[Libreoffice-commits] core.git: Branch 'distro/collabora/cp-4.3' - 20 commits - configure.ac connectivity/source dbaccess/source editeng/source hwpfilter/source i18npool/source include/sal include/unotools sc/inc sc/source svl/source svx/source sw/qa sw/source ucb/source vcl/generic vcl/source

Andras Timar andras.timar at collabora.com
Wed Mar 4 03:18:53 PST 2015


 configure.ac                                            |    2 
 connectivity/source/commontools/FValue.cxx              |   32 -
 connectivity/source/drivers/kab/KDriver.cxx             |    5 
 dbaccess/source/ui/querydesign/QueryDesignView.cxx      |    4 
 editeng/source/misc/svxacorr.cxx                        |    1 
 hwpfilter/source/drawdef.h                              |   12 
 hwpfilter/source/drawing.h                              |  281 ++++++++++------
 hwpfilter/source/hbox.h                                 |    4 
 hwpfilter/source/hinfo.cxx                              |  104 ++++-
 hwpfilter/source/hiodev.cxx                             |  117 ++++--
 hwpfilter/source/hiodev.h                               |   24 -
 hwpfilter/source/hpara.cxx                              |   33 +
 hwpfilter/source/htags.h                                |    2 
 hwpfilter/source/hwpfile.cxx                            |   82 ++--
 hwpfilter/source/hwpfile.h                              |   10 
 hwpfilter/source/hwplib.h                               |   11 
 hwpfilter/source/hwpread.cxx                            |   69 ++-
 i18npool/source/transliteration/transliterationImpl.cxx |   10 
 include/sal/log-areas.dox                               |    1 
 include/unotools/streamwrap.hxx                         |    4 
 sc/inc/tokenarray.hxx                                   |    3 
 sc/source/core/data/column.cxx                          |   29 +
 sc/source/core/tool/token.cxx                           |  136 +++++++
 sc/source/filter/xml/editattributemap.cxx               |    2 
 svl/source/numbers/zforfind.cxx                         |   33 +
 svx/source/sdr/contact/viewobjectcontactofgraphic.cxx   |    6 
 sw/qa/extras/rtfimport/data/tdf88811.rtf                |   26 +
 sw/qa/extras/rtfimport/rtfimport.cxx                    |    8 
 sw/source/core/doc/doctxm.cxx                           |    6 
 sw/source/core/uibase/misc/redlndlg.cxx                 |   18 -
 sw/source/core/unocore/unotext.cxx                      |   13 
 ucb/source/ucp/file/shell.cxx                           |    9 
 vcl/generic/glyphs/gcach_layout.cxx                     |    2 
 vcl/source/filter/wmf/emfwr.cxx                         |    2 
 34 files changed, 781 insertions(+), 320 deletions(-)

New commits:
commit 4835d579d401d5d060aa8f23a973b6479b37ff9a
Author: Andras Timar <andras.timar at collabora.com>
Date:   Wed Mar 4 03:18:47 2015 -0800

    Bump version to 4.3-4
    
    Change-Id: I1185a2c490895493012d5b1ddbb2bdf6e8fac5ec

diff --git a/configure.ac b/configure.ac
index d657981..b6e4dee 100644
--- a/configure.ac
+++ b/configure.ac
@@ -9,7 +9,7 @@ dnl in order to create a configure script.
 # several non-alphanumeric characters, those are split off and used only for the
 # ABOUTBOXPRODUCTVERSIONSUFFIX in openoffice.lst. Why that is necessary, no idea.
 
-AC_INIT([LibreOffice],[4.3.10.3],[],[],[https://libreoffice-from-collabora.com/])
+AC_INIT([LibreOffice],[4.3.10.4],[],[],[https://libreoffice-from-collabora.com/])
 
 AC_PREREQ([2.59])
 
commit 04341697fbc79fa4c2a07883194ba0929767b9b7
Author: Lionel Elie Mamane <lionel at mamane.lu>
Date:   Wed Jan 28 21:09:42 2015 +0100

    not all OrCriteria have three children
    
    and some contain a column in the second child
    
    Change-Id: Ifd69758336233ed0233120b3315d4f33655fa994
    Reviewed-on: https://gerrit.libreoffice.org/14719
    Tested-by: David Tardon <dtardon at redhat.com>
    Reviewed-by: David Tardon <dtardon at redhat.com>
    (cherry picked from commit 1ce2461ab77f2ad28671ac1542509bbb16a155ef)

diff --git a/dbaccess/source/ui/querydesign/QueryDesignView.cxx b/dbaccess/source/ui/querydesign/QueryDesignView.cxx
index 880cafc..7f6a1b1 100644
--- a/dbaccess/source/ui/querydesign/QueryDesignView.cxx
+++ b/dbaccess/source/ui/querydesign/QueryDesignView.cxx
@@ -1304,9 +1304,11 @@ namespace
     {
         bool bRet = true;
         ::connectivity::OSQLParseNode* pFirstColumnRef = _pFirstColumnRef;
-        for (int i = 0; i < 3 && bRet; i+=2)
+        for (size_t i = 0; i < _pCondition->count() && bRet; ++i)
         {
             const  ::connectivity::OSQLParseNode* pChild = _pCondition->getChild(i);
+            if ( pChild->isToken() )
+                continue;
             if ( SQL_ISRULE(pChild,search_condition) )
                 bRet = CheckOrCriteria(pChild,pFirstColumnRef);
             else
commit 6b701c7242f74a6395348f9c9bf2dbb99eb4ee92
Author: Lionel Elie Mamane <lionel at mamane.lu>
Date:   Mon Mar 2 18:19:18 2015 +0100

    getAny() is not a safe default, it assumes there is actually an Any
    
    at *m_aValue.m_pValue.
    But there could not even be a pointer there, e.g. if m_aValue.m_nIntXX is in use.
    Then the pointer dereference usually leads to a crash.
    Can e.g. be reproduced by calling getBytes() on an integer column of a RowSet.
    
    Change-Id: Ib5361d838d2869142fd797d4e3454e2562ea7acf
    Reviewed-on: https://gerrit.libreoffice.org/14720
    Tested-by: David Tardon <dtardon at redhat.com>
    Reviewed-by: David Tardon <dtardon at redhat.com>
    (cherry picked from commit 998f8cf5419f3da086246094408a50ab1e9d61f3)

diff --git a/connectivity/source/commontools/FValue.cxx b/connectivity/source/commontools/FValue.cxx
index e7bb803..e424962 100644
--- a/connectivity/source/commontools/FValue.cxx
+++ b/connectivity/source/commontools/FValue.cxx
@@ -965,7 +965,7 @@ Any ORowSetValue::makeAny() const
                 break;
             default:
                 SAL_WARN( "connectivity.commontools","ORowSetValue::makeAny(): UNSPUPPORTED TYPE!");
-                rValue = getAny();
+                rValue = makeAny();
                 break;
         }
     }
@@ -1050,7 +1050,7 @@ OUString ORowSetValue::getString( ) const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= aRet;
                     break;
                 }
@@ -1121,7 +1121,7 @@ bool ORowSetValue::getBool()    const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= bRet;
                     break;
                 }
@@ -1192,7 +1192,7 @@ sal_Int8 ORowSetValue::getInt8()    const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= nRet;
                     break;
                 }
@@ -1263,7 +1263,7 @@ sal_uInt8 ORowSetValue::getUInt8()    const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= nRet;
                     break;
                 }
@@ -1335,7 +1335,7 @@ sal_Int16 ORowSetValue::getInt16()  const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= nRet;
                     break;
                 }
@@ -1406,7 +1406,7 @@ sal_uInt16 ORowSetValue::getUInt16()  const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= nRet;
                     break;
                 }
@@ -1479,7 +1479,7 @@ sal_Int32 ORowSetValue::getInt32()  const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= nRet;
                     break;
                 }
@@ -1552,7 +1552,7 @@ sal_uInt32 ORowSetValue::getUInt32()  const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= nRet;
                     break;
                 }
@@ -1625,7 +1625,7 @@ sal_Int64 ORowSetValue::getLong()   const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= nRet;
                     break;
                 }
@@ -1698,7 +1698,7 @@ sal_uInt64 ORowSetValue::getULong()   const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= nRet;
                     break;
                 }
@@ -1775,7 +1775,7 @@ float ORowSetValue::getFloat()  const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= nRet;
                     break;
                 }
@@ -1851,7 +1851,7 @@ double ORowSetValue::getDouble()    const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= nRet;
                     break;
                 }
@@ -1922,7 +1922,7 @@ Sequence<sal_Int8>  ORowSetValue::getSequence() const
                 break;
             default:
                 {
-                    Any aValue = getAny();
+                    Any aValue = makeAny();
                     aValue >>= aSeq;
                     break;
                 }
@@ -2025,7 +2025,7 @@ Sequence<sal_Int8>  ORowSetValue::getSequence() const
                 break;
             default:
                 {
-                    Any aAnyValue = getAny();
+                    Any aAnyValue = makeAny();
                     aAnyValue >>= aValue;
                     break;
                 }
@@ -2077,7 +2077,7 @@ Sequence<sal_Int8>  ORowSetValue::getSequence() const
                 break;
             default:
                 {
-                    Any aAnyValue = getAny();
+                    Any aAnyValue = makeAny();
                     aAnyValue >>= aValue;
                     break;
                 }
commit fac8e577db3e125e00b7d02042427f5dbb182051
Author: Henry Castro <hcvcastro at gmail.com>
Date:   Mon Feb 16 14:08:16 2015 -0400

