[Libreoffice-commits] core.git: Branch 'distro/collabora/cp-4.4' - 63 commits - chart2/source editeng/source filter/qa filter/source include/editeng include/filter include/svx include/tools include/xmloff sc/inc sc/qa sc/source sd/qa sd/source svx/source sw/CppunitTest_sw_odfexport.mk sw/qa sw/source tools/source vcl/inc vcl/qa vcl/source vcl/win xmloff/source

Miklos Vajna vmiklos at collabora.co.uk
Mon Aug 31 06:02:03 PDT 2015


 chart2/source/controller/dialogs/DataBrowser.cxx               |   34 -
 chart2/source/controller/dialogs/DataBrowser.hxx               |    2 
 chart2/source/inc/DiagramHelper.hxx                            |    1 
 chart2/source/tools/DiagramHelper.cxx                          |   49 +
 editeng/source/editeng/editattr.cxx                            |    6 
 editeng/source/items/textitem.cxx                              |   38 -
 filter/qa/cppunit/data/pbm/fail/crash-1.pbm                    |    6 
 filter/qa/cppunit/data/tiff/fail/hang-10.tiff                  |binary
 filter/source/graphicfilter/ipbm/ipbm.cxx                      |   35 +
 filter/source/graphicfilter/itiff/lzwdecom.cxx                 |   12 
 filter/source/msfilter/msdffimp.cxx                            |   60 +-
 filter/source/msfilter/svdfppt.cxx                             |  220 +++++---
 include/editeng/colritem.hxx                                   |   10 
 include/filter/msfilter/dffpropset.hxx                         |    1 
 include/filter/msfilter/svdfppt.hxx                            |   12 
 include/svx/unobrushitemhelper.hxx                             |    3 
 include/tools/color.hxx                                        |    4 
 include/xmloff/PageMasterStyleMap.hxx                          |   12 
 include/xmloff/txtprmap.hxx                                    |    2 
 include/xmloff/xmlexppr.hxx                                    |    3 
 sc/inc/compare.hxx                                             |    8 
 sc/inc/dbdata.hxx                                              |    5 
 sc/qa/unit/data/ods/header-image.ods                           |binary
 sc/qa/unit/subsequent_export-test.cxx                          |   16 
 sc/source/core/inc/interpre.hxx                                |    2 
 sc/source/core/tool/compare.cxx                                |   22 
 sc/source/core/tool/dbdata.cxx                                 |   21 
 sc/source/core/tool/interpr1.cxx                               |   20 
 sc/source/core/tool/parclass.cxx                               |    6 
 sc/source/core/tool/scmatrix.cxx                               |    2 
 sc/source/ui/StatisticsDialogs/RandomNumberGeneratorDialog.cxx |   29 +
 sc/source/ui/StatisticsDialogs/SamplingDialog.cxx              |   75 ++
 sc/source/ui/StatisticsDialogs/StatisticsInputOutputDialog.cxx |   71 ++
 sc/source/ui/StatisticsDialogs/StatisticsTwoVariableDialog.cxx |   89 +++
 sc/source/ui/docshell/dbdocfun.cxx                             |    3 
 sc/source/ui/inc/RandomNumberGeneratorDialog.hxx               |    1 
 sc/source/ui/inc/SamplingDialog.hxx                            |    1 
 sc/source/ui/inc/StatisticsInputOutputDialog.hxx               |    1 
 sc/source/ui/inc/StatisticsTwoVariableDialog.hxx               |    1 
 sd/qa/unit/data/ppt/pass/crash-1.ppt                           |binary
 sd/qa/unit/data/ppt/pass/crash-2.ppt                           |binary
 sd/qa/unit/data/ppt/pass/crash-3.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-1.ppt                            |binary
 sd/qa/unit/data/ppt/pass/hang-10.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-11.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-12.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-13.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-14.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-15.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-16.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-17.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-18.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-19.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-2.ppt                            |binary
 sd/qa/unit/data/ppt/pass/hang-20.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-21.ppt                           |binary
 sd/qa/unit/data/ppt/pass/hang-3.ppt                            |binary
 sd/qa/unit/data/ppt/pass/hang-4.ppt                            |binary
 sd/qa/unit/data/ppt/pass/hang-5.ppt                            |binary
 sd/qa/unit/data/ppt/pass/hang-6.ppt                            |binary
 sd/qa/unit/data/ppt/pass/hang-7.ppt                            |binary
 sd/qa/unit/data/ppt/pass/hang-8.ppt                            |binary
 sd/qa/unit/data/ppt/pass/hang-9.ppt                            |binary
 sd/source/filter/ppt/pptin.cxx                                 |  121 +++-
 sd/source/filter/ppt/propread.cxx                              |   98 ++-
 svx/source/svdraw/svdoedge.cxx                                 |    2 
 svx/source/unodraw/unobrushitemhelper.cxx                      |    6 
 sw/CppunitTest_sw_odfexport.mk                                 |    3 
 sw/qa/core/data/ww5/pass/crash-1.doc                           |binary
 sw/qa/core/data/ww5/pass/crash-2.doc                           |binary
 sw/qa/core/data/ww5/pass/crash-3.doc                           |binary
 sw/qa/core/data/ww5/pass/hang-1.doc                            |binary
 sw/qa/core/data/ww5/pass/hang-2.doc                            |binary
 sw/qa/core/data/ww6/pass/crash-1.doc                           |binary
 sw/qa/core/data/ww6/pass/crash-2.doc                           |binary
 sw/qa/core/data/ww6/pass/crash-3.doc                           |binary
 sw/qa/core/data/ww6/pass/crash-4.doc                           |binary
 sw/qa/core/data/ww6/pass/crash-6.doc                           |binary
 sw/qa/core/data/ww6/pass/crash-7.doc                           |binary
 sw/qa/core/data/ww6/pass/hang-1.doc                            |binary
 sw/qa/core/data/ww8/pass/hang-5.doc                            |binary
 sw/qa/core/filters-test.cxx                                    |    4 
 sw/qa/extras/odfexport/data/tdf92379.fodt                      |   89 +++
 sw/qa/extras/odfexport/odfexport.cxx                           |   80 +++
 sw/source/core/layout/paintfrm.cxx                             |    4 
 sw/source/core/unocore/swunohelper.cxx                         |   14 
 sw/source/core/unocore/unostyle.cxx                            |   10 
 sw/source/filter/basflt/fltshell.cxx                           |   39 +
 sw/source/filter/ww8/ww8glsy.cxx                               |   12 
 sw/source/filter/ww8/ww8graf.cxx                               |   90 ++-
 sw/source/filter/ww8/ww8par.cxx                                |   37 -
 sw/source/filter/ww8/ww8par.hxx                                |   14 
 sw/source/filter/ww8/ww8par2.cxx                               |   33 -
 sw/source/filter/ww8/ww8par4.cxx                               |    9 
 sw/source/filter/ww8/ww8scan.cxx                               |  262 +++++++---
 sw/source/filter/ww8/ww8scan.hxx                               |    3 
 sw/source/filter/xml/xmlimp.cxx                                |   12 
 tools/source/generic/color.cxx                                 |    2 
 vcl/inc/outfont.hxx                                            |    2 
 vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-3.wmf          |binary
 vcl/source/filter/wmf/enhwmf.cxx                               |   19 
 vcl/source/gdi/salgdilayout.cxx                                |   36 +
 vcl/source/outdev/font.cxx                                     |    5 
 vcl/win/source/gdi/winlayout.cxx                               |    9 
 vcl/win/source/gdi/winlayout.hxx                               |    1 
 xmloff/source/draw/sdpropls.cxx                                |    4 
 xmloff/source/style/impastpl.cxx                               |    1 
 xmloff/source/style/styleexp.cxx                               |    8 
 xmloff/source/style/xmlexppr.cxx                               |   23 
 xmloff/source/text/txtimppr.cxx                                |   14 
 110 files changed, 1520 insertions(+), 429 deletions(-)

New commits:
commit aeba901db44db667933a13acd8e2d74e1e4a0028
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Mon Aug 31 09:05:59 2015 +0200

    tdf#89245 xmloff: fix Calc header background image saving
    
    Regression from commit 7d9bb549d498d6beed2c4050c402d09643febdfa
    (Related: #i124638# Second step of DrawingLayer FillAttributes...,
    2014-06-02), the problem was that the new
    CTF_PM_REPEAT_OFFSET_X..CTF_PM_FILLTRANSNAME range's values overlapped with the
    existing CTF_PM_HEADERHEIGHT..CTF_PM_HEADERGRAPHICURL range's values, so
    when the new code in XMLPageMasterExportPropMapper::ContextFilter()
    tried to tweak header repeat offset properties, it actually disabled
    HeaderBackGraphicURL instead.
    
    (cherry picked from commit 3b40329f9a64b93b1e1230b1bff74ed8cda8cd70)
    
    Conflicts:
    	sc/qa/unit/subsequent_export-test.cxx
    
    Change-Id: I9c2700fa71a4ef2a813ec671049ee9d98171b57e
    Reviewed-on: https://gerrit.libreoffice.org/18162
    Reviewed-by: Andras Timar <andras.timar at collabora.com>
    Tested-by: Andras Timar <andras.timar at collabora.com>

diff --git a/include/xmloff/PageMasterStyleMap.hxx b/include/xmloff/PageMasterStyleMap.hxx
index a4007bd..859f3e0 100644
--- a/include/xmloff/PageMasterStyleMap.hxx
+++ b/include/xmloff/PageMasterStyleMap.hxx
@@ -90,12 +90,12 @@
 // at export time using CTF_PM_FLAGMASK and XML_PM_CTF_START as detector
 // to find the first entry for header/footer (!), see
 // SvXMLAutoStylePoolP_Impl::exportXML, look for XML_STYLE_FAMILY_PAGE_MASTER
-#define CTF_PM_REPEAT_OFFSET_X          (XML_PM_CTF_START + 0x0035)
-#define CTF_PM_REPEAT_OFFSET_Y          (XML_PM_CTF_START + 0x0036)
-#define CTF_PM_FILLGRADIENTNAME         (XML_PM_CTF_START + 0x0037)
-#define CTF_PM_FILLHATCHNAME            (XML_PM_CTF_START + 0x0038)
-#define CTF_PM_FILLBITMAPNAME           (XML_PM_CTF_START + 0x0039)
-#define CTF_PM_FILLTRANSNAME            (XML_PM_CTF_START + 0x0040)
+#define CTF_PM_REPEAT_OFFSET_X          (XML_PM_CTF_START + 0x0037)
+#define CTF_PM_REPEAT_OFFSET_Y          (XML_PM_CTF_START + 0x0038)
+#define CTF_PM_FILLGRADIENTNAME         (XML_PM_CTF_START + 0x0039)
+#define CTF_PM_FILLHATCHNAME            (XML_PM_CTF_START + 0x0040)
+#define CTF_PM_FILLBITMAPNAME           (XML_PM_CTF_START + 0x0041)
+#define CTF_PM_FILLTRANSNAME            (XML_PM_CTF_START + 0x0042)
 
 #define CTF_PM_SCALETO                  (XML_PM_CTF_START + 0x0051) // calc specific
 #define CTF_PM_SCALETOPAGES             (XML_PM_CTF_START + 0x0052)
diff --git a/sc/qa/unit/data/ods/header-image.ods b/sc/qa/unit/data/ods/header-image.ods
new file mode 100644
index 0000000..c19b902
Binary files /dev/null and b/sc/qa/unit/data/ods/header-image.ods differ
diff --git a/sc/qa/unit/subsequent_export-test.cxx b/sc/qa/unit/subsequent_export-test.cxx
index 33312e4..a6f273b 100644
--- a/sc/qa/unit/subsequent_export-test.cxx
+++ b/sc/qa/unit/subsequent_export-test.cxx
@@ -135,6 +135,7 @@ public:
     void testLinkedGraphicRT();
 
     void testSupBookVirtualPath();
+    void testHeaderImage();
 
     CPPUNIT_TEST_SUITE(ScExportTest);
     CPPUNIT_TEST(test);
@@ -180,6 +181,7 @@ public:
 #endif
     CPPUNIT_TEST(testSwappedOutImageExport);
     CPPUNIT_TEST(testLinkedGraphicRT);
+    CPPUNIT_TEST(testHeaderImage);
 
     CPPUNIT_TEST_SUITE_END();
 
@@ -2417,6 +2419,20 @@ void ScExportTest::testLinkedGraphicRT()
     }
 }
 
+void ScExportTest::testHeaderImage()
+{
+    // Graphic as header background was lost on export.
+    ScDocShellRef xShell = loadDoc("header-image.", ODS);
+    ScDocShellRef xDocSh = saveAndReload(&(*xShell), ODS);
+    uno::Reference<style::XStyleFamiliesSupplier> xStyleFamiliesSupplier(xDocSh->GetModel(), uno::UNO_QUERY);
+    uno::Reference<container::XNameAccess> xStyleFamilies = xStyleFamiliesSupplier->getStyleFamilies();
+    uno::Reference<container::XNameAccess> xPageStyles(xStyleFamilies->getByName("PageStyles"), uno::UNO_QUERY);
+    uno::Reference<beans::XPropertySet> xStyle(xPageStyles->getByName("Default"), uno::UNO_QUERY);
+    OUString aURL;
+    xStyle->getPropertyValue("HeaderBackGraphicURL") >>= aURL;
+    CPPUNIT_ASSERT(aURL.startsWith("vnd.sun.star.GraphicObject:"));
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(ScExportTest);
 
