Sat Oct 19 14:33:05 PDT 2013

Rebased ref, commits from common ancestor:
commit b96c44689a6a8c388ee6e7958192d3939aa98dc5
Author: Lionel Elie Mamane <lionel at mamane.lu>
Date:   Sat Oct 19 22:57:40 2013 +0200

    fdo#70496 revert to using libmysqlclient
    
    Change-Id: I5b98b5e7840e4f1c6005aee0c1f43ef814ecf77b

diff --git a/config_host.mk.in b/config_host.mk.in
index 9268c7b..175bab3 100644
--- a/config_host.mk.in
+++ b/config_host.mk.in
@@ -322,6 +322,9 @@ export MARIADBC_MICRO=@MARIADBC_MICRO@
 export MARIADBC_MINOR=@MARIADBC_MINOR@
 export MARIADB_CFLAGS=$(gb_SPACE)@MARIADB_CFLAGS@
 export MARIADB_LIBS=$(gb_SPACE)@MARIADB_LIBS@
+export LIBMARIADB=@LIBMARIADB@
+export LIBMARIADB_PATH=@LIBMARIADB_PATH@
+export BUNDLE_MARIADB=@BUNDLE_MARIADB@
 export MD5SUM=@MD5SUM@
 export MDDS_CPPFLAGS=$(gb_SPACE)@MDDS_CPPFLAGS@
 export MERGELIBS=@MERGELIBS@
diff --git a/configure.ac b/configure.ac
index 4084f3a..fc52cb1 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1399,6 +1399,11 @@ AC_ARG_WITH(system-mariadb,
          extension.]),,
     [with_system_mariadb="$with_system_libs"])
 
+AC_ARG_ENABLE(bundle-mariadb,
+    AS_HELP_STRING([--enable-bundle-mariadb],
+        [When using MariaDB/MySQL libraries already on system, bundle them with the MariaDB Connector/LibreOffice extension.])
+)
+
 AC_ARG_WITH(system-mysql-cppconn,
     AS_HELP_STRING([--with-system-mysql-cppconn],
         [Use MySQL C++ Connector libraries already on system.]),,
@@ -7631,11 +7636,12 @@ if test "$ENABLE_MARIADBC" = "YES"; then
     if test "$with_system_mariadb" = "yes"; then
         AC_MSG_RESULT([external])
         SYSTEM_MARIADB=YES
-        AC_PATH_PROG(MARIADBCONFIG, [mariadb_config])
+        #AC_PATH_PROG(MARIADBCONFIG, [mariadb_config])
         if test -z "$MARIADBCONFIG"; then
             AC_PATH_PROG(MARIADBCONFIG, [mysql_config])
             if test -z "$MARIADBCONFIG"; then
-                AC_MSG_ERROR([mariadb_config and mysql_config are missing. Install MariaDB or MySQL package.])
+                #AC_MSG_ERROR([mariadb_config and mysql_config are missing. Install MariaDB or MySQL package.])
+                AC_MSG_ERROR([mysql_config is missing. Install MySQL client library development package.])
             fi
         fi
         AC_MSG_CHECKING([MariaDB version])
@@ -7648,10 +7654,36 @@ if test "$ENABLE_MARIADBC" = "YES"; then
         fi
         AC_MSG_CHECKING([for MariaDB Client library])
         MARIADB_CFLAGS=`$MARIADBCONFIG --cflags`
-        MARIADB_LIBS=`$MARIADBCONFIG --libs`
-        AC_MSG_RESULT([includes $MARIADB_CFLAGS, libraries $MARIADB_LIBS])
+        MARIADB_LIBS=`$MARIADBCONFIG --libs_r`
+        AC_MSG_RESULT([includes '$MARIADB_CFLAGS', libraries '$MARIADB_LIBS'])
+        AC_MSG_CHECKING([whether to bundle the MySQL/MariaDB client library])
+        if test "$enable_bundle_mariadb" = "yes"; then
+            AC_MSG_RESULT([yes])
+            BUNDLE_MARIADB=YES
+            LIBMARIADB=lib$(echo "${MARIADB_LIBS}" | sed -e 's/[[[:space:]]]\+-l/\n/g' | grep -E '(mysqlclient|mariadb)')
+            if test "$_os" = "Darwin"; then
+                LIBMARIADB=${LIBMARIADB}.dylib
+            elif test "$_os" = "WINNT"; then
+                LIBMARIADB=${LIBMARIADB}.dll
+            else
+                LIBMARIADB=${LIBMARIADB}.so
+            fi
+            LIBMARIADB_PATH=$($MARIADBCONFIG --variable=pkglibdir)
+            AC_MSG_CHECKING([for $LIBMARIADB in $LIBMARIADB_PATH])
+            if test -e "$LIBMARIADB_PATH/$LIBMARIADB"; then
+                AC_MSG_RESULT([found.])
+                PathFormat "$LIBMARIADB_PATH"
+                LIBMARIADB_PATH="$formatted_path"
+            else
+                AC_MSG_ERROR([not found.])
+            fi
+        else
+            AC_MSG_RESULT([no])
+            BUNDLE_MARIADB=NO
+        fi
     else
         AC_MSG_RESULT([internal])
+        AC_MSG_ERROR([libmariadb is known to be broken as of 2013-10; use libmysqlclient])
         SYSTEM_MARIADB=NO
         MARIADB_CFLAGS="-I${WORKDIR}/UnpackedTarball/mariadb/include"
         MARIADB_LIBS="-L${OUTDIR}/lib -lmariadblib"
@@ -7661,6 +7693,9 @@ if test "$ENABLE_MARIADBC" = "YES"; then
     AC_SUBST(SYSTEM_MARIADB)
     AC_SUBST(MARIADB_CFLAGS)
     AC_SUBST(MARIADB_LIBS)
+    AC_SUBST(LIBMARIADB)
+    AC_SUBST(LIBMARIADB_PATH)
+    AC_SUBST(BUNDLE_MARIADB)
 
     AC_LANG_PUSH([C++])
     dnl ===================================================================
diff --git a/mysqlc/Extension_mysql-connector-ooo.mk b/mysqlc/Extension_mysql-connector-ooo.mk
index 810ede5..d949057 100644
--- a/mysqlc/Extension_mysql-connector-ooo.mk
+++ b/mysqlc/Extension_mysql-connector-ooo.mk
@@ -26,4 +26,10 @@ ifeq ($(SYSTEM_MYSQL_CPPCONN),NO)
 $(eval $(call gb_Extension_add_library,mysql-connector-ooo,mysqlcppconn))
 endif
 
+ifeq ($(BUNDLE_MARIADB),YES)
+$(eval $(call gb_Extension_add_files,mysql-connector-ooo,,\
+       $(LIBMARIADB_PATH)/$(LIBMARIADB) \
+))
+endif
+
 # vim: set noet sw=4 ts=4:
diff --git a/mysqlc/Library_mysqlc.mk b/mysqlc/Library_mysqlc.mk
index 72787fc..00c35e3 100644
--- a/mysqlc/Library_mysqlc.mk
+++ b/mysqlc/Library_mysqlc.mk
@@ -42,6 +42,8 @@ $(eval $(call gb_Library_add_defs,mysqlc,\
 	-DMARIADBC_VERSION_MICRO=$(MARIADBC_MICRO) \
 	$(if $(filter NO,$(SYSTEM_MYSQL_CPPCONN)),\
 	-DCPPCONN_LIB=\"$(call gb_Library_get_runtime_filename,mysqlcppconn)\") \
+	$(if $(filter YES,$(BUNDLE_MARIADB)),\
+	-DBUNDLE_MARIADB=\"$(LIBMARIADB)\") \
 ))
 
 $(eval $(call gb_Library_add_exception_objects,mysqlc,\
diff --git a/mysqlc/source/mysqlc_driver.cxx b/mysqlc/source/mysqlc_driver.cxx
index 7a6a326..cbd956f 100644
--- a/mysqlc/source/mysqlc_driver.cxx
+++ b/mysqlc/source/mysqlc_driver.cxx
@@ -143,9 +143,30 @@ void MysqlCDriver::impl_initCppConn_lck_throw()
 #ifdef SYSTEM_MYSQL_CPPCONN
     cppDriver = get_driver_instance();
 #else
+#ifdef BUNDLE_MARIADB
+    if ( !m_bAttemptedLoadCConn )
+    {
+        const OUString sModuleName(BUNDLE_MARIADB);
+        m_hCConnModule = osl_loadModuleRelative( &thisModule, sModuleName.pData, 0 );
+        m_bAttemptedLoadCConn = true;
+    }
+
+    // attempted to load - was it successful?
+    if ( !m_hCConnModule )
+    {
+        OSL_FAIL( "MysqlCDriver::impl_initCppConn_lck_throw: could not load the " BUNDLE_MARIADB " library!");
+        throw SQLException(
+            OUString( "Unable to load the " BUNDLE_MARIADB " library."  ),
+            *this,
+            OUString( "08001"  ),  // "unable to connect"
+            0,
+            Any()
+        );
+    }
+#endif
     if ( !m_bAttemptedLoadCppConn )
     {
-        const OUString sModuleName(CPPCONN_LIB );
+        const OUString sModuleName(CPPCONN_LIB);
         m_hCppConnModule = osl_loadModuleRelative( &thisModule, sModuleName.pData, 0 );
         m_bAttemptedLoadCppConn = true;
     }
diff --git a/mysqlc/source/mysqlc_driver.hxx b/mysqlc/source/mysqlc_driver.hxx
index 0c14e8a..d63ed05 100644
--- a/mysqlc/source/mysqlc_driver.hxx
+++ b/mysqlc/source/mysqlc_driver.hxx
@@ -63,6 +63,10 @@ namespace connectivity
                                             // of all the Connection objects
                                             // for this Driver
 #ifndef SYSTEM_MYSQL_CPPCONN
+#ifdef BUNDLE_MARIADB
+            oslModule       m_hCConnModule;
+            bool            m_bAttemptedLoadCConn;
+#endif
             oslModule       m_hCppConnModule;
             bool            m_bAttemptedLoadCppConn;
 #endif
diff --git a/mysqlcppconn/Library_mysqlcppconn.mk b/mysqlcppconn/Library_mysqlcppconn.mk
index adebc5b..eccc521 100644
--- a/mysqlcppconn/Library_mysqlcppconn.mk
+++ b/mysqlcppconn/Library_mysqlcppconn.mk
@@ -12,7 +12,6 @@ $(eval $(call gb_Library_Library,mysqlcppconn))
 $(eval $(call gb_Library_use_unpacked,mysqlcppconn,mysqlcppconn))
 
 $(eval $(call gb_Library_use_externals,mysqlcppconn, \
-	mysql \
 	boost_headers \
 	mariadb \
 ))
commit 757f4dd74ad9bfd6e17a0f51f91c83cc3eff65b0
Author: Lionel Elie Mamane <lionel at mamane.lu>
Date:   Mon Oct 14 17:59:10 2013 +0200

    fdo#68657 bool->string conversion to 1/0, not "true"/"false
    
    This matches what OO.org / older versions of LibreOffice did, and which was inadvertently changed in 2bd856e6
    
    Change-Id: I1d45ea975a096c599a996caafc41e4aa06d35fcd

diff --git a/connectivity/source/commontools/FValue.cxx b/connectivity/source/commontools/FValue.cxx
index 770b34e..0dd208c 100644
--- a/connectivity/source/commontools/FValue.cxx
+++ b/connectivity/source/commontools/FValue.cxx
@@ -27,6 +27,8 @@
 #include <com/sun/star/io/XInputStream.hpp>
 #include <rtl/ustrbuf.hxx>
 #include <rtl/logfile.hxx>
+#include <boost/type_traits.hpp>
+#include <boost/static_assert.hpp>
 
 using namespace ::dbtools;
 using namespace ::com::sun::star::sdbc;
@@ -1007,7 +1009,12 @@ OUString ORowSetValue::getString( ) const
                 break;
             case DataType::BIT:
             case DataType::BOOLEAN:
-                aRet = OUString::boolean(static_cast<bool>(*this));
+                // This would be the natural choice,
+                // but historically it was converted to "0" or "1".
+                // For backwards compatibility, continue doing that.
+                // aRet = OUString::boolean(static_cast<bool>(*this));
+                BOOST_STATIC_ASSERT((boost::is_same< sal_Bool, sal_uInt8 >::value));
+                aRet = OUString::number(static_cast<sal_Bool>(*this));
                 break;
             case DataType::TINYINT:
             case DataType::SMALLINT:
commit f295f47b1549a39c0113f4ca3eb0d8bb14844cac
Author: David Tardon <dtardon at redhat.com>
Date:   Fri Oct 18 10:52:04 2013 +0200

    fdo#70480 do not crash reading malformed zip
    
    Change-Id: Ibbdf7ce4979f8452c4a662cc9ae3f598cce23126
    (cherry picked from commit f2422ab90d92104915b93e96f647a89bbf55ad30)
    Signed-off-by: David Tardon <dtardon at redhat.com>
    Reviewed-on: https://gerrit.libreoffice.org/6313
    Reviewed-by: CaolÃ¡n McNamara <caolanm at redhat.com>
    Tested-by: CaolÃ¡n McNamara <caolanm at redhat.com>

diff --git a/libvisio/0001-fdo-70480-do-not-crash-reading-malformed-zip.patch b/libvisio/0001-fdo-70480-do-not-crash-reading-malformed-zip.patch
new file mode 100644
index 0000000..6c7135f
--- /dev/null
+++ b/libvisio/0001-fdo-70480-do-not-crash-reading-malformed-zip.patch
@@ -0,0 +1,26 @@
+From 410f564d9a728b983cf11ba9b3eadfc7d59c187c Mon Sep 17 00:00:00 2001
+From: David Tardon <dtardon at redhat.com>
+Date: Thu, 17 Oct 2013 10:35:34 +0200
+Subject: [PATCH] fdo#70480 do not crash reading malformed zip
+
+Change-Id: Ia37e8be5172a49669cb9f7271c5401ca88f39072
+---
+ src/lib/VSDZipStream.cpp | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/lib/VSDZipStream.cpp b/src/lib/VSDZipStream.cpp
+index 3b3e08a..1c12d56 100644
+--- a/src/lib/VSDZipStream.cpp
++++ b/src/lib/VSDZipStream.cpp
+@@ -203,6 +203,8 @@ bool libvisio::VSDZipStreamImpl::isZipStream()
+     return false;
+   if (!readCentralDirectory(end))
+     return false;
++  if (m_cdir.empty())
++    return false;
+   CentralDirectoryEntry entry = m_cdir.begin()->second;
+   m_input->seek(entry.offset, WPX_SEEK_SET);
+   LocalFileHeader header;
+-- 
+1.8.3.1
+
diff --git a/libvisio/UnpackedTarball_libvisio.mk b/libvisio/UnpackedTarball_libvisio.mk
index e4c0561..c2a2000 100644
--- a/libvisio/UnpackedTarball_libvisio.mk
+++ b/libvisio/UnpackedTarball_libvisio.mk
@@ -11,4 +11,10 @@ $(eval $(call gb_UnpackedTarball_UnpackedTarball,libvisio))
 