    tdf#87820  Images not displayed properly in Calc
    
    Fixed. After opening, images were not displayed properly in Calc 4.3 and 4.4
    
    Change-Id: I1f0dd7e9d332889df81be84a6c1e28a09f509733
    Reviewed-on: https://gerrit.libreoffice.org/14505
    Reviewed-by: Zolnai Tamás <zolnaitamas2000 at gmail.com>
    Tested-by: Zolnai Tamás <zolnaitamas2000 at gmail.com>
    (cherry picked from commit 6c84442f99de109b585d3ba8964deb8dcf261c0f)
    (cherry picked from commit e035a0775bd0a0cc14d64d7a0c0f265e9dcd4622)

diff --git a/svx/source/sdr/contact/viewobjectcontactofgraphic.cxx b/svx/source/sdr/contact/viewobjectcontactofgraphic.cxx
index 5649d32..d706625 100644
--- a/svx/source/sdr/contact/viewobjectcontactofgraphic.cxx
+++ b/svx/source/sdr/contact/viewobjectcontactofgraphic.cxx
@@ -134,6 +134,9 @@ namespace sdr
                             rGrafObj.mbInsidePaint = false;
                         }
 
+                        // Invalidate paint areas.
+                        GetViewContact().ActionChanged();
+
                         bRetval = true;
                     }
                 }
@@ -186,6 +189,9 @@ namespace sdr
                         rGrafObj.mbInsidePaint = false;
                     }
 
+                    // Invalidate paint areas.
+                    GetViewContact().ActionChanged();
+
                     bRetval = true;
                 }
             }
commit 581ab9d281ce6f4b1c457d4866f1983acdabc442
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Feb 26 13:47:58 2015 +0000

    in BITFIELDS mode (3) there are *3* pal entries not 12
    
    There are 12 *bytes*, which presumably is the thinko there. But this nPalCount
    gets multiplied by 4 to convert it to bytes later.
    
    This is the source of the bad mask values found after "Use the cairo-compatible
    basebmp surface for headless" etc. Arbitrary values ended up being read as mask
    values.
    
    Change-Id: If5d93f74b1c58d3ecdb5186f93cb0215a556586a
    (cherry picked from commit 5e5b90c12862b522a4553337fbf6309bb8278b8c)
    Reviewed-on: https://gerrit.libreoffice.org/14660
    Tested-by: Michael Stahl <mstahl at redhat.com>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit f20197a5e6da7ab0b550bce7ef2e07b7f7b401d5)

diff --git a/vcl/source/filter/wmf/emfwr.cxx b/vcl/source/filter/wmf/emfwr.cxx
index b25bb20..cf715ab 100644
--- a/vcl/source/filter/wmf/emfwr.cxx
+++ b/vcl/source/filter/wmf/emfwr.cxx
@@ -856,7 +856,7 @@ void EMFWriter::ImplWriteBmpRecord( const Bitmap& rBmp, const Point& rPt,
         aMemStm.ReadUInt32( nColsUsed );
 
         nPalCount = ( nBitCount <= 8 ) ? ( nColsUsed ? nColsUsed : ( 1 << (sal_uInt32) nBitCount ) ) :
-                                         ( ( 3 == nCompression ) ? 12 : 0 );
+                                         ( ( 3 == nCompression ) ? 3 : 0 );
 
         m_rStm.Write( aMemStm.GetData(), nDIBSize );
 
commit 8fecaca12b9a2e8ddb9457e520b1c1c8ebb1e83f
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Fri Feb 27 14:14:55 2015 +0100

    sdbc:address:kab URLs don't have a trailing ":"
    
    broken since 4bf95c4c31dd871065d4042028a4b3ae476dab70 "make use of startsWith()"
    where the tricky
    
      !url.compareTo(::rtl::OUString("sdbc:address:kab:"), 16)
    
    was replaced with
    
      url.startsWith("sdbc:address:kab:")
    
    even though the original exempted the trailing ":" from the comparison
    
    (cherry picked from commit 27e85dd314e02dc97612bf1682fccacaf0244127)
    Conflicts:
    	connectivity/source/drivers/kab/KDriver.cxx
    
    Change-Id: I45175b2669d61eb4cee36d4456ccb69d0f11ef63
    Reviewed-on: https://gerrit.libreoffice.org/14673
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit d24f2d128f42a4252e5fe5d2bad135e0bc72d1db)

diff --git a/connectivity/source/drivers/kab/KDriver.cxx b/connectivity/source/drivers/kab/KDriver.cxx
index 4a55aa7..84ca13d 100644
--- a/connectivity/source/drivers/kab/KDriver.cxx
+++ b/connectivity/source/drivers/kab/KDriver.cxx
@@ -404,7 +404,7 @@ sal_Bool SAL_CALL KabDriver::acceptsURL( const OUString& url )
         return sal_False;
 
     // here we have to look whether we support this URL format
-    return url.startsWith("sdbc:address:kab:");
+    return url.startsWith("sdbc:address:kab");
 }
 
 Sequence< DriverPropertyInfo > SAL_CALL KabDriver::getPropertyInfo( const OUString&, const Sequence< PropertyValue >& ) throw(SQLException, RuntimeException, std::exception)
commit 7bfa3af03b9eb920b7be92a06c8d101db918fe18
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Fri Feb 27 14:12:54 2015 +0100

    Adapt code to changed libkabdrv1lo.so name
    
    broken since LO 3.6, commit 07d512eff12fc89adbfb73e546b3946494f21472
    "connectivity: convert kab to gbuild"
    
    (cherry picked from commit d8a2a0b84a9aa570116febf23a6f1d6430fec287)
    Conflicts:
    	connectivity/source/drivers/kab/KDriver.cxx
    
    Change-Id: I65cc32fa55f1d5c0358585489b8b3dc3aaf8004b
    Reviewed-on: https://gerrit.libreoffice.org/14672
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit b9df2d7519ab1a36b00ce414ff8136b8bb11f7a8)

diff --git a/connectivity/source/drivers/kab/KDriver.cxx b/connectivity/source/drivers/kab/KDriver.cxx
index b023eaa..4a55aa7 100644
--- a/connectivity/source/drivers/kab/KDriver.cxx
+++ b/connectivity/source/drivers/kab/KDriver.cxx
@@ -31,6 +31,7 @@
 #include <cppuhelper/supportsservice.hxx>
 #include <rtl/ustrbuf.hxx>
 #include <tools/diagnose_ex.h>
+#include <tools/solar.h>
 #include "resource/kab_res.hrc"
 #include "resource/sharedresources.hxx"
 
@@ -120,7 +121,7 @@ bool KabImplModule::impl_loadModule()
     OSL_ENSURE( !m_hConnectorModule && !m_pConnectionFactoryFunc && !m_pApplicationInitFunc && !m_pApplicationShutdownFunc && !m_pKDEVersionCheckFunc,
         "KabImplModule::impl_loadModule: inconsistence: inconsistency (never attempted load before, but some values already set)!");
 
-    const OUString sModuleName( SAL_MODULENAME( "kabdrv1"  ));
+    const OUString sModuleName( SVLIBRARY( "kabdrv1"  ));
     m_hConnectorModule = osl_loadModuleRelative( &thisModule, sModuleName.pData, SAL_LOADMODULE_NOW );   // LAZY! #i61335#
     OSL_ENSURE( m_hConnectorModule, "KabImplModule::impl_loadModule: could not load the implementation library!" );
     if ( !m_hConnectorModule )
commit 602775ef25ec46a21a2ffebb5d8a0b415cd0509a
Author: Niklas Johansson <sleeping.pillow at gmail.com>
Date:   Wed Feb 18 07:51:36 2015 +0100

    tdf#78148 Ordinal numbers should not be auto-capitalized
    
    FnChgOrdinalNumber should return true if it changes the ordinal number.
    This seems to be accentually removed when the function was
    internationalized and has always returned false since.
    