 CPPUNIT_PLUGIN_IMPLEMENT();
commit f953d338808c0e060145d9bc027272d35ff5e7d0
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Aug 29 20:26:27 2015 +0100

    check stream status
    
    Change-Id: I6b9537cf94ac1c5d996ba64ddf878745dadde254
    (cherry picked from commit 452cd9e75de657e996e17510fe5d3539065489d1)
    Reviewed-on: https://gerrit.libreoffice.org/18129
    Reviewed-by: Norbert Thiebaud <nthiebaud at gmail.com>
    Tested-by: Norbert Thiebaud <nthiebaud at gmail.com>

diff --git a/sd/qa/unit/data/ppt/pass/hang-21.ppt b/sd/qa/unit/data/ppt/pass/hang-21.ppt
new file mode 100644
index 0000000..99cf49f
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-21.ppt differ
diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx
index 1dbb832..08987b5 100644
--- a/sd/source/filter/ppt/propread.cxx
+++ b/sd/source/filter/ppt/propread.cxx
@@ -497,10 +497,18 @@ void Section::Read( SvStorageStream *pStrm )
         {
             sal_uInt32 nDictCount(0);
             pStrm->ReadUInt32(nDictCount);
+            auto nMaxRecordsPossible = pStrm->remainingSize() / (sizeof(sal_uInt32)*2);
+            if (nDictCount > nMaxRecordsPossible)
+            {
+                SAL_WARN("sd.filter", "Dictionary count of " << nDictCount << " claimed, only " << nMaxRecordsPossible << " possible");
+                nDictCount = nMaxRecordsPossible;
+            }
             for (sal_uInt32 i = 0; i < nDictCount; ++i)
             {
                 sal_uInt32 nSize(0);
                 pStrm->ReadUInt32( nSize ).ReadUInt32( nSize );
+                if (!pStrm->good())
+                    break;
                 sal_uInt64 nPos = pStrm->Tell() + nSize;
                 if (nPos != pStrm->Seek(nPos))
                     break;
commit 3df0ed49aec08ae74eb639fd7d5840a28bd015c4
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Aug 30 20:14:16 2015 +0100

    pClientData can be null
    
    Change-Id: I9375f84affdaef30d9b1ded31525e6b7b8709cbc
    (cherry picked from commit 7d4c77e374310bef538465d11980d1d610cbe0f1)
    Reviewed-on: https://gerrit.libreoffice.org/18150
    Reviewed-by: Norbert Thiebaud <nthiebaud at gmail.com>
    Tested-by: Norbert Thiebaud <nthiebaud at gmail.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index e1e14b8..73283e2 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -2576,7 +2576,7 @@ bool SdrPowerPointImport::GetColorFromPalette( sal_uInt16 nNum, Color& rColor )
 bool SdrPowerPointImport::SeekToShape( SvStream& rSt, void* pClientData, sal_uInt32 nId ) const
 {
     bool bRet = SvxMSDffManager::SeekToShape( rSt, pClientData, nId );
-    if ( !bRet )
+    if (!bRet && pClientData)
     {
         ProcessData& rData = *( (ProcessData*)pClientData );
         PptSlidePersistEntry& rPersistEntry = rData.rPersistEntry;
diff --git a/sd/qa/unit/data/ppt/pass/crash-3.ppt b/sd/qa/unit/data/ppt/pass/crash-3.ppt
new file mode 100644
index 0000000..daa0102
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/crash-3.ppt differ
commit 215f8eb3592548cd6fb07429743cfad815955969
Author: Michael Stahl <mstahl at redhat.com>
Date:   Wed Aug 26 19:04:50 2015 +0200

    ODF import: workaround dubious draw:fill="solid" on frame styles
    
    Since the gradient frame backgrounds were added in LO 4.1, we export
    this:
    
     fo:background-color="transparent" draw:fill="solid"
    
    Which doesn't make a whole lot of sense as this is really a "none" fill,
    and now with the backward compatibility stuff in the style import code
    we get the pool default color added when setting the BackTransparent
    property, and with the draw:fill="solid" it becomes visible and the
    background color is now Sky Blue 1.
    
    So try to detect draw:fill="solid" without draw:fill-color attribute
    and contradicting transparent legacy attribute and nerf it.  This way
    we also export draw:fill="none" again, although still with a bogus
    draw:fill-color but that shouldn't cause any harm.
    
    (cherry picked from commit 68efa6f5128abf4cd097ae81a4cfd7fecbcb2a80)
    
    Change-Id: I1c2bea46ba7d9a3f042b875df0ca12c7f6037909
    Reviewed-on: https://gerrit.libreoffice.org/18045
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/include/xmloff/txtprmap.hxx b/include/xmloff/txtprmap.hxx
index dc8de70..c473f15 100644
--- a/include/xmloff/txtprmap.hxx
+++ b/include/xmloff/txtprmap.hxx
@@ -196,6 +196,8 @@
 #define CTF_CHARBOTTOMBORDER                (XML_TEXT_CTF_START + 167)
 #define CTF_RELWIDTHREL                     (XML_TEXT_CTF_START + 168)
 #define CTF_RELHEIGHTREL                    (XML_TEXT_CTF_START + 169)
+#define CTF_FILLSTYLE                       (XML_TEXT_CTF_START + 172)
+#define CTF_FILLCOLOR                       (XML_TEXT_CTF_START + 173)
 
 
 #define TEXT_PROP_MAP_TEXT 0
diff --git a/sw/qa/extras/odfexport/data/tdf92379.fodt b/sw/qa/extras/odfexport/data/tdf92379.fodt
index 8aeb9c4..762a04d 100644
--- a/sw/qa/extras/odfexport/data/tdf92379.fodt
+++ b/sw/qa/extras/odfexport/data/tdf92379.fodt
@@ -36,6 +36,11 @@
         <style:columns fo:column-count="1" fo:column-gap="0in"/>
       </style:graphic-properties>
     </style:style>
+    <style:style style:name="Untitled1" style:family="graphic" style:parent-style-name="encarts">
+      <style:graphic-properties fo:background-color="transparent" style:background-transparency="100%" draw:fill="solid">
+        <style:background-image/>
+      </style:graphic-properties>
+    </style:style>
 
     <!-- "Titre Avis expert" and derived styles from bugdoc -->
     <style:style style:name="Titre_20_Avis_20_expert" style:display-name="Titre Avis expert" style:family="paragraph" style:parent-style-name="Standard" style:master-page-name="">
diff --git a/sw/qa/extras/odfexport/odfexport.cxx b/sw/qa/extras/odfexport/odfexport.cxx
index d3ee3ee..22083c7 100644
--- a/sw/qa/extras/odfexport/odfexport.cxx
+++ b/sw/qa/extras/odfexport/odfexport.cxx
@@ -84,6 +84,23 @@ DECLARE_ODFEXPORT_TEST(testTdf92379, "tdf92379.fodt")
     CPPUNIT_ASSERT_EQUAL(sal_Int32(0xffcc99), getProperty<sal_Int32>(xStyle, "FillColor"));
     CPPUNIT_ASSERT_EQUAL(sal_Int16(0), getProperty<sal_Int16>(xStyle, "FillTransparence"));
 
+    uno::Reference<beans::XPropertySet> xFrameStyle2(xStyles->getByName("Untitled1"),
+            uno::UNO_QUERY);
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0xffffff), getProperty<sal_Int32>(xFrameStyle2, "BackColorRGB"));
+    CPPUNIT_ASSERT_EQUAL(true, getProperty<bool>(xFrameStyle2, "BackTransparent"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(100), getProperty<sal_Int32>(xFrameStyle2, "BackColorTransparency"));
+    CPPUNIT_ASSERT_EQUAL(drawing::FillStyle_NONE, getProperty<drawing::FillStyle>(xFrameStyle2, "FillStyle"));
+// unfortunately this is actually the pool default value, which would be hard to fix - but it isn't a problem because style is NONE
+//    CPPUNIT_ASSERT_EQUAL(sal_Int32(0xffffff), getProperty<sal_Int32>(xFrameStyle2, "FillColor"));
+//    CPPUNIT_ASSERT_EQUAL(sal_Int16(100), getProperty<sal_Int16>(xFrameStyle2, "FillTransparence"));
+
+    if (xmlDocPtr pXmlDoc = parseExport("styles.xml"))
+    {
+        // check that fo:background-color attribute is exported properly
+        assertXPath(pXmlDoc, "//style:style[@style:family='graphic' and @style:name='encarts']/style:graphic-properties[@fo:background-color='#ffcc99']", 1);
+        assertXPath(pXmlDoc, "//style:style[@style:family='graphic' and @style:name='Untitled1']/style:graphic-properties[@fo:background-color='transparent']", 1);
+    }
+
     // paragraph style fo:background-color was wrongly inherited despite being
     // overridden in derived style
     uno::Reference<container::XNameAccess> xParaStyles(getStyles("ParagraphStyles"));
diff --git a/xmloff/source/draw/sdpropls.cxx b/xmloff/source/draw/sdpropls.cxx
index 27b2de0..065d3dd 100644
--- a/xmloff/source/draw/sdpropls.cxx
+++ b/xmloff/source/draw/sdpropls.cxx
@@ -106,8 +106,8 @@ const XMLPropertyMapEntry aXMLSDProperties[] =
     GMAP( "LineCap",                        XML_NAMESPACE_SVG , XML_STROKE_LINECAP,         XML_SD_TYPE_LINECAP, 0 ),
 
     // fill attributes
-    GMAP( "FillStyle",                      XML_NAMESPACE_DRAW, XML_FILL,                   XML_SD_TYPE_FILLSTYLE, 0 ),
-    GMAP_D("FillColor",                     XML_NAMESPACE_DRAW, XML_FILL_COLOR,             XML_TYPE_COLOR, 0),
+    GMAP( "FillStyle",                      XML_NAMESPACE_DRAW, XML_FILL,                   XML_SD_TYPE_FILLSTYLE, CTF_FILLSTYLE ),
+    GMAP_D("FillColor",                     XML_NAMESPACE_DRAW, XML_FILL_COLOR,             XML_TYPE_COLOR, CTF_FILLCOLOR ),
     GMAP_D("FillColor2",                    XML_NAMESPACE_DRAW, XML_SECONDARY_FILL_COLOR,   XML_TYPE_COLOR, 0),
     GMAP( "FillGradientName",               XML_NAMESPACE_DRAW, XML_FILL_GRADIENT_NAME,     XML_TYPE_STYLENAME|MID_FLAG_NO_PROPERTY_IMPORT, CTF_FILLGRADIENTNAME ),
     GMAP( "FillGradientStepCount",          XML_NAMESPACE_DRAW, XML_GRADIENT_STEP_COUNT,    XML_TYPE_NUMBER16, 0 ),
diff --git a/xmloff/source/text/txtimppr.cxx b/xmloff/source/text/txtimppr.cxx
index 11b00e4..9278950 100644
--- a/xmloff/source/text/txtimppr.cxx
+++ b/xmloff/source/text/txtimppr.cxx
@@ -22,6 +22,7 @@
 #include <osl/thread.h>
 #include <com/sun/star/awt/FontFamily.hpp>
 #include <com/sun/star/awt/FontPitch.hpp>
+#include <com/sun/star/drawing/FillStyle.hpp>
 #include <com/sun/star/table/BorderLine2.hpp>
 #include <com/sun/star/text/VertOrientation.hpp>
 #include <com/sun/star/text/SizeType.hpp>
@@ -399,6 +400,8 @@ void XMLTextImportPropertyMapper::finished(
     XMLPropertyState* pAllMargin = 0;
     XMLPropertyState* pMargins[4] = { 0, 0, 0, 0 };
     ::std::unique_ptr<XMLPropertyState> pNewMargins[4];
+    XMLPropertyState* pFillStyle(nullptr);
+    XMLPropertyState* pFillColor(nullptr);
 
     for( ::std::vector< XMLPropertyState >::iterator aIter = rProperties.begin();
          aIter != rProperties.end();
@@ -482,6 +485,8 @@ void XMLTextImportPropertyMapper::finished(
                                         bHasAnyWidth = true; break;
         case CTF_BACKGROUND_TRANSPARENCY: pBackTransparency = property; break;
         case CTF_BACKGROUND_TRANSPARENT:  pBackTransparent = property; break;
+        case CTF_FILLSTYLE:             pFillStyle = property; break;
+        case CTF_FILLCOLOR:             pFillColor = property; break;
         case CTF_PARAMARGINALL:
         case CTF_PARAMARGINALL_REL:
                 pAllParaMargin = property; break;
@@ -646,6 +651,15 @@ void XMLTextImportPropertyMapper::finished(
                        pFontStyleNameCTL, pFontFamilyCTL, pFontPitchCTL, pFontCharSetCTL,
                        &pNewFontStyleNameCTL, &pNewFontFamilyCTL, &pNewFontPitchCTL, &pNewFontCharSetCTL );
 
+    if (pFillStyle && !pFillColor && pBackTransparent
+        && drawing::FillStyle_SOLID == pFillStyle->maValue.get<drawing::FillStyle>()
+        && pBackTransparent->maValue.get<bool>())
+    {
+        // fo:background="transparent", draw:fill="solid" without draw:fill-color
+        // prevent getSvxBrushItemFromSourceSet from adding bogus default color
+        pFillStyle->mnIndex = -1;
+    }
+
     // #i5775# don't overwrite %transparency with binary transparency
     if( ( pBackTransparency != NULL ) && ( pBackTransparent != NULL ) )
     {
commit 03238188e43c5276bcb86103520ecec133ddeee2
Author: Michael Stahl <mstahl at redhat.com>
Date:   Tue Aug 25 23:29:18 2015 +0200

    related: tdf#92379: sw: backward compatible ODF export of overriding
    
    ... frame/paragraph backgrounds.
    
    If a style is set to have draw:fill="solid" and a derived style to
    draw:fill="none" then the derived one must have
    fo:background-color="transparent" to override the parent for old
    consumers like LO <= 4.3/AOO <= 4.1 that don't understand draw:fill.
    