 $(eval $(call gb_UnpackedTarball_set_tarball,libvisio,$(VISIO_TARBALL)))
 
+$(eval $(call gb_UnpackedTarball_set_patchlevel,libvisio,1))
+
+$(eval $(call gb_UnpackedTarball_add_patches,libvisio,\
+	libvisio/0001-fdo-70480-do-not-crash-reading-malformed-zip.patch \
+))
+
 # vim: set noet sw=4 ts=4:
commit 01c3253c8e28f6be7f2cc31a6c5e97a19b7eeeba
Author: Tor Lillqvist <tml at collabora.com>
Date:   Tue Oct 15 18:53:34 2013 +0300

    Fix build against the 10.8 SDK
    
    Change-Id: I74adcca901e9a7c31d02779b1ee853731a55ea43
    Reviewed-on: https://gerrit.libreoffice.org/6253
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/vcl/Library_vcl.mk b/vcl/Library_vcl.mk
index 4e3df9b..ad59af9 100644
--- a/vcl/Library_vcl.mk
+++ b/vcl/Library_vcl.mk
@@ -370,6 +370,11 @@ $(eval $(call gb_Library_add_exception_objects,vcl,\
     $(vcl_coretext_code) \
 ))
 
+ifeq ($(MACOSX_SDK_VERSION),1080)
+$(eval $(call gb_Library_use_system_darwin_frameworks,vcl,\
+	ApplicationServices \
+))
+else
 ifeq ($(MACOSX_SDK_VERSION),1070)
 $(eval $(call gb_Library_use_system_darwin_frameworks,vcl,\
 	ApplicationServices \
@@ -385,6 +390,7 @@ $(eval $(call gb_Library_use_system_darwin_frameworks,vcl,\
 ))
 endif
 endif
+endif
 
 else # ATSUI
 
commit 5f13aa4eae758e6592b73b3de3a62a5d94c45a9f
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Thu Oct 17 18:01:47 2013 +0200

    fdo#70319 "exponent followed by at least on digit" also for special case 0.0
    
    Change-Id: I07e7917417b8a22cf6d64f2b7a447f9084b9fa2d
    (cherry picked from commit 7bbd58eafc3146abcefc73d2d1ca6869bb47ef5a)
    Reviewed-on: https://gerrit.libreoffice.org/6294
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>

diff --git a/sal/qa/rtl/math/test-rtl-math.cxx b/sal/qa/rtl/math/test-rtl-math.cxx
index 3ebdb15..c0ccaaa 100644
--- a/sal/qa/rtl/math/test-rtl-math.cxx
+++ b/sal/qa/rtl/math/test-rtl-math.cxx
@@ -81,6 +81,12 @@ public:
         CPPUNIT_ASSERT_EQUAL(rtl_math_ConversionStatus_Ok, status);
         CPPUNIT_ASSERT_EQUAL(sal_Int32(RTL_CONSTASCII_LENGTH("1")), end);
         CPPUNIT_ASSERT_EQUAL(1.0, res);
+        res = rtl::math::stringToDouble(
+            rtl::OUString("0e"),
+            sal_Unicode('.'), sal_Unicode(','), &status, &end);
+        CPPUNIT_ASSERT_EQUAL(rtl_math_ConversionStatus_Ok, status);
+        CPPUNIT_ASSERT_EQUAL(sal_Int32(RTL_CONSTASCII_LENGTH("1")), end);
+        CPPUNIT_ASSERT_EQUAL(0.0, res);
     }
 
     CPPUNIT_TEST_SUITE(Test);
diff --git a/sal/rtl/math.cxx b/sal/rtl/math.cxx
index f66039a..3bca171 100644
--- a/sal/rtl/math.cxx
+++ b/sal/rtl/math.cxx
@@ -819,6 +819,10 @@ inline double stringToDouble(CharT const * pBegin, CharT const * pEnd,
                 // offset
                 while (p != pEnd && rtl::isAsciiDigit(*p))
                     ++p;
+                if (p == pFirstExpDigit)
+                {   // no digits in exponent, reset end of scan
+                    p = pExponent;
+                }
             }
             else
             {
commit 8a955a1f86c4578d4d0442baee7bbf4b6e37175a
Author: Eike Rathke <erack at redhat.com>
Date:   Wed Oct 16 16:10:46 2013 +0200

    Resolves: rhbz#1015594 CVE-2013-2924 use-after-free
    
    Added icu.10318.CVE-2013-2924_changeset_34076.patch from
    https://ssl.icu-project.org/trac/changeset/34076 assigned to
    https://ssl.icu-project.org/trac/ticket/10318
    
    Change-Id: I93a33e59aec9b79fb8d4b1517cd0990c79ee65fb
    (cherry picked from commit 7693a4b9fbb60105d8438465db51c7afef4c3eb1)
    Reviewed-on: https://gerrit.libreoffice.org/6268
    Reviewed-by: CaolÃ¡n McNamara <caolanm at redhat.com>
    Tested-by: CaolÃ¡n McNamara <caolanm at redhat.com>

diff --git a/icu/UnpackedTarball_icu.mk b/icu/UnpackedTarball_icu.mk
index 3e084a9..cb01378 100644
--- a/icu/UnpackedTarball_icu.mk
+++ b/icu/UnpackedTarball_icu.mk
@@ -18,6 +18,7 @@ $(eval $(call gb_UnpackedTarball_set_pre_action,icu,\
 ))
 
 $(eval $(call gb_UnpackedTarball_add_patches,icu,\
+	icu/icu4c.10318.CVE-2013-2924_changeset_34076.patch \
 	icu/icu4c.10129.wintz.patch \
 	icu/icu4c.9948.mlym-crash.patch \
 	icu/icu4c-build.patch \
diff --git a/icu/icu4c.10318.CVE-2013-2924_changeset_34076.patch b/icu/icu4c.10318.CVE-2013-2924_changeset_34076.patch
new file mode 100644
index 0000000..90f50ab
--- /dev/null
+++ b/icu/icu4c.10318.CVE-2013-2924_changeset_34076.patch
@@ -0,0 +1,36 @@
+Index: /icu/trunk/source/i18n/csrucode.cpp
+===================================================================
+--- a/orig.icu/source/i18n/csrucode.cpp	(revision 34075)
++++ b/icu/source/i18n/csrucode.cpp	(revision 34076)
+@@ -1,5 +1,5 @@
+ /*
+  **********************************************************************
+- *   Copyright (C) 2005-2012, International Business Machines
++ *   Copyright (C) 2005-2013, International Business Machines
+  *   Corporation and others.  All Rights Reserved.
+  **********************************************************************
+@@ -34,6 +34,7 @@
+     const uint8_t *input = textIn->fRawInput;
+     int32_t confidence = 0;
++    int32_t length = textIn->fRawLength;
+ 
+-    if (input[0] == 0xFE && input[1] == 0xFF) {
++    if (length >=2 && input[0] == 0xFE && input[1] == 0xFF) {
+         confidence = 100;
+     }
+@@ -58,6 +59,7 @@
+     const uint8_t *input = textIn->fRawInput;
+     int32_t confidence = 0;
++    int32_t length = textIn->fRawLength;
+ 
+-    if (input[0] == 0xFF && input[1] == 0xFE && (input[2] != 0x00 || input[3] != 0x00)) {
++    if (length >= 4 && input[0] == 0xFF && input[1] == 0xFE && (input[2] != 0x00 || input[3] != 0x00)) {
+         confidence = 100;
+     }
+@@ -82,5 +84,5 @@
+     int32_t confidence = 0;
+ 
+-    if (getChar(input, 0) == 0x0000FEFFUL) {
++    if (limit > 0 && getChar(input, 0) == 0x0000FEFFUL) {
+         hasBOM = TRUE;
+     }
commit 3dac8f65123aa6046e0e94c98faf0e9708a8cc98
Author: Andras Timar <andras.timar at collabora.com>
Date:   Wed Oct 16 09:29:56 2013 +0200

    fdo#69548 do not remove last space from hyperlink target
    
    Change-Id: Ia56a4012590cc56b3beaa887cbbb91318a0977b1
    Reviewed-on: https://gerrit.libreoffice.org/6263
    Reviewed-by: CaolÃ¡n McNamara <caolanm at redhat.com>
    Tested-by: CaolÃ¡n McNamara <caolanm at redhat.com>

diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index 5bd4e62..45cc5fe 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -2155,14 +2155,10 @@ void FieldContext::AppendCommand(const OUString& rPart)
 
         if (bInString)
         {
-            if (bInStringNext)
-            {
-                sPart += OUString(' ');
-                sPart += sToken;
-            }
-            else
+            sPart += OUString(' ');
+            sPart += sToken;
+            if (!bInStringNext)
             {
-                sPart += sToken;
                 aResult.push_back(sPart);
             }
         }
commit e09cfff67b021efd04235987f9c27cea3da5c72b
Author: Mathieu Parent <mathieu.parent at nantesmetropole.fr>
Date:   Mon Oct 14 22:23:05 2013 +0100

    fdo#56007 - Read more bytes on Zip read (for thumbnails)
    
    Change-Id: Ia8c6caa44ed8019a8139beb5a855f0f28805544d
    Signed-off-by: Andras Timar <andras.timar at collabora.com>

diff --git a/shell/source/win32/zipfile/zipfile.cxx b/shell/source/win32/zipfile/zipfile.cxx
index cf05a56..270fbe1 100644
--- a/shell/source/win32/zipfile/zipfile.cxx
+++ b/shell/source/win32/zipfile/zipfile.cxx
@@ -118,18 +118,42 @@ static unsigned char readByte(StreamInterface *stream)
 
 static unsigned short readShort(StreamInterface *stream)
 {
-    unsigned short p0 = (unsigned short)readByte(stream);
-    unsigned short p1 = (unsigned short)readByte(stream);
-    return (unsigned short)(p0|(p1<<8));
+    if (!stream || stream->stell() == -1)
+        throw IOException(-1);
+    unsigned short tmpBuf;
+    unsigned long numBytesRead = stream->sread(
+        reinterpret_cast<unsigned char *>( &tmpBuf ), 2);
+    if (numBytesRead != 2)
+        throw IOException(-1);
+    return tmpBuf;
 }
 
 static unsigned readInt(StreamInterface *stream)
 {
-    unsigned p0 = (unsigned)readByte(stream);
-    unsigned p1 = (unsigned)readByte(stream);
-    unsigned p2 = (unsigned)readByte(stream);
-    unsigned p3 = (unsigned)readByte(stream);
-    return (unsigned)(p0|(p1<<8)|(p2<<16)|(p3<<24));
+    if (!stream || stream->stell() == -1)
+        throw IOException(-1);
+    unsigned tmpBuf;
+    unsigned long numBytesRead = stream->sread(
+        reinterpret_cast<unsigned char *>( &tmpBuf ), 4);
+    if (numBytesRead != 4)
+        throw IOException(-1);
+    return tmpBuf;
+}
+
+static std::string readString(StreamInterface *stream, unsigned long size)
+{
+    if (!stream || stream->stell() == -1)
+        throw IOException(-1);
+    unsigned char *tmp = new unsigned char[size];
+    if (!tmp)
+        throw IOException(-1);
+    unsigned long numBytesRead = stream->sread(tmp, size);
+    if (numBytesRead != size)
+        throw IOException(-1);
+
+    std::string aStr((char *)tmp, size);
+    delete [] tmp;
+    return aStr;
 }
 
 static bool readCentralDirectoryEnd(StreamInterface *stream, CentralDirectoryEnd &end)
@@ -147,9 +171,7 @@ static bool readCentralDirectoryEnd(StreamInterface *stream, CentralDirectoryEnd
         end.cdir_size = readInt(stream);
         end.cdir_offset = readInt(stream);
         end.comment_size = readShort(stream);
-        end.comment.clear();
-        for (unsigned short i = 0; i < end.comment_size; i++)
-            end.comment.append(1,(char)readByte(stream));
+        end.comment.assign(readString(stream, end.comment_size));
     }
     catch (...)
     {
@@ -183,15 +205,9 @@ static bool readCentralDirectoryEntry(StreamInterface *stream, CentralDirectoryE
         entry.external_attr = readInt(stream);
         entry.offset = readInt(stream);
         unsigned short i = 0;
-        entry.filename.clear();
-        for (i=0; i < entry.filename_size; i++)
-            entry.filename.append(1,(char)readByte(stream));
-        entry.extra_field.clear();
-        for (i=0; i < entry.extra_field_size; i++)
-            entry.extra_field.append(1,(char)readByte(stream));
-        entry.file_comment.clear();
-        for (i=0; i < entry.file_comment_size; i++)
-            entry.file_comment.append(1,(char)readByte(stream));
+        entry.filename.assign(readString(stream, entry.filename_size));
+        entry.extra_field.assign(readString(stream, entry.extra_field_size));
+        entry.file_comment.assign(readString(stream, entry.file_comment_size));
     }
     catch (...)
     {
@@ -219,12 +235,8 @@ static bool readLocalFileHeader(StreamInterface *stream, LocalFileHeader &header
         header.filename_size = readShort(stream);
         header.extra_field_size = readShort(stream);
         unsigned short i = 0;
-        header.filename.clear();
-        for (i=0; i < header.filename_size; i++)
-            header.filename.append(1,(char)readByte(stream));
-        header.extra_field.clear();
-        for (i=0; i < header.extra_field_size; i++)
-            header.extra_field.append(1,(char)readByte(stream));
+        header.filename.assign(readString(stream, header.filename_size));
+        header.extra_field.assign(readString(stream, header.extra_field_size));
     }
     catch (...)
     {
commit 0540be231b0a10ed97da911462874a329bd089f7
Author: Michael Meeks <michael.meeks at collabora.com>
Date:   Fri Oct 11 17:43:19 2013 +0100

    fdo#56007 - fast zip directory find to accelerate Windows Explorer thumbnail.
    