    Change-Id: I633058a99ec033e0c33f807776364a52e22e9c64
    Reviewed-on: https://gerrit.libreoffice.org/14535
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 42ec6448f9acd474d8ec1a92d9362e1b38e13758)
    Reviewed-on: https://gerrit.libreoffice.org/14578
    Tested-by: Michael Stahl <mstahl at redhat.com>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit cbab46342e75a0bd8987620757bf67c4f68f8edd)
    Reviewed-on: https://gerrit.libreoffice.org/14683
    (cherry picked from commit 4ab923b82008396f40b7137ae984a08c4175e28d)

diff --git a/editeng/source/misc/svxacorr.cxx b/editeng/source/misc/svxacorr.cxx
index 8b1a3ee..4745c0b 100644
--- a/editeng/source/misc/svxacorr.cxx
+++ b/editeng/source/misc/svxacorr.cxx
@@ -498,6 +498,7 @@ bool SvxAutoCorrect::FnChgOrdinalNumber(
                     rDoc.SetAttr( nNumEnd + 1 , nEndPos,
                                     SID_ATTR_CHAR_ESCAPEMENT,
                                     aSvxEscapementItem);
+                    bChg = true;
                 }
             }
         }
commit 33484ca7bfd9f02280a8438c802ce494cec8ae88
Author: Mark Hung <marklh9 at gmail.com>
Date:   Thu Feb 26 16:55:46 2015 -0800

    tdf#89679 - fix incorrect mapping of font-family-complex and CharFontNameAsian
    
    Change-Id: I4adad1675f2a880e14ed870a3c74e43e8898c371
    Reviewed-on: https://gerrit.libreoffice.org/14663
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Julien Nabet <serval2412 at yahoo.fr>
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit cda9ae79e58d861a85128d6a37587b633b956aae)
    Reviewed-on: https://gerrit.libreoffice.org/14668
    (cherry picked from commit ce7a2502810615b64e83036211e6149313604fff)

diff --git a/sc/source/filter/xml/editattributemap.cxx b/sc/source/filter/xml/editattributemap.cxx
index e5feb6b..fd5de8c 100644
--- a/sc/source/filter/xml/editattributemap.cxx
+++ b/sc/source/filter/xml/editattributemap.cxx
@@ -21,7 +21,7 @@ ScXMLEditAttributeMap::Entry aEntries[] = {
     { XML_NAMESPACE_STYLE, "font-charset-complex", "CharFontCharSetComplex", EE_CHAR_FONTINFO_CTL, MID_FONT_CHAR_SET },
     { XML_NAMESPACE_FO, "font-family", "CharFontName", EE_CHAR_FONTINFO, MID_FONT_FAMILY_NAME },
     { XML_NAMESPACE_STYLE, "font-family-asian", "CharFontNameAsian", EE_CHAR_FONTINFO_CJK, MID_FONT_FAMILY_NAME },
-    { XML_NAMESPACE_STYLE, "font-family-complex", "CharFontNameAsian", EE_CHAR_FONTINFO_CTL, MID_FONT_FAMILY_NAME },
+    { XML_NAMESPACE_STYLE, "font-family-complex", "CharFontNameComplex", EE_CHAR_FONTINFO_CTL, MID_FONT_FAMILY_NAME },
     { XML_NAMESPACE_STYLE, "font-family-generic", "CharFontFamily", EE_CHAR_FONTINFO, MID_FONT_FAMILY },
     { XML_NAMESPACE_STYLE, "font-family-generic-asian", "CharFontFamilyAsian", EE_CHAR_FONTINFO_CJK, MID_FONT_FAMILY },
     { XML_NAMESPACE_STYLE, "font-family-generic-complex", "CharFontFamilyComplex", EE_CHAR_FONTINFO_CTL, MID_FONT_FAMILY },
commit 50006a205ae7602e48c0a6fe1689bbc6012845cf
Author: David Tardon <dtardon at redhat.com>
Date:   Wed Feb 11 22:56:53 2015 +0100

    fix linker error
    
    /builddir/build/BUILD/libreoffice-4.4.1.1/workdir/CxxObject/svtools/source/misc/imageresourceaccess.o: In function `com::sun::star::uno::Reference<com::sun::star::io::XOutputStream>::Reference(com::sun::star::io::XOutputStream*)':
    /builddir/build/BUILD/libreoffice-4.4.1.1/include/com/sun/star/uno/Reference.hxx:137: undefined reference to `non-virtual thunk to utl::OSeekableOutputStreamWrapper::acquire()'
    
    (cherry picked from commit 8bb0446974282b32d06cdbd35af83f91e033b4af)
    
    see also: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64812
    
    Change-Id: Ic644a8299cf2f79f02c1e3ca0de9687520f402a9
    Signed-off-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 0ec8a13ed975be89098d31979c7b3e3794ca2aa6)

diff --git a/include/unotools/streamwrap.hxx b/include/unotools/streamwrap.hxx
index c52d09e..4eae03c 100644
--- a/include/unotools/streamwrap.hxx
+++ b/include/unotools/streamwrap.hxx
@@ -125,12 +125,12 @@ typedef ::cppu::ImplHelper1 <   ::com::sun::star::io::XSeekable
 /** helper class for wrapping an SvStream into an com.sun.star.io::XOutputStream
     which is seekable (i.e. supports the com.sun.star.io::XSeekable interface).
 */
-class OSeekableOutputStreamWrapper
+class UNOTOOLS_DLLPUBLIC OSeekableOutputStreamWrapper
                 :public OOutputStreamWrapper
                 ,public OSeekableOutputStreamWrapper_Base
 {
 public:
-    UNOTOOLS_DLLPUBLIC OSeekableOutputStreamWrapper(SvStream& _rStream);
+    OSeekableOutputStreamWrapper(SvStream& _rStream);
 
 private:
     virtual ~OSeekableOutputStreamWrapper();
commit ec4afa74c0207bf538c5c4cd385724fc1c91252c
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Tue Feb 3 12:29:21 2015 +0100

    tdf#88811 SwXText::convertToTextFrame: handle shapes anchored to us
    
    (cherry picked from commit 38f2b8b3b16aab19a2564ec699d253d3dccecc3c)
    
    Conflicts:
    	sw/qa/extras/rtfimport/rtfimport.cxx
    
    Change-Id: Iedf8eacd37b8ed8e307a10e8ade32f53c7417c4a
    Reviewed-on: https://gerrit.libreoffice.org/14629
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit c56abb3c952e3062099d32702719825ee55b5112)

diff --git a/sw/qa/extras/rtfimport/data/tdf88811.rtf b/sw/qa/extras/rtfimport/data/tdf88811.rtf
new file mode 100644
index 0000000..a20835c
--- /dev/null
+++ b/sw/qa/extras/rtfimport/data/tdf88811.rtf
@@ -0,0 +1,26 @@
+{\rtf1\ansi\deff0
+\margl0\margr0\margt0\margb0
+\paperw11905\paperh16837
+{\shp
+{\*\shpinst\shpleft4420\shptop2720\shpright4420\shpbottom3280\shpfhdr0\shpbxpage\shpbypage\shpwr3\shpwrk0\shpfblwtxt1\shpz0
+{\sp
+{\sn shapeType}
+{\sv 20}
+}
+}
+}
+{\pard\plain\ql\sl-180\sb40\phmrg\pvmrg\posx3520\posy2900\absw680\absh0\dxfrtext0\dfrmtxtx0\dfrmtxty0
+{\f1\fs18\b Frame1}
+\par}
+{\shp
+{\*\shpinst\shpleft5760\shptop2720\shpright5760\shpbottom3280\shpfhdr0\shpbxpage\shpbypage\shpwr3\shpwrk0\shpfblwtxt1\shpz0
+{\sp
+{\sn shapeType}
+{\sv 20}
+}
+}
+}
+{\pard\plain\ql\sl-180\sb40\phmrg\pvmrg\posx4800\posy2900\absw800\absh0\dxfrtext0\dfrmtxtx0\dfrmtxty0
+{\f1\fs18\b Frame2}
+\par}
+}
diff --git a/sw/qa/extras/rtfimport/rtfimport.cxx b/sw/qa/extras/rtfimport/rtfimport.cxx
index 45a89a1..aaa14d2 100644
--- a/sw/qa/extras/rtfimport/rtfimport.cxx
+++ b/sw/qa/extras/rtfimport/rtfimport.cxx
@@ -2111,6 +2111,14 @@ DECLARE_RTFIMPORT_TEST(testFdo82114, "fdo82114.rtf")
     CPPUNIT_ASSERT_EQUAL(aExpected, aActual);
 }
 
+DECLARE_RTFIMPORT_TEST(testTdf88811, "tdf88811.rtf")
+{
+    // The problem was that shapes anchored to the paragraph that is moved into a textframe were lost, so this was 2.
+    uno::Reference<drawing::XDrawPageSupplier> xDrawPageSupplier(mxComponent, uno::UNO_QUERY);
+    uno::Reference<drawing::XDrawPage> xDrawPage = xDrawPageSupplier->getDrawPage();
+    CPPUNIT_ASSERT_EQUAL(static_cast<sal_Int32>(4), xDrawPage->getCount());
+}
+
 CPPUNIT_PLUGIN_IMPLEMENT();
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/source/core/unocore/unotext.cxx b/sw/source/core/unocore/unotext.cxx
index cd31f50..25dd3f5 100644
--- a/sw/source/core/unocore/unotext.cxx
+++ b/sw/source/core/unocore/unotext.cxx
@@ -1658,14 +1658,21 @@ SwXText::convertToTextFrame(
 
     // see if there are frames already anchored to this node
     std::set<OUString> aAnchoredFrames;
+    // for shapes, we have to work with the SdrObjects, as unique name is not guaranteed in their frame format
+    std::set<const SdrObject*> aAnchoredShapes;
     for (size_t i = 0; i < m_pImpl->m_pDoc->GetSpzFrmFmts()->size(); ++i)
     {
         SwFrmFmt* pFrmFmt = (*m_pImpl->m_pDoc->GetSpzFrmFmts())[i];
         const SwFmtAnchor& rAnchor = pFrmFmt->GetAnchor();
-        if (FLY_AT_PARA == rAnchor.GetAnchorId() &&
+        if ((FLY_AT_PARA == rAnchor.GetAnchorId() || FLY_AT_CHAR == rAnchor.GetAnchorId()) &&
                 aStartPam.Start()->nNode.GetIndex() <= rAnchor.GetCntntAnchor()->nNode.GetIndex() &&
                 aStartPam.End()->nNode.GetIndex() >= rAnchor.GetCntntAnchor()->nNode.GetIndex())
-            aAnchoredFrames.insert(pFrmFmt->GetName());
+        {
+            if (pFrmFmt->Which() == RES_DRAWFRMFMT)
+                aAnchoredShapes.insert(pFrmFmt->FindSdrObject());
+            else
+                aAnchoredFrames.insert(pFrmFmt->GetName());
+        }
     }
 