    Change-Id: I5b56c7ace927338239195c6bfcfef1950544c8d2
    (cherry picked from commit 25c50a71ffdf7c43f8f3dd10736188271cc75ef0)
    Reviewed-on: https://gerrit.libreoffice.org/18044
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/qa/extras/odfexport/odfexport.cxx b/sw/qa/extras/odfexport/odfexport.cxx
index 308a83d..d3ee3ee 100644
--- a/sw/qa/extras/odfexport/odfexport.cxx
+++ b/sw/qa/extras/odfexport/odfexport.cxx
@@ -124,6 +124,15 @@ DECLARE_ODFEXPORT_TEST(testTdf92379, "tdf92379.fodt")
 //    CPPUNIT_ASSERT_EQUAL(sal_Int32(0xffffff), getProperty<sal_Int32>(xStyle32, "FillColor"));
 //    CPPUNIT_ASSERT_EQUAL(sal_Int16(100), getProperty<sal_Int16>(xStyle32, "FillTransparence"));
     CPPUNIT_ASSERT_EQUAL(sal_Int32(0x461900), getProperty<sal_Int32>(xStyle32, "CharColor"));
+
+    if (xmlDocPtr pXmlDoc = parseExport("styles.xml"))
+    {
+        // check that fo:background-color attribute is exported properly
+        assertXPath(pXmlDoc, "//style:style[@style:family='paragraph' and @style:display-name='Titre Avis expert']/style:paragraph-properties[@fo:background-color='#661900']", 1);
+        assertXPath(pXmlDoc, "//style:style[@style:family='paragraph' and @style:display-name='Avis expert questions']/style:paragraph-properties[@fo:background-color='transparent']", 1);
+        assertXPath(pXmlDoc, "//style:style[@style:family='paragraph' and @style:display-name='avis expert questions non cadres']/style:paragraph-properties[@fo:background-color='#801900']", 1);
+        assertXPath(pXmlDoc, "//style:style[@style:family='paragraph' and @style:display-name='Avis expert rXponses']/style:paragraph-properties[@fo:background-color='transparent']", 1);
+    }
 }
 
 DECLARE_ODFEXPORT_TEST(testFdo79358, "fdo79358.odt")
diff --git a/sw/source/core/unocore/swunohelper.cxx b/sw/source/core/unocore/swunohelper.cxx
index c6f6729..a20caab 100644
--- a/sw/source/core/unocore/swunohelper.cxx
+++ b/sw/source/core/unocore/swunohelper.cxx
@@ -286,7 +286,18 @@ bool needToMapFillItemsToSvxBrushItemTypes(const SfxItemSet& rSet,
     switch (eFill)
     {
         case drawing::FillStyle_NONE:
-            return false; // ignoring some extremely limited XFillColorItem eval
+            // claim that BackColor and BackTransparent are available so that
+            // fo:background="transparent" attribute is exported to override
+            // the parent style in case it is != NONE
+            switch (nMID)
+            {
+                case MID_BACK_COLOR:
+                case MID_BACK_COLOR_R_G_B:
+                case MID_GRAPHIC_TRANSPARENT: // this is *BackTransparent
+                    return true;
+                default:
+                    return false;
+            }
             break;
         case drawing::FillStyle_SOLID:
         case drawing::FillStyle_GRADIENT: // gradient and hatch don't exist in
@@ -294,6 +305,7 @@ bool needToMapFillItemsToSvxBrushItemTypes(const SfxItemSet& rSet,
             switch (nMID)
             {
                 case MID_BACK_COLOR:
+                case MID_GRAPHIC_TRANSPARENT: // this is *BackTransparent
                     // Gradient/Hatch always have emulated color
                     return (drawing::FillStyle_SOLID != eFill)
                         || SfxItemState::SET == rSet.GetItemState(XATTR_FILLCOLOR)
commit 97bb8a68dcda6d94f78b707053aff1b6dc51f3ba
Author: Michael Stahl <mstahl at redhat.com>
Date:   Tue Aug 25 19:08:00 2015 +0200

    tdf#92379: sw: ODF import: fix fo:background-color="transparent"
    
    The problem is that if the FillStyle is NONE, setting only
    ParaBackTransparent but not ParaBackColor does absolutely nothing.
    
    This means that if a parent style sets a background color, then a
    derived style cannot override it to be transparent.
    
    Cause is that getSvxBrushItemFromSourceSet() defaults to setting a
    0xFF transparency on the SvxBrushItem.
    
    There is still a problem that getSvxBrushItemFromSourceSet() sets the
    pool default item's color and that is also exported to ODF again as
    draw:fill-color, but together with draw:fill="none" it should not cause
    harm, at least for consumers that prefer draw:fill attributes like
    LO >= 4.4.
    
    (regression from 7d9bb549d498d6beed2c4050c402d09643febdfa)
    
    Change-Id: I5312901166a0e6f0cf02369b173dc8498e4113ed
    (cherry picked from commit f38f018053a43d1f7b473103e936abe2d4d8fa05)
    Reviewed-on: https://gerrit.libreoffice.org/18043
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/qa/extras/odfexport/data/tdf92379.fodt b/sw/qa/extras/odfexport/data/tdf92379.fodt
index 280dc5a..8aeb9c4 100644
--- a/sw/qa/extras/odfexport/data/tdf92379.fodt
+++ b/sw/qa/extras/odfexport/data/tdf92379.fodt
@@ -37,6 +37,32 @@
       </style:graphic-properties>
     </style:style>
 
+    <!-- "Titre Avis expert" and derived styles from bugdoc -->
+    <style:style style:name="Titre_20_Avis_20_expert" style:display-name="Titre Avis expert" style:family="paragraph" style:parent-style-name="Standard" style:master-page-name="">
+      <style:paragraph-properties fo:text-align="start" style:justify-single-word="false" style:page-number="auto" fo:background-color="#661900">
+        <style:background-image/>
+      </style:paragraph-properties>
+      <style:text-properties fo:color="#ffffff" />
+    </style:style>
+    <style:style style:name="Avis_20_expert_20_questions" style:display-name="Avis expert questions" style:family="paragraph" style:parent-style-name="Titre_20_Avis_20_expert" style:master-page-name="">
+      <style:paragraph-properties fo:line-height="100%" fo:text-align="start" style:justify-single-word="false" style:page-number="auto" fo:background-color="transparent">
+        <style:background-image/>
+      </style:paragraph-properties>
+      <style:text-properties fo:color="#661900" />
+    </style:style>
+    <style:style style:name="avis_20_expert_20_questions_20_non_20_cadres" style:display-name="avis expert questions non cadres" style:family="paragraph" style:parent-style-name="Avis_20_expert_20_questions" style:master-page-name="">
+      <style:paragraph-properties style:page-number="auto" fo:background-color="#801900" style:shadow="none">
+        <style:tab-stops/>
+        <style:background-image/>
+      </style:paragraph-properties>
+    </style:style>
+    <style:style style:name="Avis_20_expert_20_rXponses" style:display-name="Avis expert rXponses" style:family="paragraph" style:parent-style-name="Avis_20_expert_20_questions" style:master-page-name="">
+      <style:paragraph-properties fo:line-height="100%" fo:text-align="justify" style:justify-single-word="false" fo:orphans="0" fo:widows="0" fo:hyphenation-ladder-count="1" style:page-number="auto" fo:background-color="transparent">
+        <style:background-image/>
+      </style:paragraph-properties>
+      <style:text-properties fo:color="#461900" fo:hyphenate="true" fo:hyphenation-remain-char-count="2" fo:hyphenation-push-char-count="2"/>
+    </style:style>
+
  </office:styles>
  <office:automatic-styles>
   <style:page-layout style:name="pm1">
diff --git a/sw/qa/extras/odfexport/odfexport.cxx b/sw/qa/extras/odfexport/odfexport.cxx
index c1dc7ab..308a83d 100644
--- a/sw/qa/extras/odfexport/odfexport.cxx
+++ b/sw/qa/extras/odfexport/odfexport.cxx
@@ -82,7 +82,48 @@ DECLARE_ODFEXPORT_TEST(testTdf92379, "tdf92379.fodt")
     CPPUNIT_ASSERT_EQUAL(sal_Int32(0), getProperty<sal_Int32>(xStyle, "BackColorTransparency"));
     CPPUNIT_ASSERT_EQUAL(drawing::FillStyle_SOLID, getProperty<drawing::FillStyle>(xStyle, "FillStyle"));
     CPPUNIT_ASSERT_EQUAL(sal_Int32(0xffcc99), getProperty<sal_Int32>(xStyle, "FillColor"));
-    CPPUNIT_ASSERT_EQUAL(sal_Int32(0), getProperty<sal_Int32>(xStyle, "FillTransparence"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int16(0), getProperty<sal_Int16>(xStyle, "FillTransparence"));
+
+    // paragraph style fo:background-color was wrongly inherited despite being
+    // overridden in derived style
+    uno::Reference<container::XNameAccess> xParaStyles(getStyles("ParagraphStyles"));
+    uno::Reference<beans::XPropertySet> xStyle1(xParaStyles->getByName(
+            "Titre Avis expert"), uno::UNO_QUERY);
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0x661900), getProperty<sal_Int32>(xStyle1, "ParaBackColor"));
+    CPPUNIT_ASSERT_EQUAL(false, getProperty<bool>(xStyle1, "ParaBackTransparent"));
+    CPPUNIT_ASSERT_EQUAL(drawing::FillStyle_SOLID, getProperty<drawing::FillStyle>(xStyle1, "FillStyle"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0x661900), getProperty<sal_Int32>(xStyle1, "FillColor"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int16(0), getProperty<sal_Int16>(xStyle1, "FillTransparence"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0xffffff), getProperty<sal_Int32>(xStyle1, "CharColor"));
+
+    uno::Reference<beans::XPropertySet> xStyle2(xParaStyles->getByName(
+            "Avis expert questions"), uno::UNO_QUERY);
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(COL_TRANSPARENT), getProperty<sal_Int32>(xStyle2, "ParaBackColor"));
+    CPPUNIT_ASSERT_EQUAL(true, getProperty<bool>(xStyle2, "ParaBackTransparent"));
+    CPPUNIT_ASSERT_EQUAL(drawing::FillStyle_NONE, getProperty<drawing::FillStyle>(xStyle2, "FillStyle"));
+// unfortunately this is actually the pool default value, which would be hard to fix - but it isn't a problem because style is NONE
+//    CPPUNIT_ASSERT_EQUAL(sal_Int32(0xffffff), getProperty<sal_Int32>(xStyle2, "FillColor"));
+//    CPPUNIT_ASSERT_EQUAL(sal_Int16(100), getProperty<sal_Int16>(xStyle2, "FillTransparence"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0x661900), getProperty<sal_Int32>(xStyle2, "CharColor"));
+
+    uno::Reference<beans::XPropertySet> xStyle31(xParaStyles->getByName(
+            "avis expert questions non cadres"), uno::UNO_QUERY);
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0x801900), getProperty<sal_Int32>(xStyle31, "ParaBackColor"));
+    CPPUNIT_ASSERT_EQUAL(false, getProperty<bool>(xStyle31, "ParaBackTransparent"));
+    CPPUNIT_ASSERT_EQUAL(drawing::FillStyle_SOLID, getProperty<drawing::FillStyle>(xStyle31, "FillStyle"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0x801900), getProperty<sal_Int32>(xStyle31, "FillColor"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int16(0), getProperty<sal_Int16>(xStyle31, "FillTransparence"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0x661900), getProperty<sal_Int32>(xStyle31, "CharColor"));
+
+    uno::Reference<beans::XPropertySet> xStyle32(xParaStyles->getByName(
+            "Avis expert rXponses"), uno::UNO_QUERY);
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(COL_TRANSPARENT), getProperty<sal_Int32>(xStyle32, "ParaBackColor"));
+    CPPUNIT_ASSERT_EQUAL(true, getProperty<bool>(xStyle32, "ParaBackTransparent"));
+    CPPUNIT_ASSERT_EQUAL(drawing::FillStyle_NONE, getProperty<drawing::FillStyle>(xStyle32, "FillStyle"));
+// unfortunately this is actually the pool default value, which would be hard to fix - but it isn't a problem because style is NONE
+//    CPPUNIT_ASSERT_EQUAL(sal_Int32(0xffffff), getProperty<sal_Int32>(xStyle32, "FillColor"));
+//    CPPUNIT_ASSERT_EQUAL(sal_Int16(100), getProperty<sal_Int16>(xStyle32, "FillTransparence"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0x461900), getProperty<sal_Int32>(xStyle32, "CharColor"));
 }
 
 DECLARE_ODFEXPORT_TEST(testFdo79358, "fdo79358.odt")
diff --git a/sw/source/core/unocore/unostyle.cxx b/sw/source/core/unocore/unostyle.cxx
index a4c670b..28f25eb 100644
--- a/sw/source/core/unocore/unostyle.cxx
+++ b/sw/source/core/unocore/unostyle.cxx
@@ -1764,7 +1764,11 @@ static void lcl_SetStyleProperty(const SfxItemPropertySimpleEntry& rEntry,
 
             aChangedBrushItem.PutValue(aValue, nMemberId);
 
-            if(!(aChangedBrushItem == aOriginalBrushItem))
+            if (!(aChangedBrushItem == aOriginalBrushItem) ||
+                // 0xff is already the default - but if BackTransparent is set
+                // to true, it must be applied in the item set on ODF import
+                // to potentially override parent style, which is unknown yet
+                (MID_GRAPHIC_TRANSPARENT == nMemberId && aValue.has<bool>() && aValue.get<bool>()))
             {
                 setSvxBrushItemAsFillAttributesToTargetSet(aChangedBrushItem, rStyleSet);
             }
commit 3bd1d58838a02f197f7f9390d604addaf08764b7
Author: Michael Stahl <mstahl at redhat.com>
Date:   Fri Aug 21 18:28:23 2015 +0200

    tdf#92379: svx: don't overwrite fo:background-color on ODF import
    
    getSvxBrushItemFromSourceSet() is called once for each property of a
    frame style that is set, and the "solid" fill-style is set by first
    applying the BackColorRGB and then BackTransparency property.  So there
    is an intermediate state that has fill-style NONE but a XFillColorItem
    set - don't reset the color to white in that case!
    
    Apparently writerfilter generally relies on the current reset-to-AUTO
    implementation (loads of test failures), so for now limit the fix for
    when we know that a frame style is imported from ODF.
    