    Change-Id: Id9436def56f40d2bb54dea35bea916bd99964653
    Signed-off-by: Andras Timar <andras.timar at collabora.com>

diff --git a/shell/source/win32/zipfile/zipfile.cxx b/shell/source/win32/zipfile/zipfile.cxx
index fb7dc88..cf05a56 100644
--- a/shell/source/win32/zipfile/zipfile.cxx
+++ b/shell/source/win32/zipfile/zipfile.cxx
@@ -102,6 +102,9 @@ struct CentralDirectoryEnd
 #define LOC_FILE_HEADER_SIG 0x04034b50
 #define CDIR_END_SIG 0x06054b50
 
+// This little lot performs in a truly appalling way without
+// buffering eg. on an IStream.
+
 static unsigned char readByte(StreamInterface *stream)
 {
     if (!stream || stream->stell() == -1)
@@ -250,31 +253,57 @@ static bool areHeadersConsistent(const LocalFileHeader &header, const CentralDir
     return true;
 }
 
+#define BLOCK_SIZE 0x800
+
+static bool findSignatureAtOffset(StreamInterface *stream, unsigned long nOffset)
+{
+    // read in reasonably sized chunk, and read more, to get overlapping sigs
+    unsigned char aBuffer[ BLOCK_SIZE + 4 ];
+
+    stream->sseek(nOffset, SEEK_SET);
+
+    unsigned long nBytesRead = stream->sread(aBuffer, sizeof(aBuffer));
+    if (nBytesRead < 0)
+        return false;
+
+    for (long n = nBytesRead - 4; n >= 0; n--)
+    {
+        if (aBuffer[n  ] == 0x50 && aBuffer[n+1] == 0x4b &&
+            aBuffer[n+2] == 0x05 && aBuffer[n+3] == 0x06)
+        { // a palpable hit ...
+            stream->sseek(nOffset + n, SEEK_SET);
+            return true;
+        }
+    }
+
+    return false;
+}
+
 static bool findCentralDirectoryEnd(StreamInterface *stream)
 {
     if (!stream)
         return false;
-    stream->sseek(0, SEEK_SET);
-    if (stream->sseek(-1024, SEEK_END)) stream->sseek(0, SEEK_SET);
+
+    stream->sseek(0,SEEK_END);
+
+    long nLength = stream->stell();
+    if (nLength == -1)
+        return false;
+
     try
     {
-        while (stream->stell() != -1)
+        for (long nOffset = nLength - BLOCK_SIZE;
+             nOffset > 0; nOffset -= BLOCK_SIZE)
         {
-            unsigned signature = readInt(stream);
-            if (signature == CDIR_END_SIG)
-            {
-                stream->sseek(-4, SEEK_CUR);
+            if (findSignatureAtOffset(stream, nOffset))
                 return true;
-            }
-            else
-                stream->sseek(-3, SEEK_CUR);
         }
+        return findSignatureAtOffset(stream, 0);
     }
     catch (...)
     {
         return false;
     }
-    return false;
 }
 
 static bool isZipStream(StreamInterface *stream)
commit d8b9d9e84ef2e18bda11d51f6c9eb1fe4f1fb791
Author: Eike Rathke <erack at redhat.com>
Date:   Mon Oct 14 14:55:23 2013 +0200

    resolved fdo#70319 exponent must be followed by at least one digit
    
    (cherry picked from commit f20feba4c43c34fd2ee05b4658b0de0248c08eb9)
    
    work around crappy SbiScanner::NextSym(), fdo#70319
    
    just to make test not fail that was wrong anyway
    
    (cherry picked from commit 472ad8ba7ef99982025b37aba562f2135ca8a999)
    
    Change-Id: Icdd22fa0f1efcdd18cfea7cb48e1cbf2cf8d3533
    Reviewed-on: https://gerrit.libreoffice.org/6241
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/basic/qa/cppunit/test_scanner.cxx b/basic/qa/cppunit/test_scanner.cxx
index 9c8d388..acf740fb 100644
--- a/basic/qa/cppunit/test_scanner.cxx
+++ b/basic/qa/cppunit/test_scanner.cxx
@@ -647,6 +647,8 @@ namespace
     CPPUNIT_ASSERT(symbols[1].text == cr);
     CPPUNIT_ASSERT(errors == 0);
 
+    /* FIXME: SbiScanner::NextSym() is total crap, the result of scanning
+     * "12e++3" should be something different than this.. */
     symbols = getSymbols(source12, errors);
     CPPUNIT_ASSERT(symbols.size() == 4);
     CPPUNIT_ASSERT(symbols[0].number == 12);
@@ -655,7 +657,7 @@ namespace
     CPPUNIT_ASSERT(symbols[2].number == 3);
     CPPUNIT_ASSERT(symbols[2].type == SbxINTEGER);
     CPPUNIT_ASSERT(symbols[3].text == cr);
-    CPPUNIT_ASSERT(errors == 0);
+    CPPUNIT_ASSERT(errors == 1);
 
     symbols = getSymbols(source13, errors);
     CPPUNIT_ASSERT(symbols.size() == 2);
diff --git a/sal/qa/rtl/math/test-rtl-math.cxx b/sal/qa/rtl/math/test-rtl-math.cxx
index c156c37..3ebdb15 100644
--- a/sal/qa/rtl/math/test-rtl-math.cxx
+++ b/sal/qa/rtl/math/test-rtl-math.cxx
@@ -72,9 +72,21 @@ public:
         CPPUNIT_ASSERT_EQUAL(0.0, res);
     }
 
+    void test_stringToDouble_exponent_without_digit() {
+        rtl_math_ConversionStatus status;
+        sal_Int32 end;
+        double res = rtl::math::stringToDouble(
+            rtl::OUString("1e"),
+            sal_Unicode('.'), sal_Unicode(','), &status, &end);
+        CPPUNIT_ASSERT_EQUAL(rtl_math_ConversionStatus_Ok, status);
+        CPPUNIT_ASSERT_EQUAL(sal_Int32(RTL_CONSTASCII_LENGTH("1")), end);
+        CPPUNIT_ASSERT_EQUAL(1.0, res);
+    }
+
     CPPUNIT_TEST_SUITE(Test);
     CPPUNIT_TEST(test_stringToDouble_good);
     CPPUNIT_TEST(test_stringToDouble_bad);
+    CPPUNIT_TEST(test_stringToDouble_exponent_without_digit);
     CPPUNIT_TEST_SUITE_END();
 };
 
diff --git a/sal/rtl/math.cxx b/sal/rtl/math.cxx
index 590ea0e..f66039a 100644
--- a/sal/rtl/math.cxx
+++ b/sal/rtl/math.cxx
@@ -799,6 +799,7 @@ inline double stringToDouble(CharT const * pBegin, CharT const * pEnd,
         // Exponent
         if (p != p0 && p != pEnd && (*p == CharT('E') || *p == CharT('e')))
         {
+            CharT const * const pExponent = p;
             ++p;
             bool bExpSign;
             if (p != pEnd && *p == CharT('-'))
@@ -812,6 +813,7 @@ inline double stringToDouble(CharT const * pBegin, CharT const * pEnd,
                 if (p != pEnd && *p == CharT('+'))
                     ++p;
             }
+            CharT const * const pFirstExpDigit = p;
             if ( fVal == 0.0 )
             {   // no matter what follows, zero stays zero, but carry on the
                 // offset
@@ -857,6 +859,10 @@ inline double stringToDouble(CharT const * pBegin, CharT const * pEnd,
                     else
                         fVal = rtl::math::pow10Exp( fVal, nExp );  // normal
                 }
+                else if (p == pFirstExpDigit)
+                {   // no digits in exponent, reset end of scan
+                    p = pExponent;
+                }
             }
         }
         else if (p - p0 == 2 && p != pEnd && p[0] == CharT('#')
commit 22e58528fed41b15d242eb9e85dc25c51ec01e4d
Author: CaolÃ¡n McNamara <caolanm at redhat.com>
Date:   Sat Oct 5 10:32:12 2013 +0100

    CID#736943 clamp no of ttc entries to physical max
    
    Change-Id: Ic63defe9c14c6ee2b86bd5b7730a570238ca3981
    (cherry picked from commit 225539ab08043b6937fdd67d9ae308ebd4104646)
    Reviewed-on: https://gerrit.libreoffice.org/6150
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/vcl/generic/fontmanager/fontmanager.cxx b/vcl/generic/fontmanager/fontmanager.cxx
index d3adb50..418f480 100644
--- a/vcl/generic/fontmanager/fontmanager.cxx
+++ b/vcl/generic/fontmanager/fontmanager.cxx
@@ -1175,6 +1175,39 @@ bool PrintFontManager::analyzeFontFile( int nDirID, const OString& rFontFile, ::
 #if OSL_DEBUG_LEVEL > 1
             fprintf( stderr, "ttc: %s contains %d fonts\n", aFullPath.getStr(), nLength );
 #endif
+
+            sal_uInt64 fileSize;
+
+            OUString aURL;
+            if (!osl::File::getFileURLFromSystemPath(OStringToOUString(aFullPath, osl_getThreadTextEncoding()),
+                aURL))
+            {
+                fileSize = 0;
+            }
+            else
+            {
+                osl::File aFile(aURL);
+                if (aFile.open(osl_File_OpenFlag_Read | osl_File_OpenFlag_NoLock) != osl::File::E_None)
+                    fileSize = 0;
+                else
+                {
+                    osl::DirectoryItem aItem;
+                    osl::DirectoryItem::get( aURL, aItem );
+                    osl::FileStatus aFileStatus( osl_FileStatus_Mask_FileSize );
+                    aItem.getFileStatus( aFileStatus );
+                    fileSize = aFileStatus.getFileSize();
+                }
+            }
+
+            //Feel free to calc the exact max possible number of fonts a file
+            //could contain given its physical size. But this will clamp it to
+            //a sane starting point
+            //http://processingjs.nihongoresources.com/the_smallest_font/
+            //https://github.com/grzegorzrolek/null-ttf
+            int nMaxFontsPossible = fileSize / 528;
+
+            nLength = std::min(nLength, nMaxFontsPossible);
+
             for( int i = 0; i < nLength; i++ )
             {
                 TrueTypeFontFile* pFont     = new TrueTypeFontFile();
commit a6e066e3aa1fdf0e9001e4721171b523ac39d8d8
Author: Michael Stahl <mstahl at redhat.com>
Date:   Sat Oct 12 01:54:37 2013 +0200

    sw: fix regex search/replace of $ in selection
    
    SwView::Replace() nowadays first searches for the to-be-replaced text in
    the current selection, which does not work in the corner case of "$"
    when the selection starts at end of a paragraph, as it will when
    clicking "Find" to look for "$" and then clicking "Replace".
    
    The problem is that there is some antique code in SwPaM::Find() to
    move the cursor forward if it's at the end of a paragraph, which is
    presumably some pointless micro-optimization; the result is that
    "Replace" does not replace the selected paragraph break but the
    one in the following paragraph.
    
    (regression from 68a014dbca8bbd25056f75ef551fb81a0dbfb1b7)
    
    Conflicts:
    	sw/source/core/crsr/findtxt.cxx
    
    (cherry picked from commit b60ce8465c8f01242354abccebe00742d164af60)
    
    Change-Id: I5aae9c272d102a48166c63e01775dc6322f9f02d
    Reviewed-on: https://gerrit.libreoffice.org/6230
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/sw/source/core/crsr/findtxt.cxx b/sw/source/core/crsr/findtxt.cxx
index eb66500..f4d3408 100644
--- a/sw/source/core/crsr/findtxt.cxx
+++ b/sw/source/core/crsr/findtxt.cxx
@@ -226,22 +226,6 @@ sal_uInt8 SwPaM::Find( const SearchOptions& rSearchOpt, sal_Bool bSearchInNotes
     SwNodeIndex& rNdIdx = pPam->GetPoint()->nNode;
     SwIndex& rCntntIdx = pPam->GetPoint()->nContent;
 
-    // If a beginning/end, from out of node; stop if empty node
-    if( bSrchForward
-        ? ( rCntntIdx.GetIndex() == pPam->GetCntntNode()->Len() &&
-            rCntntIdx.GetIndex() )
-        : !rCntntIdx.GetIndex() && pPam->GetCntntNode()->Len() )
-    {
-        if( !(*fnMove->fnNds)( &rNdIdx, sal_False ))
-        {
-            delete pPam;
-            return sal_False;
-        }
-        SwCntntNode *pNd = rNdIdx.GetNode().GetCntntNode();
-        xub_StrLen nTmpPos = bSrchForward ? 0 : pNd->Len();
-        rCntntIdx.Assign( pNd, nTmpPos );
-    }
-
     // If bFound is true then the string was found and is between nStart and nEnd
     sal_Bool bFound = sal_False;
     // start position in text or initial position
commit 386d0c5d663fe50295be3714977a54b86212f766
Author: Michael Stahl <mstahl at redhat.com>
Date:   Sat Oct 12 01:53:51 2013 +0200

    fdo#64495: sw: fix regex search for soft hyphen \xAD
    
    The problem is that the soft hyphen apparently needs special handling,
    and SwPaM::DoSearch() looked for the no longer supported legacy syntax,
    not for any of the unicode character syntax that ICU regex supports.
    
    Change-Id: I754296d2cf9286242e083cc7906ce3b8fda78dd5
    (cherry picked from commit dca5163b6ef206ceb1f2d56feb7546c1929afe60)
    Reviewed-on: https://gerrit.libreoffice.org/6229
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/sw/source/core/crsr/findtxt.cxx b/sw/source/core/crsr/findtxt.cxx
index cb6ec35..eb66500 100644
--- a/sw/source/core/crsr/findtxt.cxx
+++ b/sw/source/core/crsr/findtxt.cxx
@@ -420,9 +420,14 @@ bool SwPaM::DoSearch( const SearchOptions& rSearchOpt, utl::TextSearch& rSTxt,
     bool bRemoveSoftHyphens = true;
     if ( bRegSearch )
     {
-        const OUString a00AD("\\x00AD");
-        if ( -1 != rSearchOpt.searchString.indexOf( a00AD ) )
+        if (   -1 != rSearchOpt.searchString.indexOf("\\xAD")
+            || -1 != rSearchOpt.searchString.indexOf("\\x{00AD}")
+            || -1 != rSearchOpt.searchString.indexOf("\\u00AD")
+            || -1 != rSearchOpt.searchString.indexOf("\\U000000AD")
+            || -1 != rSearchOpt.searchString.indexOf("\\N{SOFT HYPHEN}"))
+        {
              bRemoveSoftHyphens = false;
+        }
     }
     else
     {
commit 02a4d733ef24f4350f65179f46d144de7b948799
Author: Michael Stahl <mstahl at redhat.com>
Date:   Fri Oct 11 18:36:47 2013 +0200

    fdo#67796: sw: fix table cursor when setting language in status bar
    
    Unfortunately it turns out that the neat hack in commit
    b227a8e4d65e4bbfe991aed9342fe3e30eca8639 does not work unless something
    actually _deletes_ the current m_pTblCrsr between Push() and Pop(),
    e.g. by calling SwCrsrShell::ClearMark() or KillPams().
    
    It would be possible to do some invalidation of m_pTblCrsr in
    SwCrsrShell::ClearUpCrsrs() or UpdateCrsr(), to set it's bChg flag
    or perhaps call ParkTblCrsr(); not sure if doing that is an improvement;
    certainly it shouldn't be tried in a 4.0.6 backport.
    
    So work around the problem locally in SwTextShell::Execute().
    