     SwXTextFrame *const pNewFrame = new SwXTextFrame(m_pImpl->m_pDoc);
@@ -1708,7 +1715,7 @@ SwXText::convertToTextFrame(
                     for (size_t i = 0; i < m_pImpl->m_pDoc->GetSpzFrmFmts()->size(); ++i)
                     {
                         SwFrmFmt* pFrmFmt = (*m_pImpl->m_pDoc->GetSpzFrmFmts())[i];
-                        if( aAnchoredFrames.find( pFrmFmt->GetName() ) != aAnchoredFrames.end() )
+                        if (aAnchoredFrames.find(pFrmFmt->GetName()) != aAnchoredFrames.end() || aAnchoredShapes.find(pFrmFmt->FindSdrObject()) != aAnchoredShapes.end())
                         {
                             // copy the anchor to the next paragraph
                             SwFmtAnchor aAnchor(pFrmFmt->GetAnchor());
commit 4a13a27c3bc4931da743a7998466dfccd972b7cf
Author: Eike Rathke <erack at redhat.com>
Date:   Thu Feb 26 12:54:13 2015 +0100

    Resolves: tdf#81659 handle expand reference edge correctly
    
    split formula grouping for reference edge expansion, tdf#81659 related
    
    Edge expansion may change expressions individually, which must be split
    off the group.
    
    (cherry picked from commit 0cd15b4494f8e8abe67a258fb10189135bf5a8ac)
    
    tdf#81659 check that references are at least 2 cols/rows to expand edge
    
    Needs also 0cd15b4494f8e8abe67a258fb10189135bf5a8ac if edges are to be
    expanded and formula grouping is affected.
    
    (cherry picked from commit 23b0112ecea2f8796a4e237e9061de1a36997a30)
    
    Backported.
    
    b3cee8dd214d216907248316a2ac5a290399b169
    
    Change-Id: Id4328bd8c42f2ff9f83d2edc845537971f3a39d3
    Reviewed-on: https://gerrit.libreoffice.org/14656
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 58deeaea725eca0e8140b09420d5144d5d3f800c)

diff --git a/sc/inc/tokenarray.hxx b/sc/inc/tokenarray.hxx
index 1768ba9..e134f12 100644
--- a/sc/inc/tokenarray.hxx
+++ b/sc/inc/tokenarray.hxx
@@ -233,6 +233,9 @@ public:
     void CheckRelativeReferenceBounds(
         const ScAddress& rPos, SCROW nGroupLen, const ScRange& rRange, std::vector<SCROW>& rBounds ) const;
 
+    void CheckExpandReferenceBounds(
+        const sc::RefUpdateContext& rCxt, const ScAddress& rPos, SCROW nGroupLen, std::vector<SCROW>& rBounds ) const;
+
     /**
      * Create a string representation of formula token array without modifying
      * the internal state of the token array.
diff --git a/sc/source/core/data/column.cxx b/sc/source/core/data/column.cxx
index 64174ab..431e9b1 100644
--- a/sc/source/core/data/column.cxx
+++ b/sc/source/core/data/column.cxx
@@ -2300,6 +2300,27 @@ public:
     }
 };
 
+class UpdateRefExpandGroupBoundChecker : public SharedTopFormulaCellPicker
+{
+    const sc::RefUpdateContext& mrCxt;
+    std::vector<SCROW>& mrBounds;
+
+public:
+    UpdateRefExpandGroupBoundChecker(const sc::RefUpdateContext& rCxt, std::vector<SCROW>& rBounds) :
+        mrCxt(rCxt), mrBounds(rBounds) {}
+
+    virtual ~UpdateRefExpandGroupBoundChecker() {}
+
+    virtual void processSharedTop( ScFormulaCell** ppCells, size_t /*nRow*/, size_t /*nLength*/ ) SAL_OVERRIDE
+    {
+        // Check its tokens and record its reference boundaries.
+        ScFormulaCell& rCell = **ppCells;
+        const ScTokenArray& rCode = *rCell.GetCode();
+        rCode.CheckExpandReferenceBounds(
+            mrCxt, rCell.aPos, rCell.GetSharedLength(), mrBounds);
+    }
+};
+
 class FormulaGroupPicker : public SharedTopFormulaCellPicker
 {
     std::vector<sc::FormulaGroupEntry>& mrGroups;
@@ -2385,6 +2406,14 @@ bool ScColumn::UpdateReference( sc::RefUpdateContext& rCxt, ScDocument* pUndoDoc
     UpdateRefGroupBoundChecker aBoundChecker(rCxt, aBounds);
     std::for_each(maCells.begin(), maCells.end(), aBoundChecker);
 
+    // If expand reference edges is on, splitting groups may happen anywhere
+    // where a reference points to an adjacent row of the insertion.
+    if (rCxt.mnRowDelta > 0 && rCxt.mrDoc.IsExpandRefs())
+    {
+        UpdateRefExpandGroupBoundChecker aExpandChecker(rCxt, aBounds);
+        std::for_each(maCells.begin(), maCells.end(), aExpandChecker);
+    }
+
     // Do the actual splitting.
     sc::SharedFormulaUtil::splitFormulaCellGroups(maCells, aBounds);
 
diff --git a/sc/source/core/tool/token.cxx b/sc/source/core/tool/token.cxx
index 1b550af..9961b58 100644
--- a/sc/source/core/tool/token.cxx
+++ b/sc/source/core/tool/token.cxx
@@ -2642,9 +2642,18 @@ bool expandRange( const sc::RefUpdateContext& rCxt, ScRange& rRefRange, const Sc
             // Selected range is only partially overlapping in vertical direction. Bail out.
             return false;
 
-        if (!rCxt.mrDoc.IsExpandRefs() && rSelectedRange.aStart.Col() <= rRefRange.aStart.Col())
-            // Selected range is at the left end and the edge expansion is turned off.  No expansion.
-            return false;
+        if (rCxt.mrDoc.IsExpandRefs())
+        {
+            if (rRefRange.aEnd.Col() - rRefRange.aStart.Col() < 1)
+                // Reference must be at least two columns wide.
+                return false;
+        }
+        else
+        {
+            if (rSelectedRange.aStart.Col() <= rRefRange.aStart.Col())
+                // Selected range is at the left end and the edge expansion is turned off.  No expansion.
+                return false;
+        }
 
         // Move the last column position to the right.
         SCCOL nDelta = rSelectedRange.aEnd.Col() - rSelectedRange.aStart.Col() + 1;
@@ -2658,9 +2667,18 @@ bool expandRange( const sc::RefUpdateContext& rCxt, ScRange& rRefRange, const Sc
             // Selected range is only partially overlapping in horizontal direction. Bail out.
             return false;
 
-        if (!rCxt.mrDoc.IsExpandRefs() && rSelectedRange.aStart.Row() <= rRefRange.aStart.Row())
-            // Selected range is at the top end and the edge expansion is turned off.  No expansion.
-            return false;
+        if (rCxt.mrDoc.IsExpandRefs())
+        {
+            if (rRefRange.aEnd.Row() - rRefRange.aStart.Row() < 1)
+                // Reference must be at least two rows tall.
+                return false;
+        }
+        else
+        {
+            if (rSelectedRange.aStart.Row() <= rRefRange.aStart.Row())
+                // Selected range is at the top end and the edge expansion is turned off.  No expansion.
+                return false;
+        }
 
         // Move the last row position down.
         SCROW nDelta = rSelectedRange.aEnd.Row() - rSelectedRange.aStart.Row() + 1;
@@ -2687,6 +2705,11 @@ bool expandRangeByEdge( const sc::RefUpdateContext& rCxt, ScRange& rRefRange, co
     if (rCxt.mnColDelta > 0)
     {
         // Insert and shift right.
+
+        if (rRefRange.aEnd.Col() - rRefRange.aStart.Col() < 1)
+            // Reference must be at least two columns wide.
+            return false;
+
         if (rRefRange.aStart.Row() < rSelectedRange.aStart.Row() || rSelectedRange.aEnd.Row() < rRefRange.aEnd.Row())
             // Selected range is only partially overlapping in vertical direction. Bail out.
             return false;
@@ -2702,6 +2725,10 @@ bool expandRangeByEdge( const sc::RefUpdateContext& rCxt, ScRange& rRefRange, co
     }
     else if (rCxt.mnRowDelta > 0)
     {
+        if (rRefRange.aEnd.Row() - rRefRange.aStart.Row() < 1)
+            // Reference must be at least two rows tall.
+            return false;
+
         if (rRefRange.aStart.Col() < rSelectedRange.aStart.Col() || rSelectedRange.aEnd.Col() < rRefRange.aEnd.Col())
             // Selected range is only partially overlapping in horizontal direction. Bail out.
             return false;
@@ -3830,6 +3857,99 @@ void ScTokenArray::CheckRelativeReferenceBounds(
     }
 }
 