    (regression from 3d399b0e45720354fc64dc3d121ee486e01eff89)
    
    (cherry picked from commit 79fb61efb847405fa47235002b52ee8efad5e339)
    
    tdf#92379: sw: unit test for frame style background color
    
    (cherry picked from commit 982537d77c2db463cc053cfdcd522530a3834c9e)
    
    Change-Id: Ia987fe586ec819a1f3cd85acdbfb03c74ca0ec2c
    Reviewed-on: https://gerrit.libreoffice.org/18042
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/include/svx/unobrushitemhelper.hxx b/include/svx/unobrushitemhelper.hxx
index eea95b6..4055c45 100644
--- a/include/svx/unobrushitemhelper.hxx
+++ b/include/svx/unobrushitemhelper.hxx
@@ -46,7 +46,8 @@ SVX_DLLPUBLIC void setSvxBrushItemAsFillAttributesToTargetSet(
 SVX_DLLPUBLIC SvxBrushItem getSvxBrushItemFromSourceSet(
     const SfxItemSet& rSourceSet,
     sal_uInt16 nBackgroundID,
-    bool bSearchInParents = true);
+    bool bSearchInParents = true,
+    bool bXMLImportHack = false);
 
 #endif // _UNOBRUSHITEMHELPER_HXX
 
diff --git a/svx/source/unodraw/unobrushitemhelper.cxx b/svx/source/unodraw/unobrushitemhelper.cxx
index d10aab6..fb6728d 100644
--- a/svx/source/unodraw/unobrushitemhelper.cxx
+++ b/svx/source/unodraw/unobrushitemhelper.cxx
@@ -192,7 +192,7 @@ SvxBrushItem getSvxBrushItemForSolid(const SfxItemSet& rSourceSet, bool bSearchI
 }
 
 //UUUU
-SvxBrushItem getSvxBrushItemFromSourceSet(const SfxItemSet& rSourceSet, sal_uInt16 nBackgroundID, bool bSearchInParents)
+SvxBrushItem getSvxBrushItemFromSourceSet(const SfxItemSet& rSourceSet, sal_uInt16 nBackgroundID, bool bSearchInParents, bool bXMLImportHack)
 {
     const XFillStyleItem* pXFillStyleItem(static_cast< const XFillStyleItem*  >(rSourceSet.GetItem(XATTR_FILLSTYLE, bSearchInParents)));
 
@@ -201,8 +201,8 @@ SvxBrushItem getSvxBrushItemFromSourceSet(const SfxItemSet& rSourceSet, sal_uInt
         // no fill, still need to rescue the evtl. set RGB color, but use as transparent color (we have drawing::FillStyle_NONE)
         Color aFillColor(static_cast< const XFillColorItem& >(rSourceSet.Get(XATTR_FILLCOLOR, bSearchInParents)).GetColorValue());
 
-        // when fill style is none, then don't allow anything other than 0 or auto.
-        if (aFillColor.GetColor() != 0)
+        // for writerfilter: when fill style is none, then don't allow anything other than 0 or auto.
+        if (!bXMLImportHack && aFillColor.GetColor() != 0)
             aFillColor.SetColor(COL_AUTO);
 
         aFillColor.SetTransparency(0xff);
diff --git a/sw/CppunitTest_sw_odfexport.mk b/sw/CppunitTest_sw_odfexport.mk
index 7bc7ed8..c6ec626 100644
--- a/sw/CppunitTest_sw_odfexport.mk
+++ b/sw/CppunitTest_sw_odfexport.mk
@@ -56,6 +56,9 @@ $(eval $(call gb_CppunitTest_use_components,sw_odfexport,\
     embeddedobj/util/embobj \
     filter/source/config/cache/filterconfig1 \
     filter/source/storagefilterdetect/storagefd \
+	filter/source/odfflatxml/odfflatxml \
+	filter/source/xmlfilterdetect/xmlfd \
+	filter/source/xmlfilteradaptor/xmlfa \
     framework/util/fwk \
     i18npool/util/i18npool \
     linguistic/source/lng \
diff --git a/sw/qa/extras/odfexport/data/tdf92379.fodt b/sw/qa/extras/odfexport/data/tdf92379.fodt
new file mode 100644
index 0000000..280dc5a
--- /dev/null
+++ b/sw/qa/extras/odfexport/data/tdf92379.fodt
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<office:document xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" xmlns:style="urn:oasis:names:tc:opendocument:xmlns:style:1.0" xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0" xmlns:table="urn:oasis:names:tc:opendocument:xmlns:table:1.0" xmlns:draw="urn:oasis:names:tc:opendocument:xmlns:drawing:1.0" xmlns:fo="urn:oasis:names:tc:opendocument:xmlns:xsl-fo-compatible:1.0" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:meta="urn:oasis:names:tc:opendocument:xmlns:meta:1.0" xmlns:number="urn:oasis:names:tc:opendocument:xmlns:datastyle:1.0" xmlns:svg="urn:oasis:names:tc:opendocument:xmlns:svg-compatible:1.0" xmlns:chart="urn:oasis:names:tc:opendocument:xmlns:chart:1.0" xmlns:dr3d="urn:oasis:names:tc:opendocument:xmlns:dr3d:1.0" xmlns:math="http://www.w3.org/1998/Math/MathML" xmlns:form="urn:oasis:names:tc:opendocument:xmlns:form:1.0" xmlns:script="urn:oasis:names:tc:opendocument:xmlns:script:1.0" xmlns:config="urn:oas
 is:names:tc:opendocument:xmlns:config:1.0" xmlns:ooo="http://openoffice.org/2004/office" xmlns:ooow="http://openoffice.org/2004/writer" xmlns:oooc="http://openoffice.org/2004/calc" xmlns:dom="http://www.w3.org/2001/xml-events" xmlns:xforms="http://www.w3.org/2002/xforms" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:rpt="http://openoffice.org/2005/report" xmlns:of="urn:oasis:names:tc:opendocument:xmlns:of:1.2" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:grddl="http://www.w3.org/2003/g/data-view#" xmlns:officeooo="http://openoffice.org/2009/office" xmlns:tableooo="http://openoffice.org/2009/table" xmlns:drawooo="http://openoffice.org/2010/draw" xmlns:calcext="urn:org:documentfoundation:names:experimental:calc:xmlns:calcext:1.0" xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0" xmlns:field="urn:openoffice:names:experimental:ooo-ms-interop:xmlns:field:1.0" xmlns:formx="urn:openoffice:names:
 experimental:ooxml-odf-interop:xmlns:form:1.0" xmlns:css3t="http://www.w3.org/TR/css3-text/" office:version="1.2" office:mimetype="application/vnd.oasis.opendocument.text">
+ <office:meta><meta:initial-creator>ms </meta:initial-creator><meta:creation-date>2015-08-24T21:49:45.305718699</meta:creation-date><meta:document-statistic meta:table-count="0" meta:image-count="0" meta:object-count="0" meta:page-count="1" meta:paragraph-count="0" meta:word-count="0" meta:character-count="0" meta:non-whitespace-character-count="0"/><meta:generator>LibreOfficeDev/4.3.7.2$Linux_X86_64 LibreOffice_project/8a35821d8636a03b8bf4e15b48f59794652c68ba</meta:generator></office:meta>
+ <office:font-face-decls>
+  <style:font-face style:name="Lohit Devanagari1" svg:font-family="'Lohit Devanagari'"/>
+  <style:font-face style:name="Liberation Serif" svg:font-family="'Liberation Serif'" style:font-family-generic="roman" style:font-pitch="variable"/>
+  <style:font-face style:name="Liberation Sans" svg:font-family="'Liberation Sans'" style:font-family-generic="swiss" style:font-pitch="variable"/>
+  <style:font-face style:name="Lohit Devanagari" svg:font-family="'Lohit Devanagari'" style:font-family-generic="system" style:font-pitch="variable"/>
+  <style:font-face style:name="Source Han Sans CN Regular" svg:font-family="'Source Han Sans CN Regular'" style:font-family-generic="system" style:font-pitch="variable"/>
+ </office:font-face-decls>
+ <office:styles>
+  <style:default-style style:family="graphic">
+   <style:graphic-properties svg:stroke-color="#3465a4" draw:fill-color="#729fcf" fo:wrap-option="no-wrap" draw:shadow-offset-x="0.3cm" draw:shadow-offset-y="0.3cm" draw:start-line-spacing-horizontal="0.283cm" draw:start-line-spacing-vertical="0.283cm" draw:end-line-spacing-horizontal="0.283cm" draw:end-line-spacing-vertical="0.283cm" style:flow-with-text="false"/>
+   <style:paragraph-properties style:text-autospace="ideograph-alpha" style:line-break="strict" style:writing-mode="lr-tb" style:font-independent-line-spacing="false">
+    <style:tab-stops/>
+   </style:paragraph-properties>
+   <style:text-properties style:use-window-font-color="true" style:font-name="Liberation Serif" fo:font-size="12pt" fo:language="de" fo:country="DE" style:letter-kerning="true" style:font-name-asian="Source Han Sans CN Regular" style:font-size-asian="10.5pt" style:language-asian="zh" style:country-asian="CN" style:font-name-complex="Lohit Devanagari" style:font-size-complex="12pt" style:language-complex="hi" style:country-complex="IN"/>
+  </style:default-style>
+  <style:default-style style:family="paragraph">
+   <style:paragraph-properties fo:hyphenation-ladder-count="no-limit" style:text-autospace="ideograph-alpha" style:punctuation-wrap="hanging" style:line-break="strict" style:tab-stop-distance="1.251cm" style:writing-mode="page"/>
+   <style:text-properties style:use-window-font-color="true" style:font-name="Liberation Serif" fo:font-size="12pt" fo:language="de" fo:country="DE" style:letter-kerning="true" style:font-name-asian="Source Han Sans CN Regular" style:font-size-asian="10.5pt" style:language-asian="zh" style:country-asian="CN" style:font-name-complex="Lohit Devanagari" style:font-size-complex="12pt" style:language-complex="hi" style:country-complex="IN" fo:hyphenate="false" fo:hyphenation-remain-char-count="2" fo:hyphenation-push-char-count="2"/>
+  </style:default-style>
+  <style:default-style style:family="table">
+   <style:table-properties table:border-model="collapsing"/>
+  </style:default-style>
+  <style:default-style style:family="table-row">
+   <style:table-row-properties fo:keep-together="auto"/>
+  </style:default-style>
+  <style:style style:name="Standard" style:family="paragraph" style:class="text"/>
+
+    <!-- "encarts" from bugdoc -->
+    <style:style style:name="encarts" style:family="graphic">
+      <style:graphic-properties svg:width="3.9701in" svg:height="0.1402in" text:anchor-type="paragraph" fo:background-color="#ffcc99" style:background-transparency="0%" draw:fill="solid" fo:padding="0.0193in" fo:border="0.79pt solid #661900" style:shadow="none" draw:shadow-opacity="100%">
+        <style:background-image/>
+        <style:columns fo:column-count="1" fo:column-gap="0in"/>
+      </style:graphic-properties>
+    </style:style>
+
+ </office:styles>
+ <office:automatic-styles>
+  <style:page-layout style:name="pm1">
+   <style:page-layout-properties fo:page-width="21.001cm" fo:page-height="29.7cm" style:num-format="1" style:print-orientation="portrait" fo:margin-top="2cm" fo:margin-bottom="2cm" fo:margin-left="2cm" fo:margin-right="2cm" style:writing-mode="lr-tb" style:footnote-max-height="0cm">
+    <style:footnote-sep style:width="0.018cm" style:distance-before-sep="0.101cm" style:distance-after-sep="0.101cm" style:line-style="solid" style:adjustment="left" style:rel-width="25%" style:color="#000000"/>
+   </style:page-layout-properties>
+   <style:header-style/>
+   <style:footer-style/>
+  </style:page-layout>
+ </office:automatic-styles>
+ <office:master-styles>
+  <style:master-page style:name="Standard" style:page-layout-name="pm1"/>
+ </office:master-styles>
+ <office:body>
+  <office:text>
+   <text:p text:style-name="Standard"/>
+  </office:text>
+ </office:body>
+</office:document>
diff --git a/sw/qa/extras/odfexport/odfexport.cxx b/sw/qa/extras/odfexport/odfexport.cxx
index a7c1a18..c1dc7ab 100644
--- a/sw/qa/extras/odfexport/odfexport.cxx
+++ b/sw/qa/extras/odfexport/odfexport.cxx
@@ -72,6 +72,19 @@ DECLARE_ODFEXPORT_TEST(testFdo38244, "fdo38244.odt")
     CPPUNIT_ASSERT_EQUAL(OUString("M"), getProperty<OUString>(xPropertySet, "Initials"));
 }
 
+DECLARE_ODFEXPORT_TEST(testTdf92379, "tdf92379.fodt")
+{
+    // frame style fo:background-color was not imported
+    uno::Reference<container::XNameAccess> xStyles(getStyles("FrameStyles"));
+    uno::Reference<beans::XPropertySet> xStyle(xStyles->getByName("encarts"),
+            uno::UNO_QUERY);
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0xffcc99), getProperty<sal_Int32>(xStyle, "BackColorRGB"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0), getProperty<sal_Int32>(xStyle, "BackColorTransparency"));
+    CPPUNIT_ASSERT_EQUAL(drawing::FillStyle_SOLID, getProperty<drawing::FillStyle>(xStyle, "FillStyle"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0xffcc99), getProperty<sal_Int32>(xStyle, "FillColor"));
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(0), getProperty<sal_Int32>(xStyle, "FillTransparence"));
+}
+
 DECLARE_ODFEXPORT_TEST(testFdo79358, "fdo79358.odt")
 {
     // the boolean properties of the index were not exported properly
diff --git a/sw/source/core/unocore/unostyle.cxx b/sw/source/core/unocore/unostyle.cxx
index 2329c74..a4c670b 100644
--- a/sw/source/core/unocore/unostyle.cxx
+++ b/sw/source/core/unocore/unostyle.cxx
@@ -1759,7 +1759,7 @@ static void lcl_SetStyleProperty(const SfxItemPropertySimpleEntry& rEntry,
         {
             //UUUU
             SfxItemSet& rStyleSet = rBase.GetItemSet();
-            const SvxBrushItem aOriginalBrushItem(getSvxBrushItemFromSourceSet(rStyleSet, RES_BACKGROUND));
+            const SvxBrushItem aOriginalBrushItem(getSvxBrushItemFromSourceSet(rStyleSet, RES_BACKGROUND, true, pDoc->IsInXMLImport()));
             SvxBrushItem aChangedBrushItem(aOriginalBrushItem);
 
             aChangedBrushItem.PutValue(aValue, nMemberId);
@@ -4298,7 +4298,7 @@ uno::Reference< style::XAutoStyle > SwXAutoStyleFamily::insertStyle(
                 case RES_BACKGROUND:
                 {
                     //UUUU
-                    const SvxBrushItem aOriginalBrushItem(getSvxBrushItemFromSourceSet(aSet, RES_BACKGROUND));
+                    const SvxBrushItem aOriginalBrushItem(getSvxBrushItemFromSourceSet(aSet, RES_BACKGROUND, true, pDocShell->GetDoc()->IsInXMLImport()));
                     SvxBrushItem aChangedBrushItem(aOriginalBrushItem);
 
                     aChangedBrushItem.PutValue(aValue, nMemberId);
commit 97907662840b89190688f805b20eb108c069edcf
Author: Michael Stahl <mstahl at redhat.com>
Date:   Mon Aug 24 22:56:17 2015 +0200

    sw: Flat ODF import: set the InReading and InXMLImport flags
    
    Flat ODF Import does not use SwReader but uses
    SwXMLImport::startDocument() and SwXMLImport::endDocument() to set up
    the document, so make sure those set the import relevant SwDoc flags.
    