    Conflicts:
    	sw/source/ui/shells/textsh1.cxx
    
    (cherry picked from commit 9533e01713c0170bdae030429de38756d9c5ca74)
    
    Change-Id: I2981506b3065e824532deda28d21dad4a5734a8c
    Reviewed-on: https://gerrit.libreoffice.org/6212
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/sw/source/ui/shells/textsh1.cxx b/sw/source/ui/shells/textsh1.cxx
index 25976e9..b019604 100644
--- a/sw/source/ui/shells/textsh1.cxx
+++ b/sw/source/ui/shells/textsh1.cxx
@@ -328,8 +328,6 @@ void SwTextShell::Execute(SfxRequest &rReq)
                 rWrtSh.StartAction();
                 // prevent view from jumping because of (temporary) selection changes
                 rWrtSh.LockView( sal_True );
-                // save selection for later restoration
-                rWrtSh.Push();
 
                 // setting the new language...
                 if (aNewLangTxt.Len() > 0)
@@ -369,6 +367,12 @@ void SwTextShell::Execute(SfxRequest &rReq)
                         bForSelection = false;
                     }
 
+                    if (bForParagraph || !bForSelection)
+                    {
+                        rWrtSh.Push(); // save selection for later restoration
+                        rWrtSh.ClearMark(); // fdo#67796: invalidate table crsr
+                    }
+
                     if (bForParagraph)
                         SwLangHelper::SelectCurrentPara( rWrtSh );
 
@@ -383,10 +387,12 @@ void SwTextShell::Execute(SfxRequest &rReq)
                         SwLangHelper::ResetLanguages( rWrtSh, bForSelection );
                     else
                         SwLangHelper::SetLanguage( rWrtSh, aNewLangTxt, bForSelection, aCoreSet );
-                }
 
-                // restore selection...
-                rWrtSh.Pop( sal_False );
+                    if (bForParagraph || !bForSelection)
+                    {
+                        rWrtSh.Pop(false); // restore selection...
+                    }
+                }
 
                 rWrtSh.LockView( sal_False );
                 rWrtSh.EndAction();
commit 856e8cdf9cb67acfc858c9ca55bda5bd24ee7b57
Author: Eike Rathke <erack at redhat.com>
Date:   Thu Oct 10 18:02:25 2013 +0200

    fixed another "Out of bounds substring access"
    
    Introduced with 3c2a26c84e70fd996855181d319970e2230b2459
    Didn't have consequences here because the result was used to check for a
    "startsWith" condition which it wouldn't had matched anyway. However,
    use the real startsWith() now.
    
    (cherry picked from commit b1caf176a44b6979d2e0ea47f495a3dacf86e197)
    
    With f81ed484ffd443e2593627f3d8d3133161817af2 in 4-1 we should have this
    as well.
    
    Change-Id: Ia1d558fc106d9a2010ad41c30f7eb2a2a480c59b
    Reviewed-on: https://gerrit.libreoffice.org/6218
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/sc/source/ui/docshell/tablink.cxx b/sc/source/ui/docshell/tablink.cxx
index 14ab878..ba1ed72 100644
--- a/sc/source/ui/docshell/tablink.cxx
+++ b/sc/source/ui/docshell/tablink.cxx
@@ -512,12 +512,11 @@ bool ScDocumentLoader::GetFilterName(
 
 void ScDocumentLoader::RemoveAppPrefix( OUString& rFilterName )
 {
-    OUStringBuffer aAppPrefix;
-    aAppPrefix.appendAscii(STRING_SCAPP);
-    aAppPrefix.appendAscii(": ");
-    sal_Int32 nPreLen = aAppPrefix.getLength();
-    if (rFilterName.copy(0, nPreLen).equals(aAppPrefix.makeStringAndClear()))
-        rFilterName = rFilterName.copy(nPreLen);
+    OUStringBuffer aBuf;
+    aBuf.appendAscii( STRING_SCAPP).appendAscii( ": ");
+    OUString aAppPrefix( aBuf.makeStringAndClear());
+    if (rFilterName.startsWith( aAppPrefix))
+        rFilterName = rFilterName.copy( aAppPrefix.getLength());
 }
 
 ScDocumentLoader::ScDocumentLoader( const OUString& rFileName,
commit 9225bf807d40bf85a83536e2df23a28c457f7777
Author: CaolÃ¡n McNamara <caolanm at redhat.com>
Date:   Thu Aug 22 15:29:10 2013 +0100

    Resolves: rhbz#996162 apparent NULL bullet font
    
    Change-Id: I2f50ef1dabe2f152f2e18025edc88734158dbea2
    (cherry picked from commit 166510ed48bf49b75a031ce973f41d08fb4e4518)
    Reviewed-on: https://gerrit.libreoffice.org/6153
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>

diff --git a/editeng/source/outliner/outliner.cxx b/editeng/source/outliner/outliner.cxx
index 92923d3..70da2fc 100644
--- a/editeng/source/outliner/outliner.cxx
+++ b/editeng/source/outliner/outliner.cxx
@@ -898,9 +898,15 @@ Font Outliner::ImpCalcBulletFont( sal_Int32 nPara ) const
     }
 
     Font aBulletFont;
+    const Font *pSourceFont = 0;
     if ( pFmt->GetNumberingType() == SVX_NUM_CHAR_SPECIAL )
     {
-        aBulletFont = *pFmt->GetBulletFont();
+        pSourceFont = pFmt->GetBulletFont();
+    }
+
+    if (pSourceFont)
+    {
+        aBulletFont = *pSourceFont;
     }
     else
     {
commit c23fa104084fccd8aa3bd930499406380c410d02
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Fri Oct 11 14:57:32 2013 +0200

    Extension shared library components must not use the "prefix" feature
    
    ...at least no non-bundled ones, see 9dfcee9266c9769153444cdcd4ab0e6e636c3eb6
    "Not being able to honor a 'prefix' is a rather hard error" and the description
    there how that can lead to a crash when using mysql-connector-ooo.oxt:  "'rm -rf
    instdir/*/share/extensions/mysql-connector-ooo', 'instdir/*/program/soffice
    workdir/*/Extension/mysql-connector.oxt', install the [extension] per-user, then
    'File - New - Database - Connect to an existing database: MySQL - Next >> -
    Connect directly - Next >> - Database name: foo - Server / Port - Server: bar -
    Next >> - Test Connection', crash."
    
    This is a partial revert of cd79d51420b90117d0f3e1d5f3cdf9187bd61b88 "prefix all
    component_getFactory methods."
    
    Change-Id: Ia7a6272eb0597e3b3bbf4ab333174b3232448539
    (cherry picked from commit 3bafe5f5f529f6539363c5a291dd13ef1e2cbbde)
    Reviewed-on: https://gerrit.libreoffice.org/6209
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/mysqlc/source/mysqlc.component b/mysqlc/source/mysqlc.component
index ae16484..e429511 100644
--- a/mysqlc/source/mysqlc.component
+++ b/mysqlc/source/mysqlc.component
@@ -7,7 +7,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
  *
 -->
-<component xmlns="http://openoffice.org/2010/uno-components" prefix="mysqlc"
+<component xmlns="http://openoffice.org/2010/uno-components"
         loader="com.sun.star.loader.SharedLibrary">
     <implementation name="com.sun.star.comp.sdbc.mysqlc.MysqlCDriver">
         <service name="com.sun.star.sdbc.Driver"/>
diff --git a/mysqlc/source/mysqlc_services.cxx b/mysqlc/source/mysqlc_services.cxx
index cc7e8e0..af1cabe 100644
--- a/mysqlc/source/mysqlc_services.cxx
+++ b/mysqlc/source/mysqlc_services.cxx
@@ -76,7 +76,7 @@ struct ProviderRequest
 
 
 /* {{{ component_getFactory -I- */
-extern "C" SAL_DLLPUBLIC_EXPORT void* SAL_CALL mysqlc_component_getFactory(
+extern "C" SAL_DLLPUBLIC_EXPORT void* SAL_CALL component_getFactory(
                     const sal_Char * pImplementationName,
                     void * pServiceManager,
                     void * /* pRegistryKey */)
commit c42edd592e158d85a2231703552fdac6f13d7425
Author: Eike Rathke <erack at redhat.com>
Date:   Fri Oct 11 01:08:01 2013 +0200

    resolved fdo#69948 honor a detected FilterName
    
    TypeDetection::queryTypeByDescriptor() adds the FilterName property to
    the MediaDescriptor, use that if present.
    
    Strangely enough the sequence returned by XNameAccess::getByName(sType)
    of the type detection contains an empty PreferredFilter value so that is
    useless in this scenario.
    
    (cherry picked from commit 823278dd095d754d0f673ef140c36c9fa7ebeffd)
    
    Backported.
    
    Change-Id: I5cdc9fe71e35bdb7c511739c7f7728134941649a
    Reviewed-on: https://gerrit.libreoffice.org/6207
    Tested-by: Kohei Yoshida <libreoffice at kohei.us>
    Reviewed-by: Kohei Yoshida <libreoffice at kohei.us>

diff --git a/sfx2/source/appl/fileobj.cxx b/sfx2/source/appl/fileobj.cxx
index 1083a85..553b2cd 100644
--- a/sfx2/source/appl/fileobj.cxx
+++ b/sfx2/source/appl/fileobj.cxx
@@ -392,13 +392,32 @@ String impl_getFilter( const String& _rURL )
             OUString sType = xTypeDetection->queryTypeByDescriptor( aDescrList, sal_True );
             if ( !sType.isEmpty() )
             {
-                css::uno::Reference< css::container::XNameAccess > xTypeCont( xTypeDetection,
-                                                                              css::uno::UNO_QUERY );
-                if ( xTypeCont.is() )
+                // Honor a selected/detected filter.
+                for (sal_Int32 i=0; i < aDescrList.getLength(); ++i)
                 {
-                    ::comphelper::SequenceAsHashMap lTypeProps( xTypeCont->getByName( sType ) );
-                    sFilter = lTypeProps.getUnpackedValueOrDefault(
-                        OUString("PreferredFilter"), OUString() );
+                    if (aDescrList[i].Name == "FilterName")
+                    {
+                        OUString aFilterName;
+                        if (aDescrList[i].Value >>= aFilterName)
+                        {
+                            sFilter = aFilterName;
+                            break;
+                        }
+                    }
+                }
+                if (!sFilter.Len())
+                {
+                    css::uno::Reference< css::container::XNameAccess > xTypeCont( xTypeDetection,
+                            css::uno::UNO_QUERY );
+                    if ( xTypeCont.is() )
+                    {
+                        /* XXX: for fdo#69948 scenario the sequence returned by
+                         * getByName() contains an empty PreferredFilter
+                         * property value (since? expected?) */
+                        ::comphelper::SequenceAsHashMap lTypeProps( xTypeCont->getByName( sType ) );
+                        sFilter = lTypeProps.getUnpackedValueOrDefault(
+                                OUString("PreferredFilter"), OUString() );
+                    }
                 }
             }
         }
commit ca83560f3079289df88dd7df7c00917efbd72dc0
Author: Arnaud Versini <arnaud.versini at libreoffice.org>
Date:   Mon Oct 7 21:09:26 2013 +0200

    fdo#70143: fix SwDoc::ReplaceRangeImpl()
    
    Fix fdo#70143 by reporting swaping of positions
    
    (regression from 6b08fe833186a04f9aef698a540d3a7493ac4519,
    which changed SwUndoReplace::Impl::SetEnd to use the wrongly set end
    position in rPam)
    
    Change-Id: I14c6f58bc5c1418c69eb565d42f1829856eed58c
    (cherry picked from commit 9685d20f2a0526a4c454cea1bd947eccbaeefa84)
    
    Fixes regex replace of "$" with nothing (to delete line
    breaks).
    
    Change-Id: If7ec1e5f524f7bb308a2949ace16cb8aa6989106
    (cherry picked from commit f011a5c5071ed4a60f0ee7117608b72cecbb958d)
    Reviewed-on: https://gerrit.libreoffice.org/6175
    Reviewed-by: Arnaud Versini <arnaud.versini at libreoffice.org>
    Tested-by: CaolÃ¡n McNamara <caolanm at redhat.com>
    Reviewed-by: CaolÃ¡n McNamara <caolanm at redhat.com>

diff --git a/sw/source/core/doc/docedt.cxx b/sw/source/core/doc/docedt.cxx
index f169ae5..b0794e6 100644
--- a/sw/source/core/doc/docedt.cxx
+++ b/sw/source/core/doc/docedt.cxx
@@ -2442,17 +2442,23 @@ SetRedlineMode( eOld );
                 }
             }
 
-            *rPam.GetMark() = *aDelPam.GetMark();
-
+            *rPam.GetPoint() = *aDelPam.GetMark();
             ++aPtNd;
             rPam.GetMark()->nNode = aPtNd;
             rPam.GetMark()->nContent.Assign( aPtNd.GetNode().GetCntntNode(),
                                                 nPtCnt );
 
-            if (bJoinTxt && !bJoinPrev)
+            if (bJoinTxt)
             {
+                assert(rPam.GetPoint() == rPam.End());
+                // move so that SetEnd remembers position after sw_JoinText
                 rPam.Move(fnMoveBackward);
             }
+            else if (aDelPam.GetPoint() == pStt) // backward selection?
+            {
+                assert(*rPam.GetMark() <= *rPam.GetPoint());
+                rPam.Exchange(); // swap so that rPam is backwards
+            }
 
             if( pUndoRpl )
             {
commit 888007f5850b997b2bbf4d1b7615a536140e72e8
Author: Armin Le Grand <alg at apache.org>
Date:   Wed Oct 9 15:31:38 2013 +0000

    Resolves: #i123359# need to call SdrEndTextEdit before...
    
    manipulating objects at model/view
    
    (cherry picked from commit b5e8564995cd92e19cadcf8a6e9151be3efeeff4)
    
    Change-Id: Ie282370c7fc2dea4f9d59d85aac742b41d7c4541
    (cherry picked from commit 668730fbdd1ccf9a23d0a55361d019ca9e58ff39)

diff --git a/sd/source/ui/table/tablefunction.cxx b/sd/source/ui/table/tablefunction.cxx
index 77de56c..1ab6f9b 100644
--- a/sd/source/ui/table/tablefunction.cxx
+++ b/sd/source/ui/table/tablefunction.cxx
@@ -161,6 +161,15 @@ void DrawViewShell::FuTable(SfxRequest& rReq)
         apply_table_style( pObj, GetDoc(), sTableStyle );
         SdrPageView* pPV = mpView->GetSdrPageView();
 
+        // #i123359# if an object is to be replaced/manipulated it may be that it is in text edit mode,
+        // so to be on the safe side call SdrEndTextEdit here
+        SdrTextObj* pCheckForTextEdit = dynamic_cast< SdrTextObj* >(pPickObj);
+
+        if(pCheckForTextEdit && pCheckForTextEdit->IsInEditMode())
+        {
+            mpView->SdrEndTextEdit();
+        }
+
         // if we have a pick obj we need to make this new ole a pres obj replacing the current pick obj
         if( pPickObj )
         {
commit ba5c3e040578649a9cb1d9f327c94ade6aa08b52
Author: Andras Timar <andras.timar at collabora.com>
Date:   Thu Oct 10 09:22:36 2013 +0200

    Updated core
    Project: dictionaries  8349227a9dd98665d90b1ce744247fdaf5582936
    
    updated pt dictionary
    
    Change-Id: I9380049c2e0b6716287c71aa2693f40dc78facf6
    Reviewed-on: https://gerrit.libreoffice.org/6178
    Reviewed-by: Norbert Thiebaud <nthiebaud at gmail.com>
    Tested-by: Norbert Thiebaud <nthiebaud at gmail.com>

diff --git a/dictionaries b/dictionaries
index 307cb4c..8349227 160000
--- a/dictionaries
+++ b/dictionaries
@@ -1 +1 @@
-Subproject commit 307cb4cdf237ee21d4a90e9059a347b524b13f69
+Subproject commit 8349227a9dd98665d90b1ce744247fdaf5582936
commit f81ed484ffd443e2593627f3d8d3133161817af2
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Wed Oct 9 19:10:32 2013 +0200

    Fail fast at least in debug builds
    
    Change-Id: I266d5cf5b98827617f7ed65c94a772e28808f386
    (cherry picked from commit 57a28dc9556b4e6fff337e0eb9d0d8abc5223161)
    Reviewed-on: https://gerrit.libreoffice.org/6186
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/sal/rtl/strtmpl.cxx b/sal/rtl/strtmpl.cxx
index dd1effc..47bbc9b 100644
--- a/sal/rtl/strtmpl.cxx
+++ b/sal/rtl/strtmpl.cxx
@@ -1258,7 +1258,7 @@ void SAL_CALL IMPL_RTL_STRINGNAME( newFromSubString )( IMPL_RTL_STRINGDATA** ppT
     }
     if ( count < 0 || beginIndex < 0 || beginIndex + count > pFrom->length )
     {
-        OSL_FAIL( "Out of bounds substring access" );
+        assert(false); // fail fast at least in debug builds
         IMPL_RTL_STRINGNAME( newFromLiteral )( ppThis, "!!br0ken!!", 10, 0 );
         return;
     }
commit cfb792b7658b3011eb01bbaf007d9eb9b28eaf58
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Thu Oct 10 11:50:38 2013 +0200

    Prevent out-of-bounds arguments to OUString::copy
    
    ...which would somewhat unhelpfully result in returning "!!br0ken!!"
    