+void ScTokenArray::CheckExpandReferenceBounds(
+    const sc::RefUpdateContext& rCxt, const ScAddress& rPos, SCROW nGroupLen, std::vector<SCROW>& rBounds ) const
+{
+    const SCROW nInsRow = rCxt.maRange.aStart.Row();
+    const FormulaToken* const * p = pCode;
+    const FormulaToken* const * pEnd = p + static_cast<size_t>(nLen);
+    for (; p != pEnd; ++p)
+    {
+        switch ((*p)->GetType())
+        {
+            case svDoubleRef:
+            {
+                const ScToken* pToken = static_cast<const ScToken*>(*p);
+                const ScComplexRefData& rRef = pToken->GetDoubleRef();
+                bool bStartRowRelative = rRef.Ref1.IsRowRel();
+                bool bEndRowRelative = rRef.Ref2.IsRowRel();
+
+                // For absolute references nothing needs to be done, they stay
+                // the same for all and if to be expanded the group will be
+                // adjusted later.
+                if (!bStartRowRelative && !bEndRowRelative)
+                    break;  // switch
+
+                ScRange aAbsStart(rRef.toAbs(rPos));
+                ScAddress aPos(rPos);
+                aPos.IncRow(nGroupLen);
+                ScRange aAbsEnd(rRef.toAbs(aPos));
+                // References must be at least two rows to be expandable.
+                if ((aAbsStart.aEnd.Row() - aAbsStart.aStart.Row() < 1) &&
+                        (aAbsEnd.aEnd.Row() - aAbsEnd.aStart.Row() < 1))
+                    break;  // switch
+
+                // Only need to process if an edge may be touching the
+                // insertion row anywhere within the run of the group.
+                if (!((aAbsStart.aStart.Row() <= nInsRow && nInsRow <= aAbsEnd.aStart.Row()) ||
+                            (aAbsStart.aEnd.Row() <= nInsRow && nInsRow <= aAbsEnd.aEnd.Row())))
+                    break;  // switch
+
+                SCROW nStartRow = aAbsStart.aStart.Row();
+                SCROW nEndRow = aAbsStart.aEnd.Row();
+                // Position on first relevant range.
+                SCROW nOffset = 0;
+                if (nEndRow + 1 < nInsRow)
+                {
+                    if (bEndRowRelative)
+                    {
+                        nOffset = nInsRow - nEndRow - 1;
+                        nEndRow += nOffset;
+                        if (bStartRowRelative)
+                            nStartRow += nOffset;
+                    }
+                    else    // bStartRowRelative==true
+                    {
+                        nOffset = nInsRow - nStartRow;
+                        nStartRow += nOffset;
+                        // Start is overtaking End, swap.
+                        bStartRowRelative = false;
+                        bEndRowRelative = true;
+                    }
+                }
+                for (SCROW i = nOffset; i < nGroupLen; ++i)
+                {
+                    bool bSplit = (nStartRow == nInsRow || nEndRow + 1 == nInsRow);
+                    if (bSplit)
+                        rBounds.push_back( rPos.Row() + i);
+
+                    if (bEndRowRelative)
+                        ++nEndRow;
+                    if (bStartRowRelative)
+                    {
+                        ++nStartRow;
+                        if (!bEndRowRelative && nStartRow == nEndRow)
+                        {
+                            // Start is overtaking End, swap.
+                            bStartRowRelative = false;
+                            bEndRowRelative = true;
+                        }
+                    }
+                    if (nInsRow < nStartRow || (!bStartRowRelative && nInsRow <= nEndRow))
+                    {
+                        if (bSplit && (++i < nGroupLen))
+                            rBounds.push_back( rPos.Row() + i);
+                        break;  // for, out of range now
+                    }
+                }
+            }
+            break;
+            default:
+                ;
+        }
+    }
+}
+
 namespace {
 
 void appendDouble( sc::TokenStringContext& rCxt, OUStringBuffer& rBuf, double fVal )
commit 44b0389cc14891285856971709ef0eaf8a25bcd4
Author: Michael Stahl <mstahl at redhat.com>
Date:   Tue Feb 24 21:32:54 2015 +0100

    tdf#89666: vcl: speed up HbLayoutEngine line layout for large paragraphs
    
    When formatting a 180k char Writer paragraph, most of the time is spent
    in vcl::ScriptRun::next(), which is called twice per line from
    SwTxtGuess::Guess(), once via GetTxtBreak() and once via GetTxtSize().
    
    In the second call, from GetTxtSize(), the end position of the line is
    known, and passed to vcl, and iterating beyond that position seems
    pointless.
    
    This reduces vcl::ScriptRun::next() from 24 to 11 billion callgrind
    cycles when built with GCC 4.9.2 -m32 -Os.
    
    (cherry picked from commit 7fde44c85620f8079bc4863fe3f7ea1f69a0f88c)
    
    Conflicts:
    	vcl/generic/glyphs/gcach_layout.cxx
    
    Change-Id: Ia23fcccaf5ef9c9ecdcb54bfc8f0f8a043c8711e
    Reviewed-on: https://gerrit.libreoffice.org/14645
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 623f16d7a47020600e2b4ba03aa6a617545b0d93)

diff --git a/vcl/generic/glyphs/gcach_layout.cxx b/vcl/generic/glyphs/gcach_layout.cxx
index 3f065bb..bf2eab2 100644
--- a/vcl/generic/glyphs/gcach_layout.cxx
+++ b/vcl/generic/glyphs/gcach_layout.cxx
@@ -372,7 +372,7 @@ bool HbLayoutEngine::layout(ServerFontLayout& rLayout, ImplLayoutArgs& rArgs)
 
     rLayout.Reserve(nGlyphCapacity);
 
-    ScriptRun aScriptRun(reinterpret_cast<const UChar *>(rArgs.mpStr), rArgs.mnLength);
+    ScriptRun aScriptRun(reinterpret_cast<const UChar *>(rArgs.mpStr), rArgs.mnEndCharPos);
 
     Point aCurrPos(0, 0);
     while (true)
commit 8e9c0cfe86b0e6570c41ad625e1e59d289b4015e
Author: Michael Stahl <mstahl at redhat.com>
Date:   Fri Feb 20 20:57:59 2015 +0100

    tdf#89665: i18npool: fix pathological transliterate slow-path
    
    TransliterationImpl::transliterate() has a slow-path for the case when
    more than one trasliteration module is cascaded which swaps 2
    uno::Sequence.  This is unbelievably slow because non-const
    Sequence::operator[] does a function call into cppu to check whether COW
    has to be done.
    
    This speeds up transliterate() from 344 billion to 101 billion callgrind
    cycles when built with GCC 4.9.2 -m32 -Os.
    
    Commit d2771b63b94a8aae3c25c83e9dae9f83242f46c1 added a second
    transliteration module that is enabled by default, making the problem
    visible, especially with long paragraphs in Writer.
    
    Change-Id: I2799df9173ac73aab8c4eb4cc6f592976b06c8da
    (cherry picked from commit 88d4b2fb08b983531b1e0abc71b07f4bdecdc925)
    Reviewed-on: https://gerrit.libreoffice.org/14644
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit 5e28588770fa27eb210d004aec2f56e28fe01252)

diff --git a/i18npool/source/transliteration/transliterationImpl.cxx b/i18npool/source/transliteration/transliterationImpl.cxx
index b9e4445..20d22f0 100644
--- a/i18npool/source/transliteration/transliterationImpl.cxx
+++ b/i18npool/source/transliteration/transliterationImpl.cxx
@@ -326,9 +326,17 @@ TransliterationImpl::transliterate( const OUString& inStr, sal_Int32 startPos, s
 
             nCount = tmpStr.getLength();
 
+            assert(off[from].getLength() == nCount);
             tmp = from; from = to; to = tmp;
+            // tdf#89665: don't use operator[] to write - too slow!
+            // interestingly gcc 4.9 -Os won't even inline the const operator[]
+            sal_Int32 const*const pFrom(off[from].getConstArray());
+            sal_Int32 *const pTo(off[to].getArray());
             for (sal_Int32 j = 0; j < nCount; j++)
-                off[to][j] = off[from][off[to][j]];
+            {
+                assert(pTo[j] < off[from].getLength());
+                pTo[j] = pFrom[pTo[j]];
+            }
         }
         offset = off[to];
         return tmpStr;
commit 49c4b067f5c209b40d06804c2399fb1706b92282
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 25 10:50:59 2015 +0000

    check if reads were successful
    
    Reviewed-on: https://gerrit.libreoffice.org/14631
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit f974db5d89eacf0c23e303c22c62972014e9db16)
    
    Conflicts:
    	hwpfilter/source/hiodev.cxx
    	hwpfilter/source/hiodev.h
    	hwpfilter/source/hwpfile.cxx
    