    (cherry picked from commit 27a02d1708be7812668a84ea956edc8ecb312246)
    
    Change-Id: Ife3e58eeebd73ad895fe328662822b847cf9bfec
    Reviewed-on: https://gerrit.libreoffice.org/18041
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/xml/xmlimp.cxx b/sw/source/filter/xml/xmlimp.cxx
index f59c732..7913153 100644
--- a/sw/source/filter/xml/xmlimp.cxx
+++ b/sw/source/filter/xml/xmlimp.cxx
@@ -651,6 +651,13 @@ void SwXMLImport::startDocument()
     if( !pDoc )
         return;
 
+    if (IMPORT_ALL == getImportFlags())
+    {
+        // for flat ODF - this is done in SwReader::Read() for package ODF
+        pDoc->SetInReading(true);
+        pDoc->SetInXMLImport(true);
+    }
+
     if( (getImportFlags() & IMPORT_CONTENT) != 0 && !IsStylesOnlyMode() )
     {
         pSttNdIdx = new SwNodeIndex( pDoc->GetNodes() );
@@ -875,6 +882,11 @@ void SwXMLImport::endDocument( void )
                 pDoc->PrtOLENotify( false );
             else if ( pDoc->IsOLEPrtNotifyPending() )
                 pDoc->PrtOLENotify( true );
+
+            assert(pDoc->IsInReading());
+            assert(pDoc->IsInXMLImport());
+            pDoc->SetInReading(false);
+            pDoc->SetInXMLImport(false);
         }
 
         SwDrawModel* pDrawModel = pDoc->getIDocumentDrawModelAccess().GetDrawModel();
commit d9f2d87c90dac516f46d250f2eb02adb26a56e6a
Author: Michael Stahl <mstahl at redhat.com>
Date:   Fri Aug 28 18:37:37 2015 +0200

    vcl: fix resource management issue in WinSalLayout
    
    Since commit 65a66d41fd0e13d0aad9df935091b731b4af650a the
    sd_exports_test crashes on Windows in UniscribeLayout because
    it uses a ImplFontEntry that has been removed from the font cache.
    
    Tweak the refcount in WinLayout so it will be valid.
    
    (cherry picked from commit 34700400247e378e074ce4164ab2809edb092201)
    
    Change-Id: Ic4bf984ea9fd70de9fa95ca964ae12d95d47d5bf
    Reviewed-on: https://gerrit.libreoffice.org/18120
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/vcl/inc/outfont.hxx b/vcl/inc/outfont.hxx
index 0f28657..adca1cd 100644
--- a/vcl/inc/outfont.hxx
+++ b/vcl/inc/outfont.hxx
@@ -35,6 +35,7 @@ class PhysicalFontFamily;
 class ImplGetDevFontList;
 class ImplGetDevSizeList;
 class ImplFontEntry;
+class ImplFontCache;
 class ImplPreMatchFontSubstitution;
 class ImplGlyphFallbackFontSubstitution;
 class FontSelectPattern;
@@ -226,6 +227,7 @@ public:
     virtual             ~ImplFontEntry();
 
 public: // TODO: make data members private
+    ImplFontCache * m_pFontCache;
     FontSelectPattern  maFontSelData;      // FontSelectionData
     ImplFontMetricData  maMetric;           // Font Metric
     const ConvertChar*  mpConversion;       // used e.g. for StarBats->StarSymbol
diff --git a/vcl/source/outdev/font.cxx b/vcl/source/outdev/font.cxx
index 068b2bb..6e46b80 100644
--- a/vcl/source/outdev/font.cxx
+++ b/vcl/source/outdev/font.cxx
@@ -951,7 +951,8 @@ Font OutputDevice::GetDefaultFont( sal_uInt16 nType, LanguageType eLang,
 }
 
 ImplFontEntry::ImplFontEntry( const FontSelectPattern& rFontSelData )
-    : maFontSelData( rFontSelData )
+    : m_pFontCache(nullptr)
+    , maFontSelData( rFontSelData )
     , maMetric( rFontSelData )
     , mpConversion( NULL )
     , mnLineHeight( 0 )
@@ -968,6 +969,7 @@ ImplFontEntry::ImplFontEntry( const FontSelectPattern& rFontSelData )
 ImplFontEntry::~ImplFontEntry()
 {
     delete mpUnicodeFallbackList;
+    m_pFontCache = nullptr;
 }
 
 size_t ImplFontEntry::GFBCacheKey_Hash::operator()( const GFBCacheKey& rData ) const
@@ -1303,6 +1305,7 @@ ImplFontEntry* ImplFontCache::GetFontEntry( PhysicalFontCollection* pFontList,
     {
         // create a new logical font instance from this physical font face
         pEntry = pFontData->CreateFontInstance( aFontSelData );
+        pEntry->m_pFontCache = this;
 
         // if we're subtituting from or to a symbol font we may need a symbol
         // conversion table
diff --git a/vcl/win/source/gdi/winlayout.cxx b/vcl/win/source/gdi/winlayout.cxx
index 4a147b0..d010985 100644
--- a/vcl/win/source/gdi/winlayout.cxx
+++ b/vcl/win/source/gdi/winlayout.cxx
@@ -27,6 +27,7 @@
 #include <vcl/opengl/OpenGLHelper.hxx>
 #include <win/salgdi.h>
 #include <win/saldata.hxx>
+#include <outdev.h>
 
 #include "sft.hxx"
 #include "sallayout.hxx"
@@ -113,8 +114,14 @@ WinLayout::WinLayout(HDC hDC, const ImplWinFontData& rWFD, ImplWinFontEntry& rWF
     mrWinFontData( rWFD ),
     mrWinFontEntry(rWFE),
     mbUseOpenGL(bUseOpenGL)
-{}
+{
+    ++mrWinFontEntry.mnRefCount; // keep it alive
+}
 
+WinLayout::~WinLayout()
+{
+    mrWinFontEntry.m_pFontCache->Release(&mrWinFontEntry);
+}
 void WinLayout::InitFont() const
 {
     ::SelectObject( mhDC, mhFont );
diff --git a/vcl/win/source/gdi/winlayout.hxx b/vcl/win/source/gdi/winlayout.hxx
index 7847665..e362f5a 100644
--- a/vcl/win/source/gdi/winlayout.hxx
+++ b/vcl/win/source/gdi/winlayout.hxx
@@ -41,6 +41,7 @@ class WinLayout : public SalLayout
 {
 public:
                         WinLayout(HDC, const ImplWinFontData&, ImplWinFontEntry&, bool bUseOpenGL);
+    virtual             ~WinLayout();
     virtual void        InitFont() const;
     void                SetFontScale( float f ) { mfFontScale = f; }
     HFONT               DisableFontScaling( void) const;
commit f4c6049e742d3d1558fac32322b53672ca48137b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Aug 28 16:14:07 2015 +0100

    check stream status
    
    Change-Id: I609c8c4f4e843601361b61f55e0325ad99db3c23
    (cherry picked from commit dc1be62d75e654e17c2f4c02804b7fd48d5a2515)
    Reviewed-on: https://gerrit.libreoffice.org/18119
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/sd/qa/unit/data/ppt/pass/hang-20.ppt b/sd/qa/unit/data/ppt/pass/hang-20.ppt
new file mode 100644
index 0000000..7bfe75d
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-20.ppt differ
diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx
index e5b15df..27f483d 100644
--- a/sd/source/filter/ppt/pptin.cxx
+++ b/sd/source/filter/ppt/pptin.cxx
@@ -278,7 +278,6 @@ bool ImplSdPPTImport::Import()
                     if ( nSlideCount && pSection->GetProperty( PID_HEADINGPAIR, aPropItem ) )
                     {
                         sal_uInt32  nSlideTitleIndex = 0, nSlideTitleCount = 0;
-                        sal_uInt32  i, nTemp;
 
                         OUString aUString;
 
@@ -289,13 +288,14 @@ bool ImplSdPPTImport::Import()
                         {
                             nVecCount >>= 1;
                             sal_uInt32 nEntryCount = 0;
-                            for ( i = 0; i < nVecCount; i++ )
+                            for (sal_uInt32 i = 0; i < nVecCount; ++i)
                             {
                                 if ( !aPropItem.Read( aUString, VT_EMPTY, false ) )
                                     break;
                                 aPropItem.ReadUInt32( nType );
                                 if ( ( nType != VT_I4 ) && ( nType != VT_UI4 ) )
                                     break;
+                                sal_uInt32 nTemp(0);
                                 aPropItem.ReadUInt32( nTemp );
                                 if ( aUString == "Slide Titles" || aUString == "Folientitel" )
                                 {
@@ -310,17 +310,33 @@ bool ImplSdPPTImport::Import()
                             aPropItem.ReadUInt32( nType )
                                      .ReadUInt32( nVecCount );
 
-                            if ( ( nVecCount >= ( nSlideTitleIndex + nSlideTitleCount ) )
-                                    && ( nType == ( VT_LPSTR | VT_VECTOR ) ) )
+                            bool bVecOk = ( ( nVecCount >= (nSlideTitleIndex + nSlideTitleCount) )
+                                    && ( nType == ( VT_LPSTR | VT_VECTOR ) ) );
+
+                            if (bVecOk)
                             {
-                                for ( i = 0; i != nSlideTitleIndex; i++ )
+                                for (sal_uInt32 i = 0; i != nSlideTitleIndex; ++i)
                                 {
-                                    aPropItem.ReadUInt32( nTemp );
-                                    aPropItem.SeekRel( nTemp );
+                                    sal_uInt32 nTemp(0);
+                                    aPropItem.ReadUInt32(nTemp);
+                                    if (!aPropItem.good())
+                                    {
+                                        bVecOk = false;
+                                        break;
+                                    }
+                                    auto nPos = aPropItem.Tell() + nTemp;
+                                    if (nPos != aPropItem.Seek(nPos))
+                                    {
+                                        bVecOk = false;
+                                        break;
+                                    }
                                 }
-                                for ( i = 0; i < nSlideTitleCount; i++ )
+                            }
+                            if (bVecOk)
+                            {
+                                for (sal_uInt32 i = 0; i < nSlideTitleCount; ++i)
                                 {
-                                    if ( !aPropItem.Read( aUString, nType, false ) )
+                                    if (!aPropItem.Read(aUString, nType, false))
                                         break;
 
                                     OUString aString( aUString );
commit d58a58d027af25a445736ea16201e72d47e39fcc
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Aug 28 15:33:44 2015 +0100

    eof isn't a Error, so use good not GetError
    
    Change-Id: Ie1df87c7eb9d391d0fa4a579f744051a1f1b2ae1
    (cherry picked from commit 078235028a8c4ea36b6b366348016e19759c456a)
    Reviewed-on: https://gerrit.libreoffice.org/18118
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index 47a89e0..bab72e3 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -4147,17 +4147,17 @@ SdrObject* SvxMSDffManager::ImportShape( const DffRecordHeader& rHd, SvStream& r
         SEEK_FROM_BEGINNING ) )
     {
         sal_uInt32  nBytesLeft = maShapeRecords.Current()->nRecLen;
-        sal_uInt32  nUDData;
-        sal_uInt16  nPID;
         while( 5 < nBytesLeft )
         {
-            rSt.ReadUInt16( nPID );
-            if ( rSt.GetError() != 0 )
+            sal_uInt16 nPID(0);
+            rSt.ReadUInt16(nPID);
+            if (!rSt.good())
                 break;
-            rSt.ReadUInt32( nUDData );
-            if ( rSt.GetError() != 0 )
+            sal_uInt32 nUDData(0);
+            rSt.ReadUInt32(nUDData);
+            if (!rSt.good())
                 break;
-            if ( nPID == 447 )
+            if (nPID == 447)
             {
                 mbRotateGranientFillWithAngle = nUDData & 0x20;
                 break;
@@ -4979,15 +4979,15 @@ SdrObject* SvxMSDffManager::ProcessObj(SvStream& rSt,
             && maShapeRecords.Current()->nRecLen )
         {
             sal_uInt32  nBytesLeft = maShapeRecords.Current()->nRecLen;
-            sal_uInt32  nUDData;
-            sal_uInt16  nPID;
             while( 5 < nBytesLeft )
             {
-                rSt.ReadUInt16( nPID );
-                if ( rSt.GetError() != 0 )
+                sal_uInt16 nPID(0);
+                rSt.ReadUInt16(nPID);
+                if (!rSt.good())
                     break;
-                rSt.ReadUInt32( nUDData );
-                switch( nPID )
+                sal_uInt32 nUDData(0);
+                rSt.ReadUInt32(nUDData);
+                switch (nPID)
                 {
                     case 0x038F: pImpRec->nXAlign = nUDData; break;
                     case 0x0390:
@@ -5017,7 +5017,7 @@ SdrObject* SvxMSDffManager::ProcessObj(SvStream& rSt,
                         pImpRec->isHorizontalRule = true;
                         break;
                 }
-                if ( rSt.GetError() != 0 )
+                if (!rSt.good())
                     break;
                 nBytesLeft  -= 6;
             }
diff --git a/sd/qa/unit/data/ppt/pass/hang-19.ppt b/sd/qa/unit/data/ppt/pass/hang-19.ppt
new file mode 100644
index 0000000..942a58a
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-19.ppt differ
commit 1603f24434a351858c62ea9a06ff55273b8e46c8
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Aug 28 14:33:05 2015 +0100

    guard against 0 item size
    
    Change-Id: I9c4c2f0fe2d892615b3c70e08da0cab6da13338a
    (cherry picked from commit 2aadad1e89e96cb80c15fe1069cb6365f0cade1d)
    Reviewed-on: https://gerrit.libreoffice.org/18117
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/sd/qa/unit/data/ppt/pass/crash-2.ppt b/sd/qa/unit/data/ppt/pass/crash-2.ppt
new file mode 100644
index 0000000..78a4da4
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/crash-2.ppt differ
diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx
index 54807ef..1dbb832 100644
--- a/sd/source/filter/ppt/propread.cxx
+++ b/sd/source/filter/ppt/propread.cxx
@@ -93,7 +93,7 @@ bool PropItem::Read( OUString& rString, sal_uInt32 nStringType, bool bAlign )
     {
         case VT_LPSTR :
         {
-            if ( nItemSize )
+            if (nItemSize)
             {
                 auto nMaxSizePossible = remainingSize();
                 if (nItemSize > nMaxSizePossible)
@@ -101,6 +101,10 @@ bool PropItem::Read( OUString& rString, sal_uInt32 nStringType, bool bAlign )
                     SAL_WARN("sd.filter", "String of Len " << nItemSize << " claimed, only " << nMaxSizePossible << " possible");
                     nItemSize = nMaxSizePossible;
                 }
+            }
+
+            if (nItemSize)
+            {
                 try
                 {
                     sal_Char* pString = new sal_Char[ nItemSize ];
@@ -144,7 +148,7 @@ bool PropItem::Read( OUString& rString, sal_uInt32 nStringType, bool bAlign )
 
         case VT_LPWSTR :
         {
-            if ( nItemSize )
+            if (nItemSize)
             {
                 auto nMaxSizePossible = remainingSize() / sizeof(sal_Unicode);
                 if (nItemSize > nMaxSizePossible)
@@ -152,7 +156,10 @@ bool PropItem::Read( OUString& rString, sal_uInt32 nStringType, bool bAlign )
                     SAL_WARN("sd.filter", "String of Len " << nItemSize << " claimed, only " << nMaxSizePossible << " possible");
                     nItemSize = nMaxSizePossible;
                 }
+            }
 