    (partial backport of 34e951bd7284d2e771c279e3adc3899d191fdad0 "More
    OUString::copy out-of-bounds fixes")
    
    Change-Id: Ibf66d218fe5f0d7b6216795a3b991705d4afda73
    Reviewed-on: https://gerrit.libreoffice.org/6183
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>

diff --git a/vcl/source/control/field2.cxx b/vcl/source/control/field2.cxx
index 5ae0453..080d1fc 100644
--- a/vcl/source/control/field2.cxx
+++ b/vcl/source/control/field2.cxx
@@ -19,6 +19,8 @@
 
 #include "sal/config.h"
 
+#include <algorithm>
+
 #include <comphelper/processfactory.hxx>
 #include <comphelper/string.hxx>
 #include <tools/rc.h>
@@ -1013,7 +1015,7 @@ static sal_uInt16 ImplCutNumberFromString( OUString& rStr )
         ++i2;
     }
     sal_Int32 nValue = rStr.copy(i1, i2-i1).toInt32();
-    rStr = rStr.copy(i2+1);
+    rStr = rStr.copy(std::min(i2+1, rStr.getLength()));
     return nValue;
 }
 
commit c0660bddc9eeb0d57f5b6ad05c4c695a9fdfc535
Author: CaolÃ¡n McNamara <caolanm at redhat.com>
Date:   Wed Oct 9 16:39:28 2013 +0100

    CID#736174 yikes, sizeof(char[]) includes 0, so 4 not 3
    
    Change-Id: Ia54ecab9e08485ebffe98dc064f328360c17a120
    (cherry picked from commit 8254648828e4f4d65a0516e160e5732f3d85765a)
    Reviewed-on: https://gerrit.libreoffice.org/6173
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/filter/source/msfilter/msvbahelper.cxx b/filter/source/msfilter/msvbahelper.cxx
index e143ba4..4a5576f 100644
--- a/filter/source/msfilter/msvbahelper.cxx
+++ b/filter/source/msfilter/msvbahelper.cxx
@@ -618,7 +618,7 @@ bool getModifier( char c, sal_uInt16& mod )
     static const char modifiers[] = "+^%";
     static const sal_uInt16 KEY_MODS[] = {KEY_SHIFT, KEY_MOD1, KEY_MOD2};
 
-    for ( unsigned int i=0; i<SAL_N_ELEMENTS(modifiers); ++i )
+    for ( unsigned int i=0; i<SAL_N_ELEMENTS(KEY_MODS); ++i )
     {
         if ( c == modifiers[i] )
         {
commit d41fc60d4443e3ff22ac3ef0e56cb9131cd49cc9
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Tue Oct 1 16:57:56 2013 +0200

    bnc#779620 DOCX import: try harder to convert floating tables to text frames
    
    Since 78d1f1c2835b9fae0f91ed771fc1d594c7817502, we convert floating
    tables to text frames only in case it's possible that there will be
    wrapping, to give better results for multi-page tables, which are
    multi-page, and technically floating ones, but that has no effect on the
    layout.
    
    The problem was that we try to do this decision too early, effectively
    the page width and margins were counted from the default letter size,
    instead of the actual values, which did not arrive at the time of the
    decision. Fix this by moving this logic at the section end.
    
    (cherry picked from commit bbef85c157169efa958ea1014d91d467cb243e6f)
    
    Conflicts:
    	sw/qa/extras/ooxmlimport/ooxmlimport.cxx
    	writerfilter/source/dmapper/DomainMapper_Impl.hxx
    
    Change-Id: Ic1fbceb54c8ec223ed01836fafe6220bb3b2410a
    Reviewed-on: https://gerrit.libreoffice.org/6104
    Reviewed-by: CaolÃ¡n McNamara <caolanm at redhat.com>
    Tested-by: CaolÃ¡n McNamara <caolanm at redhat.com>

diff --git a/sw/qa/extras/ooxmlimport/data/bnc779620.docx b/sw/qa/extras/ooxmlimport/data/bnc779620.docx
new file mode 100644
index 0000000..23c126d
Binary files /dev/null and b/sw/qa/extras/ooxmlimport/data/bnc779620.docx differ
diff --git a/sw/qa/extras/ooxmlimport/ooxmlimport.cxx b/sw/qa/extras/ooxmlimport/ooxmlimport.cxx
index 913cc16..2076c8c 100644
--- a/sw/qa/extras/ooxmlimport/ooxmlimport.cxx
+++ b/sw/qa/extras/ooxmlimport/ooxmlimport.cxx
@@ -134,6 +134,7 @@ public:
     void testFdo68607();
     void testVmlTextVerticalAdjust();
     void testGroupshapeSdt();
+    void testBnc779620();
 
     CPPUNIT_TEST_SUITE(Test);
 #if !defined(MACOSX) && !defined(WNT)
@@ -233,6 +234,7 @@ void Test::run()
         {"fdo68607.docx", &Test::testFdo68607},
         {"vml-text-vertical-adjust.docx", &Test::testVmlTextVerticalAdjust},
         {"groupshape-sdt.docx", &Test::testGroupshapeSdt},
+        {"bnc779620.docx", &Test::testBnc779620},
     };
     header();
     for (unsigned int i = 0; i < SAL_N_ELEMENTS(aMethods); ++i)
@@ -1642,6 +1644,14 @@ void Test::testGroupshapeSdt()
     CPPUNIT_ASSERT_EQUAL(sal_Int32(20), getProperty<sal_Int32>(getRun(getParagraphOfText(1, xShape->getText()), 1), "CharKerning"));
 }
 
+void Test::testBnc779620()
+{
+    // The problem was that the floating table was imported as a non-floating one.
+    uno::Reference<text::XTextFramesSupplier> xTextFramesSupplier(mxComponent, uno::UNO_QUERY);
+    uno::Reference<container::XIndexAccess> xIndexAccess(xTextFramesSupplier->getTextFrames(), uno::UNO_QUERY);
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(1), xIndexAccess->getCount());
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(Test);
 
 CPPUNIT_PLUGIN_IMPLEMENT();
diff --git a/writerfilter/source/dmapper/DomainMapperTableHandler.cxx b/writerfilter/source/dmapper/DomainMapperTableHandler.cxx
index 7d5c44e..b613c07 100644
--- a/writerfilter/source/dmapper/DomainMapperTableHandler.cxx
+++ b/writerfilter/source/dmapper/DomainMapperTableHandler.cxx
@@ -817,19 +817,7 @@ void DomainMapperTableHandler::endTable(unsigned int nestedTableLevel)
         uno::Reference<text::XTextRange> xStart;
         uno::Reference<text::XTextRange> xEnd;
 
-        bool bNoFly = false;
-        if (SectionPropertyMap* pSectionContext = m_rDMapper_Impl.GetSectionContext())
-        {
-            sal_Int32 nTextAreaWidth = pSectionContext->GetPageWidth() - pSectionContext->GetLeftMargin() - pSectionContext->GetRightMargin();
-            sal_Int32 nTableWidth = 0;
-            m_aTableProperties->getValue( TablePropertyMap::TABLE_WIDTH, nTableWidth );
-            // If the table is wider than the text area, then don't create a fly
-            // for the table: no wrapping will be performed anyway, but multi-page
-            // tables will be broken.
-            bNoFly = nTableWidth >= nTextAreaWidth;
-        }
-
-        bool bFloating = aFrameProperties.hasElements() && !bNoFly;
+        bool bFloating = aFrameProperties.hasElements();
         // Additional checks: if we can do this.
         if (bFloating && (*m_pTableSeq)[0].getLength() > 0 && (*m_pTableSeq)[0][0].getLength() > 0)
         {
@@ -916,7 +904,16 @@ void DomainMapperTableHandler::endTable(unsigned int nestedTableLevel)
             // A non-zero left margin would move the table out of the frame, move the frame itself instead.
             xTableProperties->setPropertyValue("LeftMargin", uno::makeAny(sal_Int32(0)));
 
-            uno::Reference< text::XTextContent > xFrame = m_xText->convertToTextFrame(xStart, xEnd, aFrameProperties);
+            // In case the document ends with a table, we're called after
+            // SectionPropertyMap::CloseSectionGroup(), so we'll have no idea
+            // about the text area width, nor can fix this by delaying the text
+            // frame conversion: just do it here.
+            sal_Int32 nTableWidth = 0;
+            m_aTableProperties->getValue(TablePropertyMap::TABLE_WIDTH, nTableWidth);
+            if (m_rDMapper_Impl.GetSectionContext())
+                m_rDMapper_Impl.m_aPendingFloatingTables.push_back(FloatingTableInfo(xStart, xEnd, aFrameProperties, nTableWidth));
+            else
+                m_xText->convertToTextFrame(xStart, xEnd, aFrameProperties);
         }
     }
 
diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.hxx b/writerfilter/source/dmapper/DomainMapper_Impl.hxx
index c65d804..8bc422f 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.hxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.hxx
@@ -281,6 +281,22 @@ struct LineNumberSettings
 
 };
 
+/// Contains information about a table that will be potentially converted to a floating one at the section end.
+struct FloatingTableInfo
+{
+    uno::Reference<text::XTextRange> m_xStart;
+    uno::Reference<text::XTextRange> m_xEnd;
+    uno::Sequence<beans::PropertyValue> m_aFrameProperties;
+    sal_Int32 m_nTableWidth;
+
+    FloatingTableInfo(uno::Reference<text::XTextRange> xStart, uno::Reference<text::XTextRange> xEnd, uno::Sequence<beans::PropertyValue> aFrameProperties, sal_Int32 nTableWidth)
+        : m_xStart(xStart),
+        m_xEnd(xEnd),
+        m_aFrameProperties(aFrameProperties),
+        m_nTableWidth(nTableWidth)
+    {
+    }
+};
 
 class DomainMapper;
 class WRITERFILTER_DLLPRIVATE DomainMapper_Impl
@@ -700,6 +716,8 @@ public:
      * PFInTable SPRM or not).
      */
     sal_Int32 m_nTableDepth;
+    /// Pending floating tables: they may be converted to text frames at the section end.
+    std::vector<FloatingTableInfo> m_aPendingFloatingTables;
 };
 } //namespace dmapper
 } //namespace writerfilter
diff --git a/writerfilter/source/dmapper/PropertyMap.cxx b/writerfilter/source/dmapper/PropertyMap.cxx
index 83868d4..3c4a470 100644
--- a/writerfilter/source/dmapper/PropertyMap.cxx
+++ b/writerfilter/source/dmapper/PropertyMap.cxx
@@ -845,6 +845,21 @@ void SectionPropertyMap::HandleMarginsHeaderFooter(DomainMapper_Impl& rDM_Impl)
 
 void SectionPropertyMap::CloseSectionGroup( DomainMapper_Impl& rDM_Impl )
 {
+    // Text area width is known at the end of a section: decide if tables should be converted or not.
+    std::vector<FloatingTableInfo>& rPendingFloatingTables = rDM_Impl.m_aPendingFloatingTables;
+    sal_Int32 nTextAreaWidth = GetPageWidth() - GetLeftMargin() - GetRightMargin();
+    uno::Reference<text::XTextAppendAndConvert> xBodyText( rDM_Impl.GetBodyText(), uno::UNO_QUERY );
+    for (size_t i = 0; i < rPendingFloatingTables.size(); ++i)
+    {
+        FloatingTableInfo& rInfo = rPendingFloatingTables[i];
+        // If the table is wider than the text area, then don't create a fly
+        // for the table: no wrapping will be performed anyway, but multi-page
+        // tables will be broken.
+        if (rInfo.m_nTableWidth < nTextAreaWidth)
+            xBodyText->convertToTextFrame(rInfo.m_xStart, rInfo.m_xEnd, rInfo.m_aFrameProperties);
+    }
+    rPendingFloatingTables.clear();
+
     PropertyNameSupplier& rPropNameSupplier = PropertyNameSupplier::GetPropertyNameSupplier();
     if( m_nLnnMod )
     {
commit 34c5218c9a33d136bbb9b1e2f91f0f4557ab3fad
Author: Thorsten Behrens <tbehrens at suse.com>
Date:   Mon Oct 7 11:16:04 2013 +0200

    Fix fdo#70220 Superscript not imported from pptx.
    
    Import works now, though EditEngine still fscks up font scaling -
    seems for CharEscapementHeight to work, there has to be reference,
    non-scaled text in the same portion ...
    