    Change-Id: I69ab0ca9c017c9a1c10d18fd850f32a92c641d12
    Reviewed-on: https://gerrit.libreoffice.org/14654
    Tested-by: Michael Stahl <mstahl at redhat.com>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit f2d49715c176c80c4b0fa3a7799d610eb5afec88)

diff --git a/hwpfilter/source/drawdef.h b/hwpfilter/source/drawdef.h
index 6cb38fe..0bd7b7d 100644
--- a/hwpfilter/source/drawdef.h
+++ b/hwpfilter/source/drawdef.h
@@ -77,11 +77,11 @@ struct BAREHWPDOProperty
     int line_pstyle;
     int line_hstyle;
     int line_tstyle;
-    DWORD line_color;
+    unsigned int line_color;
     hunit line_width;
-    DWORD fill_color;
+    unsigned int fill_color;
     uint pattern_type;
-    DWORD pattern_color;
+    unsigned int pattern_color;
     hunit hmargin;
     hunit vmargin;
     uint flag;
@@ -130,11 +130,11 @@ struct HWPDOProperty
     int line_pstyle; /* 선 중간 모양 */
     int line_hstyle; /* 끝 화살표 모양 */
     int line_tstyle; /* 시작 모양 */
-    DWORD line_color;
+    unsigned int line_color;
     hunit line_width;
-    DWORD fill_color;
+    unsigned int fill_color;
     uint pattern_type;
-    DWORD pattern_color;
+    unsigned int pattern_color;
     hunit hmargin;
     hunit vmargin;
     uint flag;
diff --git a/hwpfilter/source/drawing.h b/hwpfilter/source/drawing.h
index 8190d0e..439f815 100644
--- a/hwpfilter/source/drawing.h
+++ b/hwpfilter/source/drawing.h
@@ -124,7 +124,6 @@ inline bool HAS_PAT(HWPDrawingObject * hdo)
         HAVE_GRADATION(hdo) || HAVE_BITMAP_PATTERN(hdo);
 }
 
-
 static void SetHdoParallRgn(HWPDrawingObject * hdo, int width, int height)
 {
     hdo->property.parall.pt[0].x = 0;
@@ -135,37 +134,37 @@ static void SetHdoParallRgn(HWPDrawingObject * hdo, int width, int height)
     hdo->property.parall.pt[2].y = height;
 }
 
-
 static bool SkipPrivateBlock(int type)
 {
     int n;
 
     if (type == OBJRET_FILE_NO_PRIVATE_BLOCK)
     {
-        n = hmem->read4b();
+        if (!hmem->read4b(n))
+            return false;
         if (hmem->state() || hmem->skipBlock(n) != n)
             return false;
     }
-    n = hmem->read4b();
+    if (!hmem->read4b(n))
+        return false;
     if (hmem->state())
         return false;
     return hmem->skipBlock(n) == n;
 }
 
-
 static int SizeExpected;
 static int SizeRead;
 
 static int ReadSizeField(int size)
 {
     SizeExpected = size;
-    SizeRead = hmem->read4b();
+    if (!hmem->read4b(SizeRead))
+        return -1;
     if (hmem->state())
         return -1;
     return SizeRead;
 }
 
-
 static bool SkipUnusedField(void)
 {
     return (SizeExpected < SizeRead) ?
@@ -179,62 +178,93 @@ static bool SkipUnusedField(void)
 #define HDOFILE_HAS_NEXT    0x01
 #define HDOFILE_HAS_CHILD   0x02
 
-static bool LoadCommonHeader(HWPDrawingObject * hdo, WORD * link_info)
+static bool LoadCommonHeader(HWPDrawingObject * hdo, unsigned short * link_info)
 {
     uint size, common_size;
 
-     if( !hmem )
-         return FALSE;
-    size = hmem->read4b();
+    if (!hmem)
+        return false;
+    if (!hmem->read4b(size))
+        return false;
     if (hmem->state())
-    {
-        return FALSE;
-    }
+        return false;
     if (size < HDOFILE_COMMON_SIZE)
-    {
-        return FALSE;
-    }
+        return false;
 
     common_size = HDOFILE_COMMON_SIZE;
-    hdo->type = hmem->read2b();
-    *link_info = sal::static_int_cast<WORD>(hmem->read2b());
-    hdo->offset.x = hmem->read4b();
-    hdo->offset.y = hmem->read4b();
-    hdo->extent.w = hmem->read4b();
-    hdo->extent.h = hmem->read4b();
-    hdo->offset2.x = hmem->read4b();
-    hdo->offset2.y = hmem->read4b();
+    unsigned short tmp16;
+    if (!hmem->read2b(tmp16))
+        return false;
+    hdo->type = tmp16;
+    if (!hmem->read2b(tmp16))
+        return false;
+    *link_info = tmp16;
+    if (!hmem->read4b(hdo->offset.x))
+        return false;
+    if (!hmem->read4b(hdo->offset.y))
+        return false;
+    if (!hmem->read4b(hdo->extent.w))
+        return false;
+    if (!hmem->read4b(hdo->extent.h))
+        return false;
+    if (!hmem->read4b(hdo->offset2.x))
+        return false;
+    if (!hmem->read4b(hdo->offset2.y))
+        return false;
 
     if (hmem->state())
-        return FALSE;
+        return false;
 
-    hdo->vrect.x = hmem->read4b();
-    hdo->vrect.y = hmem->read4b();
-    hdo->vrect.w = hmem->read4b();
-    hdo->vrect.h = hmem->read4b();
+    if (!hmem->read4b(hdo->vrect.x))
+        return false;
+    if (!hmem->read4b(hdo->vrect.y))
+        return false;
+    if (!hmem->read4b(hdo->vrect.w))
+        return false;
+    if (!hmem->read4b(hdo->vrect.h))
+        return false;
 
 // read bare property 44 bytes
-    hdo->property.line_pstyle = hmem->read4b();
-    hdo->property.line_hstyle = hmem->read4b();
-    hdo->property.line_tstyle = hmem->read4b();
-    hdo->property.line_color = hmem->read4b();
-    hdo->property.line_width = (hunit) hmem->read4b();
-    hdo->property.fill_color = hmem->read4b();
-    hdo->property.pattern_type = hmem->read4b();
-    hdo->property.pattern_color = hmem->read4b();
-    hdo->property.hmargin = (hunit) hmem->read4b();
-    hdo->property.vmargin = (hunit) hmem->read4b();
-    hdo->property.flag = hmem->read4b();
-// read ratation property 32 bytes
+    if (!hmem->read4b(hdo->property.line_pstyle))
+        return false;
+    if (!hmem->read4b(hdo->property.line_hstyle))
+        return false;
+    if (!hmem->read4b(hdo->property.line_tstyle))
+        return false;
+    if (!hmem->read4b(hdo->property.line_color))
+        return false;
+    unsigned int tmp32;
+    if (!hmem->read4b(tmp32))
+        return false;
+    hdo->property.line_width = static_cast<hunit>(tmp32);
+    if (!hmem->read4b(hdo->property.fill_color))
+        return false;
+    if (!hmem->read4b(hdo->property.pattern_type))
+        return false;
+    if (!hmem->read4b(hdo->property.pattern_color))
+        return false;
+    if (!hmem->read4b(tmp32))
+        return false;
+    hdo->property.hmargin = static_cast<hunit>(tmp32);
+    if (!hmem->read4b(tmp32))
+        return false;
+    hdo->property.vmargin = static_cast<hunit>(tmp32);
+    if (!hmem->read4b(hdo->property.flag))
+        return false;
+// read rotation property 32 bytes
     if ((size >= common_size + 32)
         && (hdo->property.flag & HWPDO_FLAG_ROTATION))
     {
-        hdo->property.rot_originx = hmem->read4b();
-        hdo->property.rot_originy = hmem->read4b();
-        for (int ii = 0; ii < 3; ii++)
+        if (!hmem->read4b(hdo->property.rot_originx))
+            return false;
+        if (!hmem->read4b(hdo->property.rot_originy))
+            return false;
+        for (int ii = 0; ii < 3; ++ii)
         {
-            hdo->property.parall.pt[ii].x = hmem->read4b();
-            hdo->property.parall.pt[ii].y = hmem->read4b();
+            if (!hmem->read4b(hdo->property.parall.pt[ii].x))
+                return false;
+            if (!hmem->read4b(hdo->property.parall.pt[ii].y))
+                return false;
         }
         common_size += 32;
     }
@@ -245,13 +275,20 @@ static bool LoadCommonHeader(HWPDrawingObject * hdo, WORD * link_info)
     if ((size >= common_size + 28) &&
         (hdo->property.flag & HWPDO_FLAG_GRADATION))
     {
-        hdo->property.fromcolor = hmem->read4b();
-        hdo->property.tocolor = hmem->read4b();
-        hdo->property.gstyle = hmem->read4b();
-        hdo->property.angle = hmem->read4b();
-        hdo->property.center_x = hmem->read4b();
-        hdo->property.center_y = hmem->read4b();
-        hdo->property.nstep = hmem->read4b();
+        if (!hmem->read4b(hdo->property.fromcolor))
+            return false;
+        if (!hmem->read4b(hdo->property.tocolor))
+            return false;
+        if (!hmem->read4b(hdo->property.gstyle))
+            return false;
+        if (!hmem->read4b(hdo->property.angle))
+            return false;
+        if (!hmem->read4b(hdo->property.center_x))
+            return false;
+        if (!hmem->read4b(hdo->property.center_y))
+            return false;
+        if (!hmem->read4b(hdo->property.nstep))
+            return false;
         common_size += 28;
     }
 