+            if (nItemSize)
+            {
                 try
                 {
                     sal_Unicode* pString = new sal_Unicode[ nItemSize ];
commit 98c2e1984c678a79f4876fe08ff7578828510234
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Aug 28 08:28:51 2015 +0100

    check seeks and reads
    
    Change-Id: I0c5c4784713376e0762bfbd197640f8d31b65562
    (cherry picked from commit 1847753ab135f522df6a293a8539155437f0129f)
    Reviewed-on: https://gerrit.libreoffice.org/18116
    Reviewed-by: David Tardon <dtardon at redhat.com>
    Tested-by: David Tardon <dtardon at redhat.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index 40c3349..e1e14b8 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -782,7 +782,8 @@ SdrObject* SdrEscherImport::ProcessObj( SvStream& rSt, DffObjData& rObjData, voi
                     }
                     break;
                 }
-                aClientDataHd.SeekToEndOfRecord( rSt );
+                if (!aClientDataHd.SeekToEndOfRecord(rSt))
+                    break;
             }
         }
         if ( ( aPlaceholderAtom.nPlaceholderId == PPT_PLACEHOLDER_NOTESSLIDEIMAGE ) && ( rPersistEntry.bNotesMaster == false ) )
@@ -1798,7 +1799,10 @@ SdrObject* SdrPowerPointImport::ImportOLE( long nOLEId,
                 break;
             }
             else
-                aPlaceHd.SeekToEndOfRecord( rStCtrl );
+            {
+                if (!aPlaceHd.SeekToEndOfRecord(rStCtrl))
+                    break;
+            }
         }
     }
 
@@ -2390,7 +2394,8 @@ bool SdrPowerPointImport::SeekToContentOfProgTag( sal_Int32 nVersion, SvStream&
                     }
                 }
             }
-            aProgTagBinaryDataHd.SeekToEndOfRecord( rSt );
+            if (!aProgTagBinaryDataHd.SeekToEndOfRecord(rSt))
+                break;
         }
     }
     if ( !bRetValue )
@@ -2691,7 +2696,8 @@ void ImportComment10( SvxMSDffManager& rMan, SvStream& rStCtrl, SdrPage* pPage,
             }
             break;
         }
-        aCommentHd.SeekToEndOfRecord( rStCtrl );
+        if (!aCommentHd.SeekToEndOfRecord(rStCtrl))
+            break;
     }
     Point aPosition( nPosX, nPosY );
     rMan.Scale( aPosition );
@@ -2751,7 +2757,8 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet, const PptSlidePersistEntry*
                         while( ( rStCtrl.GetError() == 0 ) && SeekToRec( rStCtrl, PPT_PST_Comment10, aContentDataHd.GetRecEndFilePos(), &aComment10Hd ) )
                         {
                             ImportComment10( *this, rStCtrl, pRet, aComment10Hd );
-                            aComment10Hd.SeekToEndOfRecord( rStCtrl );
+                            if (!aComment10Hd.SeekToEndOfRecord(rStCtrl))
+                                break;
                         }
                     }
                 }
@@ -2829,7 +2836,8 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet, const PptSlidePersistEntry*
                             }
                             if ( aEscherObjListHd.nRecType == DFF_msofbtSpContainer )
                                 break;
-                            aEscherObjListHd.SeekToEndOfRecord( rStCtrl );
+                            if (!aEscherObjListHd.SeekToEndOfRecord(rStCtrl))
+                                break;
                         }
 
                         // now importing page
@@ -2879,7 +2887,8 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet, const PptSlidePersistEntry*
                             }
                             if ( aEscherObjListHd.nRecType == DFF_msofbtSpgrContainer )
                                 break;
-                            aEscherObjListHd.SeekToEndOfRecord( rStCtrl );
+                            if (!aEscherObjListHd.SeekToEndOfRecord(rStCtrl))
+                                break;
                         }
 
                         if ( rSlidePersist.pBObj )
@@ -2895,7 +2904,8 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet, const PptSlidePersistEntry*
                 }
                 break;
             }
-            aHd.SeekToEndOfRecord( rStCtrl );
+            if (!aHd.SeekToEndOfRecord(rStCtrl))
+                break;
         }
         if ( rSlidePersist.pSolverContainer )
             SolveSolver( *rSlidePersist.pSolverContainer );
@@ -3115,7 +3125,8 @@ void SdrEscherImport::ImportHeaderFooterContainer( DffRecordHeader& rHd, HeaderF
             }
             break;
         }
-        aHd.SeekToEndOfRecord( rStCtrl );
+        if (!aHd.SeekToEndOfRecord(rStCtrl))
+            break;
     }
 }
 
@@ -3253,7 +3264,8 @@ PPTExtParaProv::PPTExtParaProv( SdrPowerPointImport& rMan, SvStream& rSt, const
 #ifdef DBG_UTIL
                         else OSL_FAIL( "PPTExParaProv::PPTExParaProv - unknown atom interpreting the PPT_PST_ExtendedBuGraContainer (SJ)" );
 #endif
-                        aBuGraAtomHd.SeekToEndOfRecord( rSt );
+                        if (!aBuGraAtomHd.SeekToEndOfRecord(rSt))
+                            break;
                     }
                     if ( !aBuGraList.empty() )
                         bGraphics = true;
@@ -3277,7 +3289,8 @@ PPTExtParaProv::PPTExtParaProv( SdrPowerPointImport& rMan, SvStream& rSt, const
                 break;
 #endif
             }
-            aHd.SeekToEndOfRecord( rSt );
+            if (!aHd.SeekToEndOfRecord(rSt))
+                break;
         }
         break;
     }
@@ -3329,7 +3342,8 @@ PPTExtParaProv::PPTExtParaProv( SdrPowerPointImport& rMan, SvStream& rSt, const
                 case 0xf144 :
                 break;
             }
-            aHd.SeekToEndOfRecord( rSt );
+            if (!aHd.SeekToEndOfRecord(rSt))
+                break;
         }
         break;
     }
@@ -4107,7 +4121,10 @@ PPTStyleSheet::PPTStyleSheet( const DffRecordHeader& rSlideHd, SvStream& rIn, Sd
                 break;
             }
             else
-                aTxMasterStyleHd.SeekToEndOfRecord( rIn );
+            {
+                if (!aTxMasterStyleHd.SeekToEndOfRecord(rIn))
+                    break;
+            }
         }
     }
 
@@ -4121,7 +4138,10 @@ PPTStyleSheet::PPTStyleSheet( const DffRecordHeader& rSlideHd, SvStream& rIn, Sd
         if ( aTxMasterStyleHd.nRecType == PPT_PST_TxMasterStyleAtom )
             break;
         else
-            aTxMasterStyleHd.SeekToEndOfRecord( rIn );
+        {
+            if (!aTxMasterStyleHd.SeekToEndOfRecord(rIn))
+                break;
+        }
     }
     while ( ( aTxMasterStyleHd.nRecType == PPT_PST_TxMasterStyleAtom ) && ( rIn.Tell() < nEndRecPos ) ) //TODO: aTxMasterStyleHd may be used without having been properly initialized
     {
@@ -4223,7 +4243,8 @@ PPTStyleSheet::PPTStyleSheet( const DffRecordHeader& rSlideHd, SvStream& rIn, Sd
             }
 #endif
         }
-        aTxMasterStyleHd.SeekToEndOfRecord( rIn );
+        if (!aTxMasterStyleHd.SeekToEndOfRecord(rIn))
+            break;
         ReadDffRecordHeader( rIn, aTxMasterStyleHd );
     }
     if ( !mpCharSheet[ TSS_TYPE_SUBTITLE ] )
@@ -4296,7 +4317,10 @@ PPTStyleSheet::PPTStyleSheet( const DffRecordHeader& rSlideHd, SvStream& rIn, Sd
                     break;
                 }
                 else
-                    aTxMasterStyleHd2.SeekToEndOfRecord( rIn );
+                {
+                    if (!aTxMasterStyleHd2.SeekToEndOfRecord(rIn))
+                        break;
+                }
             }
         }
     }
@@ -6488,7 +6512,8 @@ PPTTextObj::PPTTextObj( SvStream& rIn, SdrPowerPointImport& rSdrPowerPointImport
 
                                 if ( ( nTmpSlideId == nSlideId ) && ( pHd->nRecInstance == nRefNum ) )
                                 {
-                                    pHd->SeekToEndOfRecord( rIn );
+                                    if (!pHd->SeekToEndOfRecord(rIn))
+                                        break;
                                     ReadDffRecordHeader( rIn, aPresRuleHd );
                                     if ( aPresRuleHd.nRecType == PPT_PST_ExtendedParagraphAtom )
                                     {
@@ -6819,7 +6844,8 @@ PPTTextObj::PPTTextObj( SvStream& rIn, SdrPowerPointImport& rSdrPowerPointImport
                                     }
                                     break;
                                 }
-                                aTextHd.SeekToEndOfRecord( rIn );
+                                if (!aTextHd.SeekToEndOfRecord(rIn))
+                                    break;
                                 if ( pEntry )
                                 {
                                     // sorting fields ( hi >> lo )
diff --git a/sd/qa/unit/data/ppt/pass/hang-15.ppt b/sd/qa/unit/data/ppt/pass/hang-15.ppt
new file mode 100644
index 0000000..b93255a
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-15.ppt differ
diff --git a/sd/qa/unit/data/ppt/pass/hang-16.ppt b/sd/qa/unit/data/ppt/pass/hang-16.ppt
new file mode 100644
index 0000000..c398d2b
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-16.ppt differ
diff --git a/sd/qa/unit/data/ppt/pass/hang-17.ppt b/sd/qa/unit/data/ppt/pass/hang-17.ppt
new file mode 100644
index 0000000..de876ff
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-17.ppt differ
diff --git a/sd/source/filter/ppt/pptin.cxx b/sd/source/filter/ppt/pptin.cxx
index 5fe2bdc..e5b15df 100644
--- a/sd/source/filter/ppt/pptin.cxx
+++ b/sd/source/filter/ppt/pptin.cxx
@@ -519,7 +519,8 @@ bool ImplSdPPTImport::Import()
                     break;
                 rStCtrl.SeekRel( 8 );
                 rStCtrl.ReadUInt32( pPtr->nIndex );
-                aHyperE.SeekToEndOfRecord( rStCtrl );
+                if (!aHyperE.SeekToEndOfRecord(rStCtrl))
+                    break;
             }
         }
     }
@@ -818,7 +819,8 @@ bool ImplSdPPTImport::Import()
                                             }
                                             break;
                                         }
-                                        aProgTagContentHd.SeekToEndOfRecord( rStCtrl );
+                                        if (!aProgTagContentHd.SeekToEndOfRecord(rStCtrl))
+                                            break;
                                     }
                                 }
                             }
@@ -945,7 +947,8 @@ bool ImplSdPPTImport::Import()
                                             case PPT_PST_SlideTime10Atom :  // ??? don't know, this atom is always 8 bytes big
                                             break;                          // and is appearing in nearly every l10 progtag
                                         }
-                                        aProgTagContentHd.SeekToEndOfRecord( rStCtrl );
+                                        if (!aProgTagContentHd.SeekToEndOfRecord(rStCtrl))
+                                            break;
                                     }
                                 }
                             }
@@ -957,7 +960,8 @@ bool ImplSdPPTImport::Import()
                             break;
                         }
 
-                        aHd.SeekToEndOfRecord( rStCtrl );
+                        if (!aHd.SeekToEndOfRecord(rStCtrl))
+                            break;
                     }
                     ImportPageEffect( (SdPage*)pPage, bNewAnimationsUsed );
                 }
@@ -1780,7 +1784,8 @@ void ImplSdPPTImport::ImportPageEffect( SdPage* pPage, const bool bNewAnimations
                             }
                         }
                     }
-                    aHd.SeekToEndOfRecord( rStCtrl );
+                    if (!aHd.SeekToEndOfRecord(rStCtrl))
+                        break;
                 }
                 if ( bTryTwice && ( bSSSlideInfoAtom == false ) )
                 {
@@ -1942,7 +1947,10 @@ OUString ImplSdPPTImport::ReadSound(sal_uInt32 nSoundRef) const
                     }
                 }
                 if ( !bDone )
-                    aSoundRecHd.SeekToEndOfRecord( rStCtrl );
+                {
+                    if (!aSoundRecHd.SeekToEndOfRecord(rStCtrl))
+                        break;
+                }
             }
         }
     }
@@ -2002,7 +2010,8 @@ OUString ImplSdPPTImport::ReadMedia( sal_uInt32 nMediaRef ) const
                                         }
                                         break;
                                     }
-                                    aHd.SeekToEndOfRecord( rStCtrl );
+                                    if (!aHd.SeekToEndOfRecord(rStCtrl))
+                                        break;
                                 }
                                 break;
                             }
@@ -2011,7 +2020,8 @@ OUString ImplSdPPTImport::ReadMedia( sal_uInt32 nMediaRef ) const
                 }
                 break;
             }
-            aHdMovie.SeekToEndOfRecord( rStCtrl );
+            if (!aHdMovie.SeekToEndOfRecord(rStCtrl))
+                break;
         }
     }
     return aRetVal;
@@ -2660,7 +2670,8 @@ SdrObject* ImplSdPPTImport::ProcessObj( SvStream& rSt, DffObjData& rObjData, voi
                         }
                         break;
                     }
-                    aHd.SeekToEndOfRecord( rSt );
+                    if (!aHd.SeekToEndOfRecord(rSt))
+                        break;
                 }
                 while( ( rSt.GetError() == 0 ) && ( rSt.Tell() < nClientDataLen ) );
 
diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx
index 8f376fd..54807ef 100644
--- a/sd/source/filter/ppt/propread.cxx
+++ b/sd/source/filter/ppt/propread.cxx
@@ -319,7 +319,7 @@ bool Section::GetDictionary( Dictionary& rDict )
 
 void Section::Read( SvStorageStream *pStrm )
 {
-    sal_uInt32 i, nSecOfs, nPropSize, nStrmSize;
+    sal_uInt32 nSecOfs, nPropSize, nStrmSize;
     nSecOfs = pStrm->Tell();
 
     pStrm->Seek( STREAM_SEEK_TO_END );
@@ -357,7 +357,7 @@ void Section::Read( SvStorageStream *pStrm )
 
             bool bVariant = ( nPropType == VT_VARIANT );
 