    Change-Id: I5505ae83bd6b700ebe8c3465beec40a4df2efb78
    Reviewed-on: https://gerrit.libreoffice.org/6154
    Reviewed-by: CaolÃ¡n McNamara <caolanm at redhat.com>
    Tested-by: CaolÃ¡n McNamara <caolanm at redhat.com>

diff --git a/include/oox/drawingml/textcharacterproperties.hxx b/include/oox/drawingml/textcharacterproperties.hxx
index 99792fe..2e519c9 100644
--- a/include/oox/drawingml/textcharacterproperties.hxx
+++ b/include/oox/drawingml/textcharacterproperties.hxx
@@ -46,6 +46,7 @@ struct TextCharacterProperties
     OptValue< sal_Int32 > moHeight;
     OptValue< sal_Int32 > moSpacing;
     OptValue< sal_Int32 > moUnderline;
+    OptValue< sal_Int32 > moBaseline;
     OptValue< sal_Int32 > moStrikeout;
     OptValue< sal_Int32 > moCaseMap;
     OptValue< bool >    moBold;
diff --git a/oox/source/drawingml/textcharacterproperties.cxx b/oox/source/drawingml/textcharacterproperties.cxx
index 11a551a..a5fe786 100644
--- a/oox/source/drawingml/textcharacterproperties.cxx
+++ b/oox/source/drawingml/textcharacterproperties.cxx
@@ -21,6 +21,7 @@
 #include <com/sun/star/lang/Locale.hpp>
 #include <com/sun/star/awt/FontSlant.hpp>
 #include <com/sun/star/awt/FontWeight.hpp>
+#include <editeng/escapementitem.hxx>
 #include "oox/helper/helper.hxx"
 #include "oox/helper/propertyset.hxx"
 #include "oox/core/xmlfilterbase.hxx"
@@ -51,6 +52,7 @@ void TextCharacterProperties::assignUsed( const TextCharacterProperties& rSource
     moHeight.assignIfUsed( rSourceProps.moHeight );
     moSpacing.assignIfUsed( rSourceProps.moSpacing );
     moUnderline.assignIfUsed( rSourceProps.moUnderline );
+    moBaseline.assignIfUsed( rSourceProps.moBaseline );
     moStrikeout.assignIfUsed( rSourceProps.moStrikeout );
     moCaseMap.assignIfUsed( rSourceProps.moCaseMap );
     moBold.assignIfUsed( rSourceProps.moBold );
@@ -123,6 +125,11 @@ void TextCharacterProperties::pushToPropMap( PropertyMap& rPropMap, const XmlFil
     rPropMap[ PROP_CharStrikeout ] <<= GetFontStrikeout( moStrikeout.get( XML_noStrike ) );
     rPropMap[ PROP_CharCaseMap ] <<= GetCaseMap( moCaseMap.get( XML_none ) );
 
+    if( !bUseOptional || moBaseline.has() ) {
+        rPropMap[ PROP_CharEscapement ] <<= sal_Int16(moBaseline.get( 0 ) / 1000);
+        rPropMap[ PROP_CharEscapementHeight ] <<= sal_Int8(DFLT_ESC_PROP);
+    }
+
     if( !bUseOptional || moBold.has() ) {
         float fWeight = moBold.get( false ) ? awt::FontWeight::BOLD : awt::FontWeight::NORMAL;
         rPropMap[ PROP_CharWeight ] <<= fWeight;
diff --git a/oox/source/drawingml/textcharacterpropertiescontext.cxx b/oox/source/drawingml/textcharacterpropertiescontext.cxx
index ed2ef6e..8622558 100644
--- a/oox/source/drawingml/textcharacterpropertiescontext.cxx
+++ b/oox/source/drawingml/textcharacterpropertiescontext.cxx
@@ -55,36 +55,27 @@ TextCharacterPropertiesContext::TextCharacterPropertiesContext(
         mrTextCharacterProperties.moUnderline = aAttribs.getToken( XML_u );
     if ( aAttribs.hasAttribute( XML_strike ) )
         mrTextCharacterProperties.moStrikeout = aAttribs.getToken( XML_strike );
+    if ( aAttribs.hasAttribute( XML_baseline ) )
+        mrTextCharacterProperties.moBaseline = aAttribs.getInteger( XML_baseline );
 
-//  mrTextCharacterProperties.moCaseMap     = aAttribs.getToken( XML_cap );
     if ( aAttribs.hasAttribute( XML_b ) )
         mrTextCharacterProperties.moBold = aAttribs.getBool( XML_b );
     if ( aAttribs.hasAttribute( XML_i ) )
         mrTextCharacterProperties.moItalic = aAttribs.getBool( XML_i );
 
-// TODO
-/*   todo: we need to be able to iterate over the XFastAttributes
-
-  // ST_TextNonNegativePoint
-    const OUString sCharKerning( "CharKerning" );
-    //case A_TOKEN( kern ):
-
-  // ST_TextLanguageID
-    OUString sAltLang = rXAttributes->getOptionalValue( XML_altLang );
-
-        case A_TOKEN( kumimoji ):       // xsd:boolean
-            break;
-        case A_TOKEN( spc ):            // ST_TextPoint
-        case A_TOKEN( normalizeH ):     // xsd:boolean
-        case A_TOKEN( baseline ):       // ST_Percentage
-        case A_TOKEN( noProof ):        // xsd:boolean
-        case A_TOKEN( dirty ):          // xsd:boolean
-        case A_TOKEN( err ):            // xsd:boolean
-        case A_TOKEN( smtClean ):       // xsd:boolean
-        case A_TOKEN( smtId ):          // xsd:unsignedInt
-            break;
-*/
-
+    /* TODO / unhandled so far:
+       XML_cap
+       A_TOKEN( kern )
+       XML_altLang
+       A_TOKEN( kumimoji )
+       A_TOKEN( spc )
+       A_TOKEN( normalizeH )
+       A_TOKEN( noProof )
+       A_TOKEN( dirty )
+       A_TOKEN( err )
+       A_TOKEN( smtClean )
+       A_TOKEN( smtId )
+    */
 }
 
 TextCharacterPropertiesContext::~TextCharacterPropertiesContext()
commit 128a744416bd0c23738ce285ad3e8d7c3e26fbc5
Author: Andras Timar <andras.timar at collabora.com>
Date:   Wed Oct 9 11:13:25 2013 +0200

    fdo#67074 push the localized macinstall.ulf to solver
    
    Change-Id: I0c7ed3d5bbad93adeba6175f0a9789fcb8ec3d3f
    Reviewed-on: https://gerrit.libreoffice.org/6170
    Reviewed-by: CaolÃ¡n McNamara <caolanm at redhat.com>
    Tested-by: CaolÃ¡n McNamara <caolanm at redhat.com>

diff --git a/setup_native/Package_ulf.mk b/setup_native/Package_ulf.mk
index bbf19c5..f8aafab 100644
--- a/setup_native/Package_ulf.mk
+++ b/setup_native/Package_ulf.mk
@@ -7,8 +7,8 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 #
 
-$(eval $(call gb_Package_Package,setup_native/ulf,$(SRCDIR)/setup_native/source))
+$(eval $(call gb_Package_Package,setup_native/ulf,$(call gb_CustomTarget_get_workdir,setup_native/mac)))
 
-$(eval $(call gb_Package_add_file,setup_native/ulf,bin/macinstall.ulf,mac/macinstall.ulf))
+$(eval $(call gb_Package_add_file,setup_native/ulf,bin/macinstall.ulf,macinstall.ulf))
 
 # vim: set noet sw=4 ts=4:
commit e577b3d19787ea16397a36dd6b2f93628b2799ed
Author: Michael Stahl <mstahl at redhat.com>
Date:   Sat Oct 5 23:12:40 2013 +0200

    fdo#64400: DXF import filter: fix OUString handling
    
    The DXF import filter stores all strings read from the file in
    char[DXF_MAX_STRING_LEN+1] arrays, and then calls OUString constructor
    with that which then asserts because the string is actually shorter than
    the size of the array... avoid that by converting from char* to OString.
    
    Actually this also fixes the actual bug: the weird lines in the exported
    PDF were tiny Text elements from the document, repeated.
    
    (cherry picked from commit 96852a89da058084b2acf5ff706d9679b127b29a)
    
    Change-Id: I93c52788f88fe5d21968d450d029ed5db101d88b
    Reviewed-on: https://gerrit.libreoffice.org/6151
    Reviewed-by: CaolÃ¡n McNamara <caolanm at redhat.com>
    Tested-by: CaolÃ¡n McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/idxf/dxf2mtf.cxx b/filter/source/graphicfilter/idxf/dxf2mtf.cxx
index 9635ed3..2ee26eb 100644
--- a/filter/source/graphicfilter/idxf/dxf2mtf.cxx
+++ b/filter/source/graphicfilter/idxf/dxf2mtf.cxx
@@ -52,9 +52,10 @@ long DXF2GDIMetaFile::GetEntityColor(const DXFBasicEntity & rE)
 
     nColor=rE.nColor;
     if (nColor==256) {
-        if (rE.sLayer[0]=='0' && rE.sLayer[1]==0) nColor=nParentLayerColor;
-        else {
-            pLayer=pDXF->aTables.SearchLayer(rE.sLayer);
+        if (rE.m_sLayer.getLength() < 2) {
+            nColor=nParentLayerColor;
+        } else {
+            pLayer=pDXF->aTables.SearchLayer(rE.m_sLayer);
             if (pLayer!=NULL) nColor=pLayer->nColor;
             else nColor=nParentLayerColor;
         }
@@ -63,12 +64,12 @@ long DXF2GDIMetaFile::GetEntityColor(const DXFBasicEntity & rE)
     return nColor;
 }
 
-DXFLineInfo DXF2GDIMetaFile::LTypeToDXFLineInfo(const char * sLineType)
+DXFLineInfo DXF2GDIMetaFile::LTypeToDXFLineInfo(OString const& rLineType)
 {
     const DXFLType * pLT;
     DXFLineInfo aDXFLineInfo;
 
-    pLT=pDXF->aTables.SearchLType(sLineType);
+    pLT = pDXF->aTables.SearchLType(rLineType);
     if (pLT==NULL || pLT->nDashCount == 0) {
         aDXFLineInfo.eStyle = LINE_SOLID;
     }
@@ -124,18 +125,23 @@ DXFLineInfo DXF2GDIMetaFile::GetEntityDXFLineInfo(const DXFBasicEntity & rE)
     aDXFLineInfo.fDotLen = 0;
     aDXFLineInfo.fDistance = 0;
 
-    if (strcmp(rE.sLineType,"BYLAYER")==0) {
-        if (rE.sLayer[0]=='0' && rE.sLayer[1]==0) aDXFLineInfo=aParentLayerDXFLineInfo;
-        else {
-            const DXFLayer * pLayer=pDXF->aTables.SearchLayer(rE.sLayer);
-            if (pLayer!=NULL) aDXFLineInfo=LTypeToDXFLineInfo(pLayer->sLineType);
+    if (rE.m_sLineType == "BYLAYER") {
+        if (rE.m_sLayer.getLength() < 2) {
+            aDXFLineInfo=aParentLayerDXFLineInfo;
+        } else {
+            const DXFLayer * pLayer=pDXF->aTables.SearchLayer(rE.m_sLayer);
+            if (pLayer!=NULL) {
+                aDXFLineInfo = LTypeToDXFLineInfo(pLayer->m_sLineType);
+            }
             else aDXFLineInfo=aParentLayerDXFLineInfo;
         }
     }
-    else if (strcmp(rE.sLineType,"BYBLOCK")==0) {
+    else if (rE.m_sLineType == "BYBLOCK") {
         aDXFLineInfo=aBlockDXFLineInfo;
     }
-    else aDXFLineInfo=LTypeToDXFLineInfo(rE.sLineType);
+    else {
+        aDXFLineInfo = LTypeToDXFLineInfo(rE.m_sLineType);
+    }
     return aDXFLineInfo;
 }
 
@@ -414,7 +420,6 @@ void DXF2GDIMetaFile::DrawTextEntity(const DXFTextEntity & rE, const DXFTransfor
     double fA;
     sal_uInt16 nHeight;
     short nAng;
-    OString aStr( rE.sText );
     DXFTransform aT( DXFTransform(rE.fXScale,rE.fHeight,1.0,rE.fRotAngle,rE.aP0), rTransform );
     aT.TransDir(DXFVector(0,1,0),aV);
     nHeight=(sal_uInt16)(aV.Abs()+0.5);
@@ -423,7 +428,8 @@ void DXF2GDIMetaFile::DrawTextEntity(const DXFTextEntity & rE, const DXFTransfor
     aT.TransDir(DXFVector(1,0,0),aV);
     if ( SetFontAttribute( rE,nAng, nHeight, aV. Abs() ) )
     {
-        OUString aUString(OStringToOUString(aStr, pDXF->getTextEncoding()));
+        OUString const aUString(
+                OStringToOUString(rE.m_sText, pDXF->getTextEncoding()));
         aT.Transform( DXFVector( 0, 0, 0 ), aPt );
         pVirDev->DrawText( aPt, aUString );
     }
@@ -433,7 +439,7 @@ void DXF2GDIMetaFile::DrawTextEntity(const DXFTextEntity & rE, const DXFTransfor
 void DXF2GDIMetaFile::DrawInsertEntity(const DXFInsertEntity & rE, const DXFTransform & rTransform)
 {
     const DXFBlock * pB;
-    pB=pDXF->aBlocks.Search(rE.sName);
+    pB=pDXF->aBlocks.Search(rE.m_sName);
     if (pB!=NULL) {
         DXFTransform aDXFTransform1(1.0,1.0,1.0,DXFVector(0.0,0.0,0.0)-pB->aBasePoint);
         DXFTransform aDXFTransform2(rE.fXScale,rE.fYScale,rE.fZScale,rE.fRotAngle,rE.aP0);
@@ -449,11 +455,11 @@ void DXF2GDIMetaFile::DrawInsertEntity(const DXFInsertEntity & rE, const DXFTran
         aSavedParentLayerDXFLineInfo=aParentLayerDXFLineInfo;
         nBlockColor=GetEntityColor(rE);
         aBlockDXFLineInfo=GetEntityDXFLineInfo(rE);
-        if (rE.sLayer[0]!='0' || rE.sLayer[1]!=0) {
-            DXFLayer * pLayer=pDXF->aTables.SearchLayer(rE.sLayer);
+        if (rE.m_sLayer.getLength() > 1) {
+            DXFLayer * pLayer=pDXF->aTables.SearchLayer(rE.m_sLayer);
             if (pLayer!=NULL) {
                 nParentLayerColor=pLayer->nColor;
-                aParentLayerDXFLineInfo=LTypeToDXFLineInfo(pLayer->sLineType);
+                aParentLayerDXFLineInfo = LTypeToDXFLineInfo(pLayer->m_sLineType);
             }
         }
         DrawEntities(*pB,aT);
@@ -473,7 +479,6 @@ void DXF2GDIMetaFile::DrawAttribEntity(const DXFAttribEntity & rE, const DXFTran
         double fA;
         sal_uInt16 nHeight;
         short nAng;
-        OString aStr( rE.sText );
         DXFTransform aT( DXFTransform( rE.fXScale, rE.fHeight, 1.0, rE.fRotAngle, rE.aP0 ), rTransform );
         aT.TransDir(DXFVector(0,1,0),aV);
         nHeight=(sal_uInt16)(aV.Abs()+0.5);
@@ -482,7 +487,8 @@ void DXF2GDIMetaFile::DrawAttribEntity(const DXFAttribEntity & rE, const DXFTran
         aT.TransDir(DXFVector(1,0,0),aV);
         if (SetFontAttribute(rE,nAng,nHeight,aV.Abs()))
         {
-            OUString aUString(OStringToOUString(aStr, pDXF->getTextEncoding()));
+            OUString const aUString(
+                    OStringToOUString(rE.m_sText, pDXF->getTextEncoding()));
             aT.Transform( DXFVector( 0, 0, 0 ), aPt );
             pVirDev->DrawText( aPt, aUString );
         }
@@ -644,7 +650,7 @@ void DXF2GDIMetaFile::Draw3DFaceEntity(const DXF3DFaceEntity & rE, const DXFTran
 void DXF2GDIMetaFile::DrawDimensionEntity(const DXFDimensionEntity & rE, const DXFTransform & rTransform)
 {
     const DXFBlock * pB;
-    pB=pDXF->aBlocks.Search(rE.sPseudoBlock);
+    pB=pDXF->aBlocks.Search(rE.m_sPseudoBlock);
     if (pB!=NULL) {
         DXFTransform aT(
             DXFTransform(1.0,1.0,1.0,DXFVector(0.0,0.0,0.0)-pB->aBasePoint),
@@ -658,11 +664,11 @@ void DXF2GDIMetaFile::DrawDimensionEntity(const DXFDimensionEntity & rE, const D
         aSavedParentLayerDXFLineInfo=aParentLayerDXFLineInfo;
         nBlockColor=GetEntityColor(rE);
         aBlockDXFLineInfo=GetEntityDXFLineInfo(rE);
-        if (rE.sLayer[0]!='0' || rE.sLayer[1]!=0) {
-            DXFLayer * pLayer=pDXF->aTables.SearchLayer(rE.sLayer);
+        if (rE.m_sLayer.getLength() > 1) {
+            DXFLayer * pLayer=pDXF->aTables.SearchLayer(rE.m_sLayer);
             if (pLayer!=NULL) {
                 nParentLayerColor=pLayer->nColor;
-                aParentLayerDXFLineInfo=LTypeToDXFLineInfo(pLayer->sLineType);
+                aParentLayerDXFLineInfo = LTypeToDXFLineInfo(pLayer->m_sLineType);
             }
         }
         DrawEntities(*pB,aT);
@@ -786,7 +792,7 @@ sal_Bool DXF2GDIMetaFile::Convert(const DXFRepresentation & rDXF, GDIMetaFile &
     pLayer=pDXF->aTables.SearchLayer("0");
     if (pLayer!=NULL) {
         nParentLayerColor=pLayer->nColor & 0xff;
-        aParentLayerDXFLineInfo=LTypeToDXFLineInfo(pLayer->sLineType);
+        aParentLayerDXFLineInfo = LTypeToDXFLineInfo(pLayer->m_sLineType);
     }
     else {
         nParentLayerColor=7;
diff --git a/filter/source/graphicfilter/idxf/dxf2mtf.hxx b/filter/source/graphicfilter/idxf/dxf2mtf.hxx
index b767cb0..0a56572 100644
--- a/filter/source/graphicfilter/idxf/dxf2mtf.hxx
+++ b/filter/source/graphicfilter/idxf/dxf2mtf.hxx
@@ -60,7 +60,7 @@ private:
 