@@ -259,54 +296,67 @@ static bool LoadCommonHeader(HWPDrawingObject * hdo, WORD * link_info)
     if ((size >= common_size + 278) && \
         (hdo->property.flag & HWPDO_FLAG_BITMAP))
     {
-        hdo->property.offset1.x = hmem->read4b();
-        hdo->property.offset1.y = hmem->read4b();
-        hdo->property.offset2.x = hmem->read4b();
-        hdo->property.offset2.y = hmem->read4b();
+        if (!hmem->read4b(hdo->property.offset1.x))
+            return false;
+        if (!hmem->read4b(hdo->property.offset1.y))
+            return false;
+        if (!hmem->read4b(hdo->property.offset2.x))
+            return false;
+        if (!hmem->read4b(hdo->property.offset2.y))
+            return false;
         if (!hmem->readBlock(hdo->property.szPatternFile, 261))
-            return FALSE;
-        hdo->property.pictype = sal::static_int_cast<char>(hmem->read1b());
+            return false;
+        if (!hmem->read1b(hdo->property.pictype))
+            return false;
         common_size += 278;
     }
      if( ( size >= common_size + 3 ) && ( hdo->property.flag & HWPDO_FLAG_WATERMARK ) )
      //if( ( size >= common_size ) && ( hdo->property.flag >> 20 & 0x01 ) )
      {
-          if( size - common_size >= 5 )
-              hmem->skipBlock( 2 );
-         hdo->property.luminance = hmem->read1b();
-         hdo->property.contrast = hmem->read1b();
-         hdo->property.greyscale = hmem->read1b();
-         common_size += 5;
-     }
-    else{
-         hdo->property.luminance = 0;
-         hdo->property.contrast = 0;
-         hdo->property.greyscale = 0;
+        if (size - common_size >= 5)
+            hmem->skipBlock(2);
+        unsigned char tmp8;
+        if (!hmem->read1b(tmp8))
+            return false;
+        hdo->property.luminance = tmp8;
+        if (!hmem->read1b(tmp8))
+            return false;
+        hdo->property.contrast = tmp8;
+        if (!hmem->read1b(tmp8))
+            return false;
+        hdo->property.greyscale = tmp8;
+
+        common_size += 5;
+    }
+    else
+    {
+        hdo->property.luminance = 0;
+        hdo->property.contrast = 0;
+        hdo->property.greyscale = 0;
     }
-     hdo->property.pPara = 0L;
+    hdo->property.pPara = 0L;
 
-     if( ( size > common_size ) && (hdo->property.flag & HWPDO_FLAG_AS_TEXTBOX) )
-     {
-          hmem->skipBlock(8);
-          hdo->property.pPara = LoadParaList();
-          if( hdo->property.pPara )
-                return TRUE;
-          else
-                return FALSE;
+    if( ( size > common_size ) && (hdo->property.flag & HWPDO_FLAG_AS_TEXTBOX) )
+    {
+        hmem->skipBlock(8);
+        hdo->property.pPara = LoadParaList();
+        if( hdo->property.pPara )
+            return true;
+        else
+            return false;
      }
 
-     if( size <= common_size )
-          return TRUE;
+     if (size <= common_size)
+          return true;
      return hmem->skipBlock(size - common_size ) != 0;
 }
 
-
 static HWPDrawingObject *LoadDrawingObject(void)
 {
     HWPDrawingObject *hdo, *head, *prev;
     int res;
 
-    WORD link_info;
+    unsigned short link_info;
 
     head = prev = NULL;
     do
@@ -365,6 +415,11 @@ static HWPDrawingObject *LoadDrawingObject(void)
 
     if (hdo != NULL)
     {
+        if (hdo->type < 0 || hdo->type >= HWPDO_NITEMS)
+        {
+            hdo->type = HWPDO_RECT;
+        }
+
         HWPDOFunc(hdo, OBJFUNC_FREE, NULL, 0);
         delete hdo;
     }
@@ -380,17 +435,25 @@ static HWPDrawingObject *LoadDrawingObject(void)
 
 static bool LoadDrawingObjectBlock(Picture * pic)
 {
-    int size = hmem->read4b();
+    int size;
+    if (!hmem->read4b(size))
+        return false;
 
     if (hmem->state() || size < HDOFILE_HEADER_SIZE)
         return false;
 
-    pic->picinfo.picdraw.zorder = hmem->read4b();
-    pic->picinfo.picdraw.mbrcnt = hmem->read4b();
-    pic->picinfo.picdraw.vrect.x = hmem->read4b();
-    pic->picinfo.picdraw.vrect.y = hmem->read4b();
-    pic->picinfo.picdraw.vrect.w = hmem->read4b();
-    pic->picinfo.picdraw.vrect.h = hmem->read4b();
+    if (!hmem->read4b(pic->picinfo.picdraw.zorder))
+        return false;
+    if (!hmem->read4b(pic->picinfo.picdraw.mbrcnt))
+        return false;
+    if (!hmem->read4b(pic->picinfo.picdraw.vrect.x))
+        return false;
+    if (!hmem->read4b(pic->picinfo.picdraw.vrect.y))
+        return false;
+    if (!hmem->read4b(pic->picinfo.picdraw.vrect.w))
+        return false;
+    if (!hmem->read4b(pic->picinfo.picdraw.vrect.h))
+        return false;
 
     if (size > HDOFILE_HEADER_SIZE &&
         !hmem->skipBlock(size - HDOFILE_HEADER_SIZE))
@@ -402,9 +465,7 @@ static bool LoadDrawingObjectBlock(Picture * pic)
     return true;
 }
 
-
 // object manipulation function
-
 static int
 HWPDODefaultFunc(int , HWPDrawingObject * , int cmd, void *, int)
 {
@@ -413,7 +474,6 @@ HWPDODefaultFunc(int , HWPDrawingObject * , int cmd, void *, int)
     return OBJRET_FILE_OK;
 }
 
-
 static int
 HWPDOLineFunc(int type, HWPDrawingObject * hdo, int cmd, void *argp, int argv)
 {
@@ -423,7 +483,8 @@ HWPDOLineFunc(int type, HWPDrawingObject * hdo, int cmd, void *argp, int argv)
         case OBJFUNC_LOAD:
             if (ReadSizeField(4) < 4)
                 return OBJRET_FILE_ERROR;
-            hdo->u.line_arc.flip = hmem->read4b();
+            if (!hmem->read4b(hdo->u.line_arc.flip))
+                return OBJRET_FILE_ERROR;
             if (hmem->state())
                 return OBJRET_FILE_ERROR;
             if (!SkipUnusedField())
@@ -466,11 +527,14 @@ int cmd, void *argp, int argv)
         case OBJFUNC_LOAD:
             if (ReadSizeField(16) < 16)
                 return OBJRET_FILE_ERROR;
-            hdo->u.arc.radial[0].x = hmem->read4b();
-            hdo->u.arc.radial[0].y = hmem->read4b();
-            hdo->u.arc.radial[1].x = hmem->read4b();
-            hdo->u.arc.radial[1].y = hmem->read4b();
-
+            if (!hmem->read4b(hdo->u.arc.radial[0].x))
+                return OBJRET_FILE_ERROR;
+            if (!hmem->read4b(hdo->u.arc.radial[0].y))
+                return OBJRET_FILE_ERROR;
+            if (!hmem->read4b(hdo->u.arc.radial[1].x))
+                return OBJRET_FILE_ERROR;
+            if (!hmem->read4b(hdo->u.arc.radial[1].y))
+                return OBJRET_FILE_ERROR;
             if (ReadSizeField(0) < 0)
                 return OBJRET_FILE_ERROR;
             break;
@@ -491,7 +555,8 @@ HWPDOArcFunc(int type, HWPDrawingObject * hdo, int cmd, void *argp, int argv)
         case OBJFUNC_LOAD:
             if (ReadSizeField(4) < 4)
                 return OBJRET_FILE_ERROR;
-            hdo->u.line_arc.flip = hmem->read4b();
+            if (!hmem->read4b(hdo->u.line_arc.flip))
+                return OBJRET_FILE_ERROR;
             if (hmem->state())
                 return OBJRET_FILE_ERROR;
             if (!SkipUnusedField())
@@ -532,7 +597,8 @@ int cmd, void *argp, int argv)
             hdo->u.freeform.pt = 0;
             if (ReadSizeField(4) < 4)
                 return OBJRET_FILE_ERROR;
-            hdo->u.freeform.npt = hmem->read4b();
+            if (!hmem->read4b(hdo->u.freeform.npt))
+                return OBJRET_FILE_ERROR;
             if (hmem->state())
                 return OBJRET_FILE_ERROR;
             if (!SkipUnusedField())
@@ -551,11 +617,16 @@ int cmd, void *argp, int argv)
                     hdo->u.freeform.npt = 0;
                     return OBJRET_FILE_ERROR;
                 }
-                for (int ii = 0; ii < hdo->u.freeform.npt; ii++)
+                for (int ii = 0; ii < hdo->u.freeform.npt; ++ii)
                 {
-                    hdo->u.freeform.pt[ii].x = hmem->read4b();
-                    hdo->u.freeform.pt[ii].y = hmem->read4b();
+                    bool bFailure = false;
+                    if (!hmem->read4b(hdo->u.freeform.pt[ii].x))
+                        bFailure = true;
+                    if (!hmem->read4b(hdo->u.freeform.pt[ii].y))
+                        bFailure = true;
                     if (hmem->state())
+                        bFailure = true;
+                    if (bFailure)
                     {
                         delete[]hdo->u.freeform.pt;
                         hdo->u.freeform.npt = 0;
diff --git a/hwpfilter/source/hbox.h b/hwpfilter/source/hbox.h
index 26a2962..62235c4 100644
--- a/hwpfilter/source/hbox.h
+++ b/hwpfilter/source/hbox.h
@@ -75,7 +75,7 @@ struct HBox
  */
 struct SkipData: public HBox
 {
-    ulong data_block_len;
+    uint data_block_len;
     hchar dummy;
     char  *data_block;
 