-            for ( i = 0; nPropSize && ( i < nVectorCount ); i++ )
+            for (sal_uInt32 i = 0; nPropSize && ( i < nVectorCount ); ++i)
             {
                 if ( bVariant )
                 {
@@ -453,7 +453,7 @@ void Section::Read( SvStorageStream *pStrm )
                 if( nPropSize > nSecSize - nSecOfs )
                     nPropSize = nSecSize - nSecOfs;
                 sal_uInt8* pBuf = new sal_uInt8[ nPropSize ];
-                pStrm->Read( pBuf, nPropSize );
+                nPropSize = pStrm->Read(pBuf, nPropSize);
                 AddProperty( nPropId, pBuf, nPropSize );
                 delete[] pBuf;
             }
@@ -488,14 +488,17 @@ void Section::Read( SvStorageStream *pStrm )
         }
         else
         {
-            sal_uInt32 nDictCount, nSize;
-            pStrm->ReadUInt32( nDictCount );
-            for ( i = 0; i < nDictCount; i++ )
+            sal_uInt32 nDictCount(0);
+            pStrm->ReadUInt32(nDictCount);
+            for (sal_uInt32 i = 0; i < nDictCount; ++i)
             {
+                sal_uInt32 nSize(0);
                 pStrm->ReadUInt32( nSize ).ReadUInt32( nSize );
-                pStrm->SeekRel( nSize );
+                sal_uInt64 nPos = pStrm->Tell() + nSize;
+                if (nPos != pStrm->Seek(nPos))
+                    break;
             }
-            nSize = pStrm->Tell();
+            sal_uInt32 nSize = pStrm->Tell();
             pStrm->Seek( nPropOfs + nSecOfs );
             nSize -= pStrm->Tell();
             if ( nSize > nStrmSize )
@@ -504,7 +507,7 @@ void Section::Read( SvStorageStream *pStrm )
                 break;
             }
             sal_uInt8* pBuf = new sal_uInt8[ nSize ];
-            pStrm->Read( pBuf, nSize );
+            nSize = pStrm->Read(pBuf, nSize);
             AddProperty( 0xffffffff, pBuf, nSize );
             delete[] pBuf;
         }
commit 949aa59fccda3e10cd45e8f74984adde7b4fb161
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 27 13:00:36 2015 +0100

    check for stream status after a read, not after a seek
    
    Change-Id: I984e99c1a1484547aa4d60bf301167f3cbc9f716
    (cherry picked from commit eea399ddd52a0de368321963bb828bc15632dd0b)
    Reviewed-on: https://gerrit.libreoffice.org/18075
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/sd/qa/unit/data/ppt/pass/hang-4.ppt b/sd/qa/unit/data/ppt/pass/hang-4.ppt
new file mode 100644
index 0000000..f5aa247
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-4.ppt differ
diff --git a/sd/source/filter/ppt/propread.cxx b/sd/source/filter/ppt/propread.cxx
index 1e71044..8f376fd 100644
--- a/sd/source/filter/ppt/propread.cxx
+++ b/sd/source/filter/ppt/propread.cxx
@@ -319,7 +319,7 @@ bool Section::GetDictionary( Dictionary& rDict )
 
 void Section::Read( SvStorageStream *pStrm )
 {
-    sal_uInt32 i, nSecOfs, nPropType, nPropSize, nCurrent, nVectorCount, nTemp, nStrmSize;
+    sal_uInt32 i, nSecOfs, nPropSize, nStrmSize;
     nSecOfs = pStrm->Tell();
 
     pStrm->Seek( STREAM_SEEK_TO_END );
@@ -329,16 +329,20 @@ void Section::Read( SvStorageStream *pStrm )
     mnTextEnc = RTL_TEXTENCODING_MS_1252;
     sal_uInt32 nSecSize(0), nPropCount(0);
     pStrm->ReadUInt32( nSecSize ).ReadUInt32( nPropCount );
-    while (nPropCount-- && pStrm->good())
+    while (nPropCount--)
     {
         sal_uInt32 nPropId(0), nPropOfs(0);
-        pStrm->ReadUInt32( nPropId ).ReadUInt32( nPropOfs );
-        nCurrent = pStrm->Tell();
-        pStrm->Seek( nPropOfs + nSecOfs );
+        pStrm->ReadUInt32(nPropId).ReadUInt32(nPropOfs);
+        if (!pStrm->good())
+            break;
+        auto nCurrent = pStrm->Tell();
+        sal_uInt64 nOffset = nPropOfs + nSecOfs;
+        if (nOffset != pStrm->Seek(nOffset))
+            break;
         if ( nPropId )                  // do not read dictionary
         {
-
-            pStrm->ReadUInt32( nPropType );
+            sal_uInt32 nPropType(0), nVectorCount(0);
+            pStrm->ReadUInt32(nPropType);
 
             nPropSize = 4;
 
@@ -360,6 +364,7 @@ void Section::Read( SvStorageStream *pStrm )
                     pStrm->ReadUInt32( nPropType );
                     nPropSize += 4;
                 }
+                sal_uInt32 nTemp(0);
                 switch( nPropType )
                 {
                     case VT_UI1 :
@@ -457,11 +462,11 @@ void Section::Read( SvStorageStream *pStrm )
                 PropItem aPropItem;
                 if ( GetProperty( 1, aPropItem ) )
                 {
-                    sal_uInt16 nCodePage;
                     aPropItem.ReadUInt32( nPropType );
                     if ( nPropType == VT_I2 )
                     {
-                        aPropItem.ReadUInt16( nCodePage );
+                        sal_uInt16 nCodePage(0);
+                        aPropItem.ReadUInt16(nCodePage);
 
                         if ( nCodePage == 1200 )
                         {
@@ -503,7 +508,7 @@ void Section::Read( SvStorageStream *pStrm )
             AddProperty( 0xffffffff, pBuf, nSize );
             delete[] pBuf;
         }
-        pStrm->Seek( nCurrent );
+        pStrm->Seek(nCurrent);
     }
     pStrm->Seek( nSecOfs + nSecSize );
 }
commit 3a29fd1332434904d5421127bfd08ec135445302
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 27 14:06:04 2015 +0100

    check stream state after read attempt
    
    Change-Id: Ie3836f2e95acab963634181a07565343501f00f8
    (cherry picked from commit 9a695e071020639926f8b038aba64eb016a1801a)
    Reviewed-on: https://gerrit.libreoffice.org/18079
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index 2eeb4b0..40c3349 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -5245,9 +5245,13 @@ void PPTStyleTextPropReader::Init( SvStream& rIn, SdrPowerPointImport& rMan, con
 
             PPTCharPropSet aCharPropSet( nCurrentPara );
             if ( bTextPropAtom )
+            {
                 ReadCharProps( rIn, aCharPropSet, aString, nCharCount, nCharAnzRead,
                                bTextPropAtom, nExtParaPos, aStyleTextProp9, nExtParaFlags,
                                nBuBlip, nHasAnm, nAnmScheme );
+                if (!rIn.good())
+                    break;
+            }
             else
                 nCharCount = nStringLen;
 
@@ -5314,7 +5318,7 @@ void PPTStyleTextPropReader::Init( SvStream& rIn, SdrPowerPointImport& rMan, con
                     break;
                 }
             }
-         }
+        }
         if ( !aCharPropList.empty() && ( aCharPropList.back()->mnParagraph != nCurrentPara ) )
         {
             PPTCharPropSet* pCharPropSet = new PPTCharPropSet( *aCharPropList.back(), nCurrentPara );
diff --git a/sd/qa/unit/data/ppt/pass/hang-8.ppt b/sd/qa/unit/data/ppt/pass/hang-8.ppt
new file mode 100644
index 0000000..0f52bd5
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-8.ppt differ
commit 3de343752604c85e7b019e69ca289a74cfdc4349
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 27 13:49:00 2015 +0100

    check SeekToEndOfRecord for success
    
    Change-Id: I7413a4e9e491b65122eaadb38ad574161f1aa943
    (cherry picked from commit d417ffb7dd93306be7c89526a75acab53dbd8831)
    Reviewed-on: https://gerrit.libreoffice.org/18077
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index 8c41446..2eeb4b0 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -2869,7 +2869,9 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet, const PptSlidePersistEntry*
                                                         insertShapeId( nShapeId, pObj );
                                                 }
                                             }
-                                            aShapeHd.SeekToEndOfRecord( rStCtrl );
+                                            bool bSuccess = aShapeHd.SeekToEndOfRecord(rStCtrl);
+                                            if (!bSuccess)
+                                                break;
                                         }
                                     }
                                 }
diff --git a/sd/qa/unit/data/ppt/pass/hang-6.ppt b/sd/qa/unit/data/ppt/pass/hang-6.ppt
new file mode 100644
index 0000000..f5aa247
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-6.ppt differ
commit 44ef0dd6f7bd0716f455b5342c7fb987cacac6ba
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 27 12:21:37 2015 +0100

    don't write SvxBackgroundColorItem via inherited SvxColorItem::Store
    
    SvxBackgroundColorItem inherits from SvxColorItem and for backwards
    compatibility with the StarOffice 5 binary file format (yes, really)
    writes/reads only rgb and not the transparency value, so copying and pasting
    text from a sidebar comment in writer to itself or another one results in a
    black character background as the default COL_AUTO turns into black
    
    (cherry picked from commit 3bc69b1d0d8620afd89a993b5f6bc46a2ff5267f)
    
    Change-Id: I18b5105dd8e060b9e49dda6026e26d3a0f00d8f5
    Reviewed-on: https://gerrit.libreoffice.org/18074
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/editeng/source/editeng/editattr.cxx b/editeng/source/editeng/editattr.cxx
index 85676ab..66e664f 100644
--- a/editeng/source/editeng/editattr.cxx
+++ b/editeng/source/editeng/editattr.cxx
@@ -221,7 +221,6 @@ void EditCharAttribColor::SetFont( SvxFont& rFont, OutputDevice* )
 {
     Color aColor = static_cast<const SvxColorItem*>(GetItem())->GetValue();
     rFont.SetColor( aColor);
-    //fprintf(stderr, "Called SetFont with Color %d\n", aColor.GetColor());
 }
 
 // class EditCharAttribBackgroundColor
@@ -238,14 +237,11 @@ EditCharAttribBackgroundColor::EditCharAttribBackgroundColor(
 void EditCharAttribBackgroundColor::SetFont( SvxFont& rFont, OutputDevice* )
 {
     Color aColor = static_cast<const SvxBackgroundColorItem*>(GetItem())->GetValue();
-    rFont.SetFillColor( aColor);
     rFont.SetTransparent(false);
-
+    rFont.SetFillColor(aColor);
 }
 
-
 // class EditCharAttribLanguage
-
 EditCharAttribLanguage::EditCharAttribLanguage( const SvxLanguageItem& rAttr, sal_uInt16 _nStart, sal_uInt16 _nEnd )
     : EditCharAttrib( rAttr, _nStart, _nEnd )
 {
diff --git a/editeng/source/items/textitem.cxx b/editeng/source/items/textitem.cxx
index b55d9ad..587e253 100644
--- a/editeng/source/items/textitem.cxx
+++ b/editeng/source/items/textitem.cxx
@@ -1809,9 +1809,12 @@ SvxBackgroundColorItem::SvxBackgroundColorItem( const Color& rCol,
 {
 }
 
-SvxBackgroundColorItem:: SvxBackgroundColorItem( SvStream& rStrm, const sal_uInt16 Id  ) :
-    SvxColorItem( rStrm, Id )
+SvxBackgroundColorItem::SvxBackgroundColorItem(SvStream& rStrm, const sal_uInt16 nId)
+    : SvxColorItem(nId)
 {
+    Color aColor;
+    aColor.Read(rStrm);
+    SetValue(aColor);
 }
 
 SvxBackgroundColorItem::SvxBackgroundColorItem( const SvxBackgroundColorItem& rCopy ) :
@@ -1821,9 +1824,14 @@ SvxBackgroundColorItem::SvxBackgroundColorItem( const SvxBackgroundColorItem& rC
 
 SfxPoolItem* SvxBackgroundColorItem::Clone( SfxItemPool * ) const
 {
-    return new SvxBackgroundColorItem( *this );
+    return new SvxBackgroundColorItem(*this);
 }
 
+SvStream& SvxBackgroundColorItem::Store(SvStream& rStrm, sal_uInt16) const
+{
+    GetValue().Write(rStrm);
+    return rStrm;
+}
 
 SfxPoolItem* SvxBackgroundColorItem::Create(SvStream& rStrm, sal_uInt16 ) const
 {
@@ -1877,23 +1885,18 @@ bool SvxBackgroundColorItem::PutValue( const uno::Any& rVal, sal_uInt8 nMemberId
 }
 
 // class SvxColorItem ----------------------------------------------------
-
 SvxColorItem::SvxColorItem( const sal_uInt16 nId ) :
     SfxPoolItem( nId ),
     mColor( COL_BLACK )
 {
 }
 
-
-
 SvxColorItem::SvxColorItem( const Color& rCol, const sal_uInt16 nId ) :
     SfxPoolItem( nId ),
     mColor( rCol )
 {
 }
 
-
-
 SvxColorItem::SvxColorItem( SvStream &rStrm, const sal_uInt16 nId ) :
     SfxPoolItem( nId )
 {
@@ -1902,21 +1905,16 @@ SvxColorItem::SvxColorItem( SvStream &rStrm, const sal_uInt16 nId ) :
     mColor = aColor;
 }
 
-
-
 SvxColorItem::SvxColorItem( const SvxColorItem &rCopy ) :
     SfxPoolItem( rCopy ),
     mColor( rCopy.mColor )
 {
 }
 
-
-
 SvxColorItem::~SvxColorItem()
 {
 }
 
-
 sal_uInt16 SvxColorItem::GetVersion( sal_uInt16 nFFVer ) const
 {
     DBG_ASSERT( SOFFICE_FILEFORMAT_31==nFFVer ||
@@ -1926,8 +1924,6 @@ sal_uInt16 SvxColorItem::GetVersion( sal_uInt16 nFFVer ) const
     return  SOFFICE_FILEFORMAT_50 >= nFFVer ? VERSION_USEAUTOCOLOR : 0;
 }
 
-
-
 bool SvxColorItem::operator==( const SfxPoolItem& rAttr ) const
 {
     DBG_ASSERT( SfxPoolItem::operator==(rAttr), "unequal types" );
@@ -1935,16 +1931,12 @@ bool SvxColorItem::operator==( const SfxPoolItem& rAttr ) const
     return  mColor == static_cast<const SvxColorItem&>( rAttr ).mColor;
 }
 
-
-
 bool SvxColorItem::QueryValue( uno::Any& rVal, sal_uInt8 /*nMemberId*/ ) const
 {
     rVal <<= (sal_Int32)(mColor.GetColor());
     return true;
 }
 
-
-
 bool SvxColorItem::PutValue( const uno::Any& rVal, sal_uInt8 /*nMemberId*/ )
 {
     sal_Int32 nColor = 0;
@@ -1955,15 +1947,11 @@ bool SvxColorItem::PutValue( const uno::Any& rVal, sal_uInt8 /*nMemberId*/ )
     return true;
 }
 