     long GetEntityColor(const DXFBasicEntity & rE);
 
-    DXFLineInfo LTypeToDXFLineInfo(const char * sLineType);
+    DXFLineInfo LTypeToDXFLineInfo(OString const& rLineType);
 
     DXFLineInfo GetEntityDXFLineInfo(const DXFBasicEntity & rE);
 
diff --git a/filter/source/graphicfilter/idxf/dxfblkrd.cxx b/filter/source/graphicfilter/idxf/dxfblkrd.cxx
index 3f06268..bb52fe42 100644
--- a/filter/source/graphicfilter/idxf/dxfblkrd.cxx
+++ b/filter/source/graphicfilter/idxf/dxfblkrd.cxx
@@ -40,25 +40,25 @@ DXFBlock::~DXFBlock()
 
 void DXFBlock::Read(DXFGroupReader & rDGR)
 {
-    sName[0]=0;
-    sAlsoName[0]=0;
+    m_sName = "";
+    m_sAlsoName = "";
     aBasePoint.fx=0.0;
     aBasePoint.fy=0.0;
     aBasePoint.fz=0.0;
     nFlags=0;
-    sXRef[0]=0;
+    m_sXRef = "";
 
     while (rDGR.Read()!=0)
     {
         switch (rDGR.GetG())
         {
-            case  2: strncpy( sName, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
-            case  3: strncpy( sAlsoName, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
+            case  2: m_sName = OString(rDGR.GetS()); break;
+            case  3: m_sAlsoName = OString(rDGR.GetS()); break;
             case 70: nFlags=rDGR.GetI(); break;
             case 10: aBasePoint.fx=rDGR.GetF(); break;
             case 20: aBasePoint.fy=rDGR.GetF(); break;
             case 30: aBasePoint.fz=rDGR.GetF(); break;
-            case  1: strncpy( sXRef, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
+            case  1: m_sXRef = OString(rDGR.GetS()); break;
         }
     }
     DXFEntities::Read(rDGR);
@@ -104,11 +104,11 @@ void DXFBlocks::Read(DXFGroupReader & rDGR)
 }
 
 
-DXFBlock * DXFBlocks::Search(const char * sName) const
+DXFBlock * DXFBlocks::Search(OString const& rName) const
 {
     DXFBlock * pB;
     for (pB=pFirst; pB!=NULL; pB=pB->pSucc) {
-        if (strcmp(sName,pB->sName)==0) break;
+        if (rName == pB->m_sName) break;
     }
     return pB;
 }
diff --git a/filter/source/graphicfilter/idxf/dxfblkrd.hxx b/filter/source/graphicfilter/idxf/dxfblkrd.hxx
index cfd17dd..84d38e6 100644
--- a/filter/source/graphicfilter/idxf/dxfblkrd.hxx
+++ b/filter/source/graphicfilter/idxf/dxfblkrd.hxx
@@ -34,11 +34,11 @@ public:
         // pointer to the nex block in the list DXFBlocks::pFirst
 
     // properties of blocks; commented with group codes:
-    char sName[DXF_MAX_STRING_LEN+1];     //  2
-    char sAlsoName[DXF_MAX_STRING_LEN+1]; //  3
+    OString m_sName;                      //  2
+    OString m_sAlsoName;                  //  3
     long nFlags;                          // 70
     DXFVector aBasePoint;                 // 10,20,30
-    char sXRef[DXF_MAX_STRING_LEN+1];     //  1
+    OString m_sXRef;                      //  1
 
     DXFBlock();
     ~DXFBlock();
@@ -66,7 +66,7 @@ public:
     void Read(DXFGroupReader & rDGR);
         // reads all block per rDGR until a ENDSEC oder EOF.
 
-    DXFBlock * Search(const char * sName) const;
+    DXFBlock * Search(OString const& rName) const;
         // looks for a block with the name, return NULL if not successful
 
     void Clear();
diff --git a/filter/source/graphicfilter/idxf/dxfentrd.cxx b/filter/source/graphicfilter/idxf/dxfentrd.cxx
index 7f77a08..910ba3d 100644
--- a/filter/source/graphicfilter/idxf/dxfentrd.cxx
+++ b/filter/source/graphicfilter/idxf/dxfentrd.cxx
@@ -24,11 +24,11 @@
 //--------------------------DXFBasicEntity--------------------------------------
 
 DXFBasicEntity::DXFBasicEntity(DXFEntityType eThisType)
+    : m_sLayer("0")
+    , m_sLineType("BYLAYER")
 {
     eType=eThisType;
     pSucc=NULL;
-    strncpy(sLayer,"0", 2 );
-    strncpy(sLineType,"BYLAYER", 8 );
     fElevation=0;
     fThickness=0;
     nColor=256;
@@ -47,8 +47,8 @@ void DXFBasicEntity::EvaluateGroup(DXFGroupReader & rDGR)
 {
     switch (rDGR.GetG())
     {
-        case   8: strncpy( sLayer, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
-        case   6: strncpy( sLineType, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
+        case   8: m_sLayer = OString(rDGR.GetS()); break;
+        case   6: m_sLineType = OString(rDGR.GetS()); break;
         case  38: fElevation=rDGR.GetF(); break;
         case  39: fThickness=rDGR.GetF(); break;
         case  62: nColor=rDGR.GetI(); break;
@@ -190,14 +190,14 @@ void DXFSolidEntity::EvaluateGroup(DXFGroupReader & rDGR)
 
 //--------------------------DXFTextEntity---------------------------------------
 
-DXFTextEntity::DXFTextEntity() : DXFBasicEntity(DXF_TEXT)
+DXFTextEntity::DXFTextEntity()
+    : DXFBasicEntity(DXF_TEXT)
+    , m_sStyle("STANDARD")
 {
     fHeight=1.0;
-    sText[0]=0;
     fRotAngle=0.0;
     fXScale=1.0;
     fOblAngle=0.0;
-    strncpy( sStyle, "STANDARD", 9 );
     nGenFlags=0;
     nHorzJust=0;
     nVertJust=0;
@@ -210,11 +210,11 @@ void DXFTextEntity::EvaluateGroup(DXFGroupReader & rDGR)
         case 20: aP0.fy=rDGR.GetF(); break;
         case 30: aP0.fz=rDGR.GetF(); break;
         case 40: fHeight=rDGR.GetF(); break;
-        case  1: strncpy( sText, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
+        case  1: m_sText = OString(rDGR.GetS()); break;
         case 50: fRotAngle=rDGR.GetF(); break;
         case 41: fXScale=rDGR.GetF(); break;
         case 42: fOblAngle=rDGR.GetF(); break;
-        case  7: strncpy( sStyle, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
+        case  7: m_sStyle = OString(rDGR.GetS()); break;
         case 71: nGenFlags=rDGR.GetI(); break;
         case 72: nHorzJust=rDGR.GetI(); break;
         case 73: nVertJust=rDGR.GetI(); break;
@@ -230,7 +230,6 @@ void DXFTextEntity::EvaluateGroup(DXFGroupReader & rDGR)
 DXFShapeEntity::DXFShapeEntity() : DXFBasicEntity(DXF_SHAPE)
 {
     fSize=1.0;
-    sName[0]=0;
     fRotAngle=0;
     fXScale=1.0;
     fOblAngle=0;
@@ -243,7 +242,7 @@ void DXFShapeEntity::EvaluateGroup(DXFGroupReader & rDGR)
         case 20: aP0.fy=rDGR.GetF(); break;
         case 30: aP0.fz=rDGR.GetF(); break;
         case 40: fSize=rDGR.GetF(); break;
-        case  2: strncpy( sName, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
+        case  2: m_sName = OString(rDGR.GetS()); break;
         case 50: fRotAngle=rDGR.GetF(); break;
         case 41: fXScale=rDGR.GetF(); break;
         case 51: fOblAngle=rDGR.GetF(); break;
@@ -256,7 +255,6 @@ void DXFShapeEntity::EvaluateGroup(DXFGroupReader & rDGR)
 DXFInsertEntity::DXFInsertEntity() : DXFBasicEntity(DXF_INSERT)
 {
     nAttrFlag=0;
-    sName[0]=0;
     fXScale=1.0;
     fYScale=1.0;
     fZScale=1.0;
@@ -271,7 +269,7 @@ void DXFInsertEntity::EvaluateGroup(DXFGroupReader & rDGR)
 {
     switch (rDGR.GetG()) {
         case 66: nAttrFlag=rDGR.GetI(); break;
-        case  2: strncpy( sName, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
+        case  2: m_sName = OString(rDGR.GetS()); break;
         case 10: aP0.fx=rDGR.GetF(); break;
         case 20: aP0.fy=rDGR.GetF(); break;
         case 30: aP0.fz=rDGR.GetF(); break;
@@ -289,18 +287,16 @@ void DXFInsertEntity::EvaluateGroup(DXFGroupReader & rDGR)
 
 //--------------------------DXFAttDefEntity-------------------------------------
 
-DXFAttDefEntity::DXFAttDefEntity() : DXFBasicEntity(DXF_ATTDEF)
+DXFAttDefEntity::DXFAttDefEntity()
+    : DXFBasicEntity(DXF_ATTDEF)
+    , m_sStyle("STANDARD")
 {
     fHeight=1.0;
-    sDefVal[0]=0;
-    sPrompt[0]=0;
-    sTagStr[0]=0;
     nAttrFlags=0;
     nFieldLen=0;
     fRotAngle=0.0;
     fXScale=1.0;
     fOblAngle=0.0;
-    strncpy( sStyle, "STANDARD", 9 );
     nGenFlags=0;
     nHorzJust=0;
     nVertJust=0;
@@ -313,15 +309,15 @@ void DXFAttDefEntity::EvaluateGroup(DXFGroupReader & rDGR)
         case 20: aP0.fy=rDGR.GetF(); break;
         case 30: aP0.fz=rDGR.GetF(); break;
         case 40: fHeight=rDGR.GetF(); break;
-        case  1: strncpy( sDefVal, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
-        case  3: strncpy( sPrompt, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
-        case  2: strncpy( sTagStr, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
+        case  1: m_sDefVal = OString(rDGR.GetS()); break;
+        case  3: m_sPrompt = OString(rDGR.GetS()); break;
+        case  2: m_sTagStr = OString(rDGR.GetS()); break;
         case 70: nAttrFlags=rDGR.GetI(); break;
         case 73: nFieldLen=rDGR.GetI(); break;
         case 50: fRotAngle=rDGR.GetF(); break;
         case 41: fXScale=rDGR.GetF(); break;
         case 51: fOblAngle=rDGR.GetF(); break;
-        case  7: strncpy( sStyle, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
+        case  7: m_sStyle = OString(rDGR.GetS()); break;
         case 71: nGenFlags=rDGR.GetI(); break;
         case 72: nHorzJust=rDGR.GetI(); break;
         case 74: nVertJust=rDGR.GetI(); break;
@@ -334,17 +330,16 @@ void DXFAttDefEntity::EvaluateGroup(DXFGroupReader & rDGR)
 
 //--------------------------DXFAttribEntity-------------------------------------
 
-DXFAttribEntity::DXFAttribEntity() : DXFBasicEntity(DXF_ATTRIB)
+DXFAttribEntity::DXFAttribEntity()
+    : DXFBasicEntity(DXF_ATTRIB)
+    , m_sStyle("STANDARD")
 {
     fHeight=1.0;
-    sText[0]=0;
-    sTagStr[0]=0;
     nAttrFlags=0;
     nFieldLen=0;
     fRotAngle=0.0;
     fXScale=1.0;
     fOblAngle=0.0;
-    strncpy( sStyle, "STANDARD", 9 );
     nGenFlags=0;
     nHorzJust=0;
     nVertJust=0;
@@ -357,14 +352,14 @@ void DXFAttribEntity::EvaluateGroup(DXFGroupReader & rDGR)
         case 20: aP0.fy=rDGR.GetF(); break;
         case 30: aP0.fz=rDGR.GetF(); break;
         case 40: fHeight=rDGR.GetF(); break;
-        case  1: strncpy( sText, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
-        case  2: strncpy( sTagStr, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
+        case  1: m_sText = OString(rDGR.GetS()); break;
+        case  2: m_sTagStr = OString(rDGR.GetS()); break;
         case 70: nAttrFlags=rDGR.GetI(); break;
         case 73: nFieldLen=rDGR.GetI(); break;
         case 50: fRotAngle=rDGR.GetF(); break;
         case 41: fXScale=rDGR.GetF(); break;
         case 51: fOblAngle=rDGR.GetF(); break;
-        case  7: strncpy( sStyle, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
+        case  7: m_sStyle = OString(rDGR.GetS()); break;
         case 71: nGenFlags=rDGR.GetI(); break;
         case 72: nHorzJust=rDGR.GetI(); break;
         case 74: nVertJust=rDGR.GetI(); break;
@@ -790,13 +785,12 @@ void DXF3DFaceEntity::EvaluateGroup(DXFGroupReader & rDGR)
 
