\f41\froman\fcharset162\fprq2 Times New Roman Tur;}{\f42\froman\fcharset177\fprq2 Times New Roman (Hebrew);}
+{\f43\froman\fcharset178\fprq2 Times New Roman (Arabic);}{\f44\froman\fcharset186\fprq2 Times New Roman Baltic;}{\f45\froman\fcharset163\fprq2 Times New Roman (Vietnamese);}}{\colortbl;\red0\green0\blue0;\red0\green0\blue255;\red0\green255\blue255;
+\red0\green255\blue0;\red255\green0\blue255;\red255\green0\blue0;\red255\green255\blue0;\red255\green255\blue255;\red0\green0\blue128;\red0\green128\blue128;\red0\green128\blue0;\red128\green0\blue128;\red128\green0\blue0;\red128\green128\blue0;
+\red128\green128\blue128;\red192\green192\blue192;}{\stylesheet{\ql \li0\ri0\widctlpar\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \fs24\lang2057\langfe2057\cgrid\langnp2057\langfenp2057 \snext0 Normal;}{\*\cs10 \additive \ssemihidden 
+Default Paragraph Font;}{\*\ts11\tsrowd\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\trcbpat1\trcfpat1\tscellwidthfts0\tsvertalt\tsbrdrt\tsbrdrl\tsbrdrb\tsbrdrr\tsbrdrdgl\tsbrdrdgr\tsbrdrh\tsbrdrv 
+\ql \li0\ri0\widctlpar\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \fs20\lang1024\langfe1024\cgrid\langnp1024\langfenp1024 \snext11 \ssemihidden Normal Table;}{\s15\ql \li0\ri0\widctlpar\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 
+\fs20\lang2057\langfe2057\cgrid\langnp2057\langfenp2057 \sbasedon0 \snext15 \ssemihidden \styrsid4263288 footnote text;}{\*\cs16 \additive \super \sbasedon10 \ssemihidden \styrsid4263288 footnote reference;}}{\*\latentstyles\lsdstimax156\lsdlockeddef0}
+{\*\rsidtbl \rsid163671\rsid4263288\rsid7694566\rsid13791612\rsid15955330}{\*\generator Microsoft Word 11.0.6359;}{\info{\title  }{\author John}{\operator John}{\version2}{\edmins1}
+{\nofpages1}{\nofwords0}{\nofchars1}{\*\company NGS}{\nofcharsws1}{\vern24703}}{\*\userprops {\propname _DocHome}\proptype3{\staticval -1428762290}}\paperw11906\paperh16838 
+\widowctrl\ftnbj\aenddoc\noxlattoyen\expshrtn\noultrlspc\dntblnsbdb\nospaceforul\hyphcaps0\formshade\horzdoc\dgmargin\dghspace180\dgvspace180\dghorigin1800\dgvorigin1440\dghshow1\dgvshow1
+\jexpand\viewkind1\viewscale86\pgbrdrhead\pgbrdrfoot\splytwnine\ftnlytwnine\htmautsp\nolnhtadjtbl\useltbaln\alntblind\lytcalctblwd\lyttblrtgr\lnbrkrule\nobrkwrptbl\snaptogridincell\allowfieldendsel\wrppunct
+\asianbrkrule\rsidroot163671\newtblstyruls\nogrowautofit \fet0{\*\ftnsep \pard\plain \ql \li0\ri0\widctlpar\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \fs24\lang2057\langfe2057\cgrid\langnp2057\langfenp2057 {\insrsid4263288 \chftnsep 
+\par }}{\*\ftnsepc \pard\plain \ql \li0\ri0\widctlpar\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \fs24\lang2057\langfe2057\cgrid\langnp2057\langfenp2057 {\insrsid4263288 \chftnsepc 
+\par }}{\*\aftnsep \pard\plain \ql \li0\ri0\widctlpar\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \fs24\lang2057\langfe2057\cgrid\langnp2057\langfenp2057 {\insrsid4263288 \chftnsep 
+\par }}{\*\aftnsepc \pard\plain \ql \li0\ri0\widctlpar\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \fs24\lang2057\langfe2057\cgrid\langnp2057\langfenp2057 {\insrsid4263288 \chftnsepc 
+\par }}\sectd \linex0\headery708\footery708\colsx708\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {\*\pnseclvl1\pnucrm\pnstart1\pnindent720\pnhang {\pntxta .}}{\*\pnseclvl2\pnucltr\pnstart1\pnindent720\pnhang {\pntxta .}}{\*\pnseclvl3
+\pndec\pnstart1\pnindent720\pnhang {\pntxta .}}{\*\pnseclvl4\pnlcltr\pnstart1\pnindent720\pnhang {\pntxta )}}{\*\pnseclvl5\pndec\pnstart1\pnindent720\pnhang {\pntxtb (}{\pntxta )}}{\*\pnseclvl6\pnlcltr\pnstart1\pnindent720\pnhang {\pntxtb (}{\pntxta )}}
+{\*\pnseclvl7\pnlcrm\pnstart1\pnindent720\pnhang {\pntxtb (}{\pntxta )}}{\*\pnseclvl8\pnlcltr\pnstart1\pnindent720\pnhang {\pntxtb (}{\pntxta )}}{\*\pnseclvl9\pnlcrm\pnstart1\pnindent720\pnhang {\pntxtb (}{\pntxta )}}\pard\plain 
+\ql \li0\ri0\widctlpar\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid163671 \fs24\lang2057\langfe2057\cgrid\langnp2057\langfenp2057 {\cs16\super\insrsid4263288 \chftn {\prtdata0 616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161
 61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616
 16161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161
 61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616
 16161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161
 61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616
 16161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161}}{\insrsid13791612\char
 rsid163671 
+\par }}
diff --git a/sw/qa/core/filters-test.cxx b/sw/qa/core/filters-test.cxx
index 85cfb3e..93b50b6 100644
--- a/sw/qa/core/filters-test.cxx
+++ b/sw/qa/core/filters-test.cxx
@@ -133,6 +133,11 @@ void FiltersTest::testCVEs()
 
     bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("Rich Text Format")),
         rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("RTF")),
+        m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2007-0245-1.rtf")));
+    CPPUNIT_ASSERT_MESSAGE("CVE-2007-0245 regression", bResult == true);
+
+    bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("Rich Text Format")),
+        rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("RTF")),
         m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2010-3451-1.rtf")));
     CPPUNIT_ASSERT_MESSAGE("CVE-2010-3451 regression", bResult == false);
 
commit aa1b83ea3077dd7b75053259a8b1eade45880c0e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Mar 4 15:03:04 2011 +0000

    regression test for CVE-2010-3452

diff --git a/sw/qa/core/CVE/CVE-2010-3452-1.rtf b/sw/qa/core/CVE/CVE-2010-3452-1.rtf
new file mode 100644
index 0000000..b2800b5
--- /dev/null
+++ b/sw/qa/core/CVE/CVE-2010-3452-1.rtf
@@ -0,0 +1 @@
+{\rtf1\ansi{\*\pnseclvlÿ}}
diff --git a/sw/qa/core/filters-test.cxx b/sw/qa/core/filters-test.cxx
index 98edaee..85cfb3e 100644
--- a/sw/qa/core/filters-test.cxx
+++ b/sw/qa/core/filters-test.cxx
@@ -136,6 +136,11 @@ void FiltersTest::testCVEs()
         m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2010-3451-1.rtf")));
     CPPUNIT_ASSERT_MESSAGE("CVE-2010-3451 regression", bResult == false);
 
+    bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("Rich Text Format")),
+        rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("RTF")),
+        m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2010-3452-1.rtf")));
+    CPPUNIT_ASSERT_MESSAGE("CVE-2010-3452 regression", bResult == true);
+
     bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("MS Word 97")),
         rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("CWW8")),
         m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2010-3453-1.doc")));
commit f488a0275f6d95b929aae2a8c885ed188512da00
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Mar 4 15:00:48 2011 +0000

    make this more robust

diff --git a/sw/source/core/docnode/ndtbl.cxx b/sw/source/core/docnode/ndtbl.cxx
index f26304c..00c0571 100644
--- a/sw/source/core/docnode/ndtbl.cxx
+++ b/sw/source/core/docnode/ndtbl.cxx
@@ -256,9 +256,12 @@ BOOL SwNodes::InsBoxen( SwTableNode* pTblNd,
                             pLine->GetTabBoxes()[ nInsPos ] )))
                 pPrvBox = pLine->FindPreviousBox( pTblNd->GetTable() );
         }
-        else if( 0 == ( pNxtBox = pLine->FindNextBox( pTblNd->GetTable(),
-                            pLine->GetTabBoxes()[ nInsPos-1 ] )))
+        else
+        {
+            if( 0 == (pNxtBox = pLine->FindNextBox( pTblNd->GetTable(),
+                            pLine->GetTabBoxes()[ pLine->GetTabBoxes().Count()-1 ] )))
                 pNxtBox = pLine->FindNextBox( pTblNd->GetTable() );
+        }
     }
     else if( 0 == ( pNxtBox = pLine->FindNextBox( pTblNd->GetTable() )))
         pPrvBox = pLine->FindPreviousBox( pTblNd->GetTable() );
commit ab2c3ff76598d61bf52f82ff9f4337458a9b969f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Mar 4 14:53:36 2011 +0000

    add regression test for CVE-2010-3453

diff --git a/sw/qa/core/CVE/CVE-2010-3453-1.doc b/sw/qa/core/CVE/CVE-2010-3453-1.doc
new file mode 100644
index 0000000..22cd8ee
Binary files /dev/null and b/sw/qa/core/CVE/CVE-2010-3453-1.doc differ
diff --git a/sw/qa/core/filters-test.cxx b/sw/qa/core/filters-test.cxx
index 1e09a05..98edaee 100644
--- a/sw/qa/core/filters-test.cxx
+++ b/sw/qa/core/filters-test.cxx
@@ -138,6 +138,11 @@ void FiltersTest::testCVEs()
 
     bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("MS Word 97")),
         rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("CWW8")),
+        m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2010-3453-1.doc")));
+    CPPUNIT_ASSERT_MESSAGE("CVE-2010-3453 regression", bResult == true);
+
+    bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("MS Word 97")),
+        rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("CWW8")),
         m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2010-3454-1.doc")));
     CPPUNIT_ASSERT_MESSAGE("CVE-2010-3454 regression", bResult == true);
 #endif


More information about the Libreoffice-commits mailing list