-
-
 SfxPoolItem* SvxColorItem::Clone( SfxItemPool * ) const
 {
     return new SvxColorItem( *this );
 }
 
-
-
 SvStream& SvxColorItem::Store( SvStream& rStrm , sal_uInt16 nItemVersion ) const
 {
     if( VERSION_USEAUTOCOLOR == nItemVersion &&
@@ -1974,15 +1962,11 @@ SvStream& SvxColorItem::Store( SvStream& rStrm , sal_uInt16 nItemVersion ) const
     return rStrm;
 }
 
-
-
 SfxPoolItem* SvxColorItem::Create(SvStream& rStrm, sal_uInt16 /*nVer*/ ) const
 {
     return new SvxColorItem( rStrm, Which() );
 }
 
-
-
 bool SvxColorItem::GetPresentation
 (
     SfxItemPresentation /*ePres*/,
diff --git a/include/editeng/colritem.hxx b/include/editeng/colritem.hxx
index bead03e..81f4ac5 100644
--- a/include/editeng/colritem.hxx
+++ b/include/editeng/colritem.hxx
@@ -91,11 +91,11 @@ class EDITENG_DLLPUBLIC SvxBackgroundColorItem : public SvxColorItem
         SvxBackgroundColorItem( SvStream& rStrm, const sal_uInt16 nId  );
         SvxBackgroundColorItem( const SvxBackgroundColorItem& rCopy );
 
-        virtual SfxPoolItem*     Clone( SfxItemPool *pPool = 0 ) const SAL_OVERRIDE;
-        virtual SfxPoolItem*     Create(SvStream &, sal_uInt16) const SAL_OVERRIDE;
-
-        virtual bool QueryValue(com::sun::star::uno::Any& rVal, sal_uInt8 nMemberId = 0) const SAL_OVERRIDE;
-        virtual bool PutValue(const com::sun::star::uno::Any& rVal, sal_uInt8 nMemberId = 0) SAL_OVERRIDE;
+        virtual SfxPoolItem* Clone(SfxItemPool* pPool = 0) const SAL_OVERRIDE;
+        virtual SvStream& Store(SvStream& rStream, sal_uInt16 nVersion) const SAL_OVERRIDE;
+        virtual SfxPoolItem* Create(SvStream &, sal_uInt16) const SAL_OVERRIDE;
+        virtual bool QueryValue(css::uno::Any& rVal, sal_uInt8 nMemberId = 0) const SAL_OVERRIDE;
+        virtual bool PutValue(const css::uno::Any& rVal, sal_uInt8 nMemberId) SAL_OVERRIDE;
 };
 
 #endif
diff --git a/include/tools/color.hxx b/include/tools/color.hxx
index ea92187..15ba3df 100644
--- a/include/tools/color.hxx
+++ b/include/tools/color.hxx
@@ -156,8 +156,8 @@ public:
     bool                operator!=( const Color& rColor ) const
                             { return !(Color::operator==( rColor )); }
 
-    SvStream&           Read( SvStream& rIStm, bool bNewFormat = true );
-    SvStream&           Write( SvStream& rOStm, bool bNewFormat = true );
+    SvStream& Read(SvStream& rIStream, bool bNewFormat = true);
+    SvStream& Write(SvStream& rOStream, bool bNewFormat = true) const;
 
     TOOLS_DLLPUBLIC friend SvStream&    ReadColor( SvStream& rIStream, Color& rColor );
     TOOLS_DLLPUBLIC friend SvStream&    WriteColor( SvStream& rOStream, const Color& rColor );
diff --git a/tools/source/generic/color.cxx b/tools/source/generic/color.cxx
index cbdc6e4..07d43de 100644
--- a/tools/source/generic/color.cxx
+++ b/tools/source/generic/color.cxx
@@ -222,7 +222,7 @@ SvStream& Color::Read( SvStream& rIStm, bool bNewFormat )
     return rIStm;
 }
 
-SvStream& Color::Write( SvStream& rOStm, bool bNewFormat )
+SvStream& Color::Write( SvStream& rOStm, bool bNewFormat ) const
 {
     if ( bNewFormat )
         rOStm.WriteUInt32( mnColor );
commit 9b25b57e3074d2f85d2e604e7898b01d87ee4ce8
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 27 20:20:01 2015 +0100

    don't loop on overly-short nEndPos
    
    Change-Id: I60d3388ece28a69c31a85b9e3b495cbe8a03e7dc
    (cherry picked from commit 42732d255423700461f4abadfed77d89efa9cdd0)
    Reviewed-on: https://gerrit.libreoffice.org/18084
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-3.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-3.wmf
new file mode 100644
index 0000000..80ad795
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-3.wmf differ
diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index 1b8dc0d..578fc0a 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -617,7 +617,7 @@ void EnhWMFReader::ReadAndDrawPolyPolygon()
 bool EnhWMFReader::ReadEnhWMF()
 {
     sal_uInt32  nStretchBltMode = 0;
-    sal_uInt32  nRecType(0), nRecSize(0), nNextPos(0),
+    sal_uInt32  nNextPos(0),
                 nW(0), nH(0), nColor(0), nIndex(0),
                 nDat32(0), nNom1(0), nDen1(0), nNom2(0), nDen2(0);
     sal_Int32   nX32(0), nY32(0), nx32(0), ny32(0);
@@ -629,7 +629,8 @@ bool EnhWMFReader::ReadEnhWMF()
 
     while( bStatus && nRecordCount-- && pWMF->good())
     {
-        pWMF->ReadUInt32( nRecType ).ReadUInt32( nRecSize );
+        sal_uInt32  nRecType(0), nRecSize(0);
+        pWMF->ReadUInt32(nRecType).ReadUInt32(nRecSize);
 
         if ( !pWMF->good() || ( nRecSize < 8 ) || ( nRecSize & 3 ) )     // Parameters are always divisible by 4
         {
@@ -637,14 +638,22 @@ bool EnhWMFReader::ReadEnhWMF()
             break;
         }
 
-        const sal_uInt32 nMaxPossibleRecSize = nEndPos - pWMF->Tell() + 8;
+        auto nCurPos = pWMF->Tell();
+
+        if (nEndPos < nCurPos - 8)
+        {
+            bStatus = false;
+            break;
+        }
+
+        const sal_uInt32 nMaxPossibleRecSize = nEndPos - (nCurPos - 8);
         if (nRecSize > nMaxPossibleRecSize)
         {
             bStatus = false;
             break;
         }
 
-        nNextPos = pWMF->Tell() + ( nRecSize - 8 );
+        nNextPos = nCurPos + (nRecSize - 8);
 
         if(  !aBmpSaveList.empty()
           && ( nRecType != EMR_STRETCHBLT )
@@ -1407,7 +1416,7 @@ bool EnhWMFReader::ReadEnhWMF()
                 case EMR_EXTTEXTOUTW :
                 {
                     sal_Int32   nLeft, nTop, nRight, nBottom, ptlReferenceX, ptlReferenceY, nGfxMode, nXScale, nYScale;
-                    sal_uInt32  nCurPos, nOffString, nOptions, offDx;
+                    sal_uInt32  nOffString, nOptions, offDx;
                     sal_Int32   nLen;
                     std::vector<long> aDX;
 
commit 4c7d6f420349c6ab8e6d9bfcf0e9d654499bb22f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 27 20:16:58 2015 +0100

    check seek
    
    Change-Id: I358758999bb918e73cdee2224e575e72c2131453
    (cherry picked from commit 0c713e45f9831073e34777f50abf9b5801f08ed9)
    Reviewed-on: https://gerrit.libreoffice.org/18085
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index 4748cb9..47a89e0 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -399,7 +399,8 @@ SvStream& ReadSvxMSDffSolverContainer( SvStream& rIn, SvxMSDffSolverContainer& r
     if ( aHd.nRecType == DFF_msofbtSolverContainer )
     {
         DffRecordHeader aCRule;
-        while ( ( rIn.GetError() == 0 ) && ( rIn.Tell() < aHd.GetRecEndFilePos() ) )
+        auto nEndPos = DffPropSet::SanitizeEndPos(rIn, aHd.GetRecEndFilePos());
+        while ( ( rIn.GetError() == 0 ) && ( rIn.Tell() < nEndPos ) )
         {
             ReadDffRecordHeader( rIn, aCRule );
             if ( aCRule.nRecType == DFF_msofbtConnectorRule )
@@ -408,7 +409,8 @@ SvStream& ReadSvxMSDffSolverContainer( SvStream& rIn, SvxMSDffSolverContainer& r
                 rIn >> *pRule;
                 rContainer.aCList.push_back( pRule );
             }
-            aCRule.SeekToEndOfRecord( rIn );
+            if (!aCRule.SeekToEndOfRecord(rIn))
+                break;
         }
     }
     return rIn;
diff --git a/sd/qa/unit/data/ppt/pass/hang-13.ppt b/sd/qa/unit/data/ppt/pass/hang-13.ppt
new file mode 100644
index 0000000..04fbdc5
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-13.ppt differ
commit aaa2738e83e49851bf3e09d05a49cea352c0cd1d
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 27 20:32:28 2015 +0100

    check seeks and offsets
    
    Change-Id: I2b6ded138b9101415fc49e93e1ec3ebcd3a9d2ae
    (cherry picked from commit 5ed690a3e8a575784ca25048e0229ebc52e6fccd)
    Reviewed-on: https://gerrit.libreoffice.org/18086
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index b6693086..8c41446 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -6507,10 +6507,12 @@ PPTTextObj::PPTTextObj( SvStream& rIn, SdrPowerPointImport& rSdrPowerPointImport
                             bStatus = false;
                         else
                         {
-                            rIn.Seek( pE->nSlidePersistStartOffset );
+                            auto nOffset(pE->nSlidePersistStartOffset);
+                            bStatus = (nOffset == rIn.Seek(nOffset));
                             // now we got the right page and are searching for the right
                             // TextHeaderAtom
-                            while ( rIn.Tell() < pE->nSlidePersistEndOffset )
+                            auto nEndRecPos = DffPropSet::SanitizeEndPos(rIn, pE->nSlidePersistEndOffset);
+                            while (bStatus && rIn.Tell() < nEndRecPos)
                             {
                                 ReadDffRecordHeader( rIn, aClientTextBoxHd );
                                 if ( aClientTextBoxHd.nRecType == PPT_PST_TextHeaderAtom )
@@ -6521,7 +6523,8 @@ PPTTextObj::PPTTextObj( SvStream& rIn, SdrPowerPointImport& rSdrPowerPointImport
                                         break;
                                     }
                                 }
-                                aClientTextBoxHd.SeekToEndOfRecord( rIn );
+                                if (!aClientTextBoxHd.SeekToEndOfRecord(rIn))
+                                    break;
                             }
                             if ( rIn.Tell() > pE->nSlidePersistEndOffset )
                                 bStatus = false;
@@ -6534,12 +6537,14 @@ PPTTextObj::PPTTextObj( SvStream& rIn, SdrPowerPointImport& rSdrPowerPointImport
 
                                 // we have to calculate the correct record len
                                 DffRecordHeader aTmpHd;
-                                while ( rIn.Tell() < pE->nSlidePersistEndOffset )
+                                nEndRecPos = DffPropSet::SanitizeEndPos(rIn, pE->nSlidePersistEndOffset);
+                                while (rIn.Tell() < nEndRecPos)
                                 {
                                     ReadDffRecordHeader( rIn, aTmpHd );
                                     if ( ( aTmpHd.nRecType == PPT_PST_SlidePersistAtom ) || ( aTmpHd.nRecType == PPT_PST_TextHeaderAtom ) )
                                         break;
-                                    aTmpHd.SeekToEndOfRecord( rIn );
+                                    if (!aTmpHd.SeekToEndOfRecord(rIn))
+                                        break;
                                     aClientTextBoxHd.nRecLen += aTmpHd.nRecLen + DFF_COMMON_RECORD_HEADER_SIZE;
                                 }
                                 aClientTextBoxHd.SeekToContent( rIn );
diff --git a/sd/qa/unit/data/ppt/pass/hang-14.ppt b/sd/qa/unit/data/ppt/pass/hang-14.ppt
new file mode 100644
index 0000000..8dd397b
Binary files /dev/null and b/sd/qa/unit/data/ppt/pass/hang-14.ppt differ
commit b7ae66eaa2e13056de67ec7eff84e32b78e2de5d
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Aug 27 14:22:23 2015 +0100

    avoid loops in atom chains
    
    (cherry picked from commit de71eae5807ff94c8eace0eccaabf1ffa08e77b6)
    
    Change-Id: Icc40c0ee6c7d8d305cf7cc60cbf3e511c763aedd
    Reviewed-on: https://gerrit.libreoffice.org/18080
    Reviewed-by: Michael Meeks <michael.meeks at collabora.com>
    Tested-by: Michael Meeks <michael.meeks at collabora.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index 9a5ca61..b6693086 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -2541,11 +2541,17 @@ bool SdrPowerPointImport::GetColorFromPalette( sal_uInt16 nNum, Color& rColor )
                     while( ( pMasterPersist && pMasterPersist->aSlideAtom.nFlags & 2 )  // it is possible that a masterpage
                         && pMasterPersist->aSlideAtom.nMasterId )                        // itself is following a master colorscheme
                     {
-                        sal_uInt16 nNextMaster = pMasterPages->FindPage( pMasterPersist->aSlideAtom.nMasterId );
+                        auto nOrigMasterId = pMasterPersist->aSlideAtom.nMasterId;
+                        sal_uInt16 nNextMaster = pMasterPages->FindPage(nOrigMasterId);
                         if ( nNextMaster == PPTSLIDEPERSIST_ENTRY_NOTFOUND )
                             break;
                         else
                             pMasterPersist = &(*pPageList2)[ nNextMaster ];
+                        if (pMasterPersist->aSlideAtom.nMasterId == nOrigMasterId)
+                        {
+                            SAL_WARN("filter.ms", "loop in atom chain");
+                            break;
+                        }
                     }
                 }
                 if ( pMasterPersist )
@@ -2554,9 +2560,9 @@ bool SdrPowerPointImport::GetColorFromPalette( sal_uInt16 nNum, Color& rColor )
                 }
             }
         }
-        // resgister current color scheme
-        ((SdrPowerPointImport*)this)->nPageColorsNum = nAktPageNum;
-        ((SdrPowerPointImport*)this)->ePageColorsKind = eAktPageKind;
+        // register current color scheme
+        const_cast<SdrPowerPointImport*>(this)->nPageColorsNum = nAktPageNum;
+        const_cast<SdrPowerPointImport*>(this)->ePageColorsKind = eAktPageKind;

... etc. - the rest is truncated


More information about the Libreoffice-commits mailing list