 DXFDimensionEntity::DXFDimensionEntity() : DXFBasicEntity(DXF_DIMENSION)
 {
-    sPseudoBlock[0]=0;
 }
 
 void DXFDimensionEntity::EvaluateGroup(DXFGroupReader & rDGR)
 {
     switch (rDGR.GetG()) {
-        case  2: strncpy( sPseudoBlock, rDGR.GetS(), DXF_MAX_STRING_LEN + 1 ); break;
+        case  2: m_sPseudoBlock = OString(rDGR.GetS()); break;
         default: DXFBasicEntity::EvaluateGroup(rDGR);
     }
 }
diff --git a/filter/source/graphicfilter/idxf/dxfentrd.hxx b/filter/source/graphicfilter/idxf/dxfentrd.hxx
index 21f4d30..3439b22 100644
--- a/filter/source/graphicfilter/idxf/dxfentrd.hxx
+++ b/filter/source/graphicfilter/idxf/dxfentrd.hxx
@@ -68,8 +68,8 @@ public:
 
     // properties that all entities have, each
     // commented with group codes:
-    char sLayer[DXF_MAX_STRING_LEN+1];    //  8
-    char sLineType[DXF_MAX_STRING_LEN+1]; //  6
+    OString m_sLayer;                     //  8
+    OString m_sLineType;                  //  6
     double fElevation;                    // 38
     double fThickness;                    // 39
     long nColor;                          // 62
@@ -210,11 +210,11 @@ public:
 
     DXFVector aP0;                     // 10,20,30
     double fHeight;                    // 40
-    char sText[DXF_MAX_STRING_LEN+1];  //  1
+    OString m_sText;                   //  1
     double fRotAngle;                  // 50
     double fXScale;                    // 41
     double fOblAngle;                  // 42
-    char sStyle[DXF_MAX_STRING_LEN+1]; //  7
+    OString m_sStyle;                  //  7
     long nGenFlags;                    // 71
     long nHorzJust;                    // 72
     long nVertJust;                    // 73
@@ -235,7 +235,7 @@ public:
 
     DXFVector aP0;                    // 10,20,30
     double fSize;                     // 40
-    char sName[DXF_MAX_STRING_LEN+1]; //  2
+    OString m_sName;                  //  2
     double fRotAngle;                 // 50
     double fXScale;                   // 41
     double fOblAngle;                 // 51
@@ -254,7 +254,7 @@ class DXFInsertEntity : public DXFBasicEntity {
 public:
 
     long nAttrFlag;                   // 66
-    char sName[DXF_MAX_STRING_LEN+1]; //  2
+    OString m_sName;                  //  2
     DXFVector aP0;                    // 10,20,30
     double fXScale;                   // 41
     double fYScale;                   // 42
@@ -280,15 +280,15 @@ public:
 
     DXFVector aP0;                      // 10,20,30
     double fHeight;                     // 40
-    char sDefVal[DXF_MAX_STRING_LEN+1]; //  1
-    char sPrompt[DXF_MAX_STRING_LEN+1]; //  3
-    char sTagStr[DXF_MAX_STRING_LEN+1]; //  2
+    OString m_sDefVal;                  //  1
+    OString m_sPrompt;                  //  3
+    OString m_sTagStr;                  //  2
     long nAttrFlags;                    // 70
     long nFieldLen;                     // 73
     double fRotAngle;                   // 50
     double fXScale;                     // 41
     double fOblAngle;                   // 51
-    char sStyle[DXF_MAX_STRING_LEN+1];  //  7
+    OString m_sStyle;                   //  7
     long nGenFlags;                     // 71
     long nHorzJust;                     // 72
     long nVertJust;                     // 74
@@ -309,14 +309,14 @@ public:
 
     DXFVector aP0;                      // 10,20,30
     double fHeight;                     // 40
-    char sText[DXF_MAX_STRING_LEN+1];   //  1
-    char sTagStr[DXF_MAX_STRING_LEN+1]; //  2
+    OString m_sText;                    //  1
+    OString m_sTagStr;                  //  2
     long nAttrFlags;                    // 70
     long nFieldLen;                     // 73
     double fRotAngle;                   // 50
     double fXScale;                     // 41
     double fOblAngle;                   // 51
-    char sStyle[DXF_MAX_STRING_LEN+1];  //  7
+    OString m_sStyle;                   //  7
     long nGenFlags;                     // 71
     long nHorzJust;                     // 72
     long nVertJust;                     // 74
@@ -542,7 +542,7 @@ class DXFDimensionEntity : public DXFBasicEntity {
 
 public:
 
-    char sPseudoBlock[DXF_MAX_STRING_LEN+1]; //  2
+    OString m_sPseudoBlock;                  //  2
 
     DXFDimensionEntity();
 
diff --git a/filter/source/graphicfilter/idxf/dxfreprd.cxx b/filter/source/graphicfilter/idxf/dxfreprd.cxx
index 7a2c93a..3ed0232 100644
--- a/filter/source/graphicfilter/idxf/dxfreprd.cxx
+++ b/filter/source/graphicfilter/idxf/dxfreprd.cxx
@@ -299,7 +299,7 @@ void DXFRepresentation::CalcBoundingBox(const DXFEntities & rEntities,
                 DXFBlock * pB;
                 DXFBoundingBox aBox;
                 DXFVector aP;
-                pB=aBlocks.Search(pE->sName);
+                pB=aBlocks.Search(pE->m_sName);
                 if (pB==NULL) break;
                 CalcBoundingBox(*pB,aBox);
                 if (aBox.bEmpty==sal_True) break;
@@ -341,7 +341,7 @@ void DXFRepresentation::CalcBoundingBox(const DXFEntities & rEntities,
                 DXFBlock * pB;
                 DXFBoundingBox aBox;
                 DXFVector aP;
-                pB=aBlocks.Search(pE->sPseudoBlock);
+                pB = aBlocks.Search(pE->m_sPseudoBlock);
                 if (pB==NULL) break;
                 CalcBoundingBox(*pB,aBox);
                 if (aBox.bEmpty==sal_True) break;
diff --git a/filter/source/graphicfilter/idxf/dxftblrd.cxx b/filter/source/graphicfilter/idxf/dxftblrd.cxx
index f99de87..eff5663 100644
--- a/filter/source/graphicfilter/idxf/dxftblrd.cxx
+++ b/filter/source/graphicfilter/idxf/dxftblrd.cxx
@@ -26,9 +26,7 @@
 DXFLType::DXFLType()
 {
     pSucc=NULL;
-    sName[0]=0;
     nFlags=0;
-    sDescription[0]=0;
     nDashCount=0;
 }
 
@@ -41,12 +39,10 @@ void DXFLType::Read(DXFGroupReader & rDGR)
         switch (rDGR.GetG())
         {
         case  2:
-            strncpy( sName, rDGR.GetS(), DXF_MAX_STRING_LEN );
-            sName[DXF_MAX_STRING_LEN] = 0;
+            m_sName = OString(rDGR.GetS());
             break;
         case  3:
-            strncpy( sDescription, rDGR.GetS(), DXF_MAX_STRING_LEN );
-            sDescription[DXF_MAX_STRING_LEN] = 0;
+            m_sDescription = OString(rDGR.GetS());
             break;
         case 70:
             nFlags=rDGR.GetI();
@@ -85,10 +81,8 @@ void DXFLType::Read(DXFGroupReader & rDGR)
 DXFLayer::DXFLayer()
 {
     pSucc=NULL;
-    sName[0]=0;
     nFlags=0;
     nColor=-1;
-    sLineType[0]=0;
 }
 
 void DXFLayer::Read(DXFGroupReader & rDGR)
@@ -98,12 +92,10 @@ void DXFLayer::Read(DXFGroupReader & rDGR)
         switch(rDGR.GetG())
         {
         case  2:
-            strncpy( sName, rDGR.GetS(), DXF_MAX_STRING_LEN );
-            sName[DXF_MAX_STRING_LEN] = 0;
+            m_sName = OString(rDGR.GetS());
             break;
         case  6:
-            strncpy( sLineType, rDGR.GetS(), DXF_MAX_STRING_LEN );
-            sLineType[DXF_MAX_STRING_LEN] = 0;
+            m_sLineType = OString(rDGR.GetS());
             break;
         case 70:
             nFlags=rDGR.GetI();
@@ -120,15 +112,12 @@ void DXFLayer::Read(DXFGroupReader & rDGR)
 DXFStyle::DXFStyle()
 {
     pSucc=NULL;
-    sName[0]=0;
     nFlags=0;
     fHeight=0.0;
     fWidthFak=1.0;
     fOblAngle=0.0;
     nTextGenFlags=0;
     fLastHeightUsed=0.0;
-    sPrimFontFile[0]=0;
-    sBigFontFile[0]=0;
 }
 
 void DXFStyle::Read(DXFGroupReader & rDGR)
@@ -138,16 +127,13 @@ void DXFStyle::Read(DXFGroupReader & rDGR)
         switch(rDGR.GetG())
         {
         case  2:
-            strncpy( sName, rDGR.GetS(), DXF_MAX_STRING_LEN );
-            sName[DXF_MAX_STRING_LEN] = 0;
+            m_sName = OString(rDGR.GetS());
             break;
         case  3:
-            strncpy( sPrimFontFile, rDGR.GetS(), DXF_MAX_STRING_LEN );
-            sPrimFontFile[DXF_MAX_STRING_LEN] = 0;
+            m_sPrimFontFile = OString(rDGR.GetS());
             break;
         case  4:
-            strncpy( sBigFontFile, rDGR.GetS(), DXF_MAX_STRING_LEN );
-            sBigFontFile[DXF_MAX_STRING_LEN] = 0;
+            m_sBigFontFile = OString(rDGR.GetS());
             break;
         case 70:
             nFlags=rDGR.GetI();
@@ -177,7 +163,6 @@ DXFVPort::DXFVPort()
 {
     pSucc=NULL;
 
-    sName[0]=0;
     nFlags=0;
     fMinX=0;
     fMinY=0;
@@ -218,8 +203,7 @@ void DXFVPort::Read(DXFGroupReader & rDGR)
         switch(rDGR.GetG())
         {
         case  2:
-            strncpy( sName, rDGR.GetS(), DXF_MAX_STRING_LEN);
-            sName[DXF_MAX_STRING_LEN] = 0;
+            m_sName = OString(rDGR.GetS());
             break;
         case 10: fMinX=rDGR.GetF(); break;
         case 11: fMaxX=rDGR.GetF(); break;
@@ -360,31 +344,31 @@ void DXFTables::Clear()
 }
 
 
-DXFLType * DXFTables::SearchLType(const char * pName) const
+DXFLType * DXFTables::SearchLType(OString const& rName) const
 {
     DXFLType * p;
     for (p=pLTypes; p!=NULL; p=p->pSucc) {
-        if (strcmp(pName,p->sName)==0) break;
+        if (rName == p->m_sName) break;
     }
     return p;
 }
 
 
-DXFLayer * DXFTables::SearchLayer(const char * pName) const
+DXFLayer * DXFTables::SearchLayer(OString const& rName) const
 {
     DXFLayer * p;
     for (p=pLayers; p!=NULL; p=p->pSucc) {
-        if (strcmp(pName,p->sName)==0) break;
+        if (rName == p->m_sName) break;
     }
     return p;
 }
 
 
-DXFVPort * DXFTables::SearchVPort(const char * pName) const
+DXFVPort * DXFTables::SearchVPort(OString const& rName) const
 {
     DXFVPort * p;
     for (p=pVPorts; p!=NULL; p=p->pSucc) {
-        if (strcmp(pName,p->sName)==0) break;
+        if (rName == p->m_sName) break;
     }
     return p;
 }
diff --git a/filter/source/graphicfilter/idxf/dxftblrd.hxx b/filter/source/graphicfilter/idxf/dxftblrd.hxx
index 4d74ccc..0b12939 100644
--- a/filter/source/graphicfilter/idxf/dxftblrd.hxx
+++ b/filter/source/graphicfilter/idxf/dxftblrd.hxx
@@ -36,9 +36,9 @@ public:
 
     DXFLType * pSucc;
 
-    char sName[DXF_MAX_STRING_LEN+1];        //  2
+    OString m_sName;                         //  2
     long nFlags;                             // 70
-    char sDescription[DXF_MAX_STRING_LEN+1]; //  3
+    OString m_sDescription;                  //  3
     long nDashCount;                         // 73
     double fPatternLength;                   // 40
     double fDash[DXF_MAX_DASH_COUNT];        // 49,49,...
@@ -58,10 +58,10 @@ public:
 
     DXFLayer * pSucc;
 
-    char sName[DXF_MAX_STRING_LEN+1];     //  2
+    OString m_sName;                      //  2
     long nFlags;                          // 70
     long nColor;                          // 62
-    char sLineType[DXF_MAX_STRING_LEN+1]; //  6
+    OString m_sLineType;                  //  6
 
     DXFLayer();
     void Read(DXFGroupReader & rDGR);
@@ -78,15 +78,15 @@ public:
 
     DXFStyle * pSucc;
 
-    char sName[DXF_MAX_STRING_LEN+1];         //  2
+    OString m_sName;                          //  2
     long nFlags;                              // 70
     double fHeight;                           // 40
     double fWidthFak;                         // 41
     double fOblAngle;                         // 50
     long nTextGenFlags;                       // 71
     double fLastHeightUsed;                   // 42
-    char sPrimFontFile[DXF_MAX_STRING_LEN+1]; //  3
-    char sBigFontFile[DXF_MAX_STRING_LEN+1];  //  4
+    OString m_sPrimFontFile;                  //  3
+    OString m_sBigFontFile;                   //  4
 
     DXFStyle();
     void Read(DXFGroupReader & rDGR);
@@ -103,7 +103,7 @@ public:
 
     DXFVPort * pSucc;
 
-    char sName[DXF_MAX_STRING_LEN+1]; //  2
+    OString m_sName;                  //  2
     long nFlags;                      // 70
     double fMinX;                     // 10
     double fMinY;                     // 20
@@ -164,9 +164,9 @@ public:
     void Clear();
 
     // look for table entries:
-    DXFLType * SearchLType(const char * pName) const;
-    DXFLayer * SearchLayer(const char * pName) const;

... etc. - the rest is truncated