@@ -635,7 +635,7 @@ struct Picture: public FBox
  * follow_block_size is the size information of the Drawing object of hwp.
  * It's value is greater than 0 if the pictype is PICTYPE_DRAW.
  */
-    ulong     follow_block_size;                  /* 추가정보 길이. */
+    uint      follow_block_size;                  /* 추가정보 길이. */
     short     dummy1;                             // to not change structure size */
     short     dummy2;                             // to not change structure size */
     uchar     reserved1;
diff --git a/hwpfilter/source/hinfo.cxx b/hwpfilter/source/hinfo.cxx
index 98f66a5..ee7654d 100644
--- a/hwpfilter/source/hinfo.cxx
+++ b/hwpfilter/source/hinfo.cxx
@@ -85,15 +85,34 @@ bool HWPInfo::Read(HWPFile & hwpf)
     hwpf.Read1b(&paper.paper_direction, 1);       /* 용지 방향 */
 
 // paper geometry information
-    paper.paper_height = (short) hwpf.Read2b();   /* 용지 길이 */
-    paper.paper_width = (short) hwpf.Read2b();    /* 용지 너비 */
-    paper.top_margin = (short) hwpf.Read2b();     /* 위쪽 여백 */
-    paper.bottom_margin = (short) hwpf.Read2b();  /* 아래쪽 여백 */
-    paper.left_margin = (short) hwpf.Read2b();    /* 왼쪽 여백 */
-    paper.right_margin = (short) hwpf.Read2b();   /* 오른쪽 여백 */
-    paper.header_length = (short) hwpf.Read2b();  /* 머리말 길이 */
-    paper.footer_length = (short) hwpf.Read2b();  /* 꼬리말 길이 */
-    paper.gutter_length = (short) hwpf.Read2b();  /* 제본여백 */
+    unsigned short tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    paper.paper_height = tmp16;                   /* 용지 길이 */
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    paper.paper_width = tmp16;                    /* 용지 너비 */
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    paper.top_margin = tmp16;                     /* 위쪽 여백 */
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    paper.bottom_margin = tmp16;                  /* 아래쪽 여백 */
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    paper.left_margin = tmp16;                    /* 왼쪽 여백 */
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    paper.right_margin = tmp16;                   /* 오른쪽 여백 */
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    paper.header_length = tmp16;                  /* 머리말 길이 */
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    paper.footer_length = tmp16;                  /* 꼬리말 길이 */
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    paper.gutter_length = tmp16;                  /* 제본여백 */
     hwpf.Read2b(&readonly, 1);                    /* 예약 */
     hwpf.Read1b(reserved1, 4);                    /* 예약 */
     hwpf.Read1b(&chain_info.chain_page_no, 1);    /* 쪽 번호 연결 1-연결, 0-새로시작 (연결인쇄에서 사용) */
@@ -109,14 +128,25 @@ bool HWPInfo::Read(HWPFile & hwpf)
 // footnote
     hwpf.Read2b(&beginfnnum,1);                   /* 각주 시작번호 */
     hwpf.Read2b(&countfn,1);                      /* 각주 갯수 */
-    splinetext = (short) hwpf.Read2b();
-    splinefn = (short) hwpf.Read2b();
-    spfnfn = (short) hwpf.Read2b();
+
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    splinetext = tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    splinefn = tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    spfnfn = tmp16;
     hwpf.Read1b(&fnchar, 1);
     hwpf.Read1b(&fnlinetype, 1);
 // border layout
     for (int ii = 0; ii < 4; ++ii)
-        bordermargin[ii] = (short) hwpf.Read2b();
+    {
+        if (!hwpf.Read2b(tmp16))
+            return false;
+        bordermargin[ii] = tmp16;
+    }
     hwpf.Read2b(&borderline, 1);
 
     hwpf.Read1b(&empty_line_hide, 1);
@@ -171,12 +201,23 @@ bool HWPSummary::Read(HWPFile & hwpf)
 
 bool ParaShape::Read(HWPFile & hwpf)
 {
-     pagebreak = 0;
-    left_margin = (short) hwpf.Read2b();
-    right_margin = (short) hwpf.Read2b();
-    indent = (short) hwpf.Read2b();
-    lspacing = (short) hwpf.Read2b();
-    pspacing_next = (short) hwpf.Read2b();
+    pagebreak = 0;
+    unsigned short tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    left_margin = tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    right_margin = tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    indent = tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    lspacing = tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    pspacing_next = tmp16;
 
     hwpf.Read1b(&condense, 1);
     hwpf.Read1b(&arrange_type, 1);
@@ -184,17 +225,27 @@ bool ParaShape::Read(HWPFile & hwpf)
     {
         hwpf.Read1b(&tabs[ii].type, 1);
         hwpf.Read1b(&tabs[ii].dot_continue, 1);
-        tabs[ii].position = (short) hwpf.Read2b();
+        if (!hwpf.Read2b(tmp16))
+            return false;
+        tabs[ii].position = tmp16;
     }
     hwpf.Read1b(&coldef.ncols, 1);
     hwpf.Read1b(&coldef.separator, 1);
-    coldef.spacing = (short) hwpf.Read2b();
-    coldef.columnlen = (short) hwpf.Read2b();
-    coldef.columnlen0 = (short) hwpf.Read2b();
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    coldef.spacing = tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    coldef.columnlen = tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    coldef.columnlen0 = tmp16;
     hwpf.Read1b(&shade, 1);
     hwpf.Read1b(&outline, 1);
     hwpf.Read1b(&outline_continue, 1);
-    pspacing_prev = (short) hwpf.Read2b();
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    pspacing_prev = tmp16;
 
     hwpf.Read1b(reserved, 2);
     return (!hwpf.State());
@@ -203,7 +254,10 @@ bool ParaShape::Read(HWPFile & hwpf)
 
 bool CharShape::Read(HWPFile & hwpf)
 {
-    size = (short) hwpf.Read2b();
+    unsigned short tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    size = tmp16;
     hwpf.Read1b(font, NLanguage);
     hwpf.Read1b(ratio, NLanguage);
     hwpf.Read1b(space, NLanguage);
diff --git a/hwpfilter/source/hiodev.cxx b/hwpfilter/source/hiodev.cxx
index 577b5f8..8e69d56 100644
--- a/hwpfilter/source/hiodev.cxx
+++ b/hwpfilter/source/hiodev.cxx
@@ -64,14 +64,14 @@ int HIODev::read1b(void *ptr, int nmemb)
         return -1;
     for (ii = 0; ii < nmemb; ii++)
     {
-        p[ii] = sal::static_int_cast<uchar>(read1b());
+        if (!read1b(p[ii]))
+            break;
         if (state())
             break;
     }
     return ii;
 }
 
-
 int HIODev::read2b(void *ptr, int nmemb)
 {
     ushort *p = (ushort *) ptr;
@@ -81,24 +81,25 @@ int HIODev::read2b(void *ptr, int nmemb)
         return -1;
     for (ii = 0; ii < nmemb; ii++)
     {
-        p[ii] = sal::static_int_cast<uchar>(read2b());
+        if (!read2b(p[ii]))
+            break;
         if (state())
             break;
     }
     return ii;
 }
 
-
 int HIODev::read4b(void *ptr, int nmemb)
 {
-    ulong *p = (ulong *) ptr;
+    uint *p = (uint *) ptr;
     int ii;
 
     if (state())
         return -1;
     for (ii = 0; ii < nmemb; ii++)
     {
-        p[ii] = read4b();
+        if (!read4b(p[ii]))
+            break;
         if (state())
             break;
     }
@@ -179,39 +180,57 @@ bool HStreamIODev::setCompressed(bool flag)
 
 #define GZREAD(ptr,len) (_gzfp?gz_read(_gzfp,ptr,len):0)
 
-int HStreamIODev::read1b()
+bool HStreamIODev::read1b(unsigned char &out)
 {
     int res = (compressed) ? GZREAD(rBuf, 1) : _stream.readBytes(rBuf, 1);
 
-    if (res <= 0)
-        return -1;
-    else
-        return (unsigned char) rBuf[0];
+    if (res < 1)
+        return false;
+
+    out = (unsigned char)rBuf[0];
+    return true;
 }
 
+bool HStreamIODev::read1b(char &out)
+{
+    unsigned char tmp8;
+    if (!read1b(tmp8))
+        return false;
+    out = tmp8;
+    return true;
+}
 
-int HStreamIODev::read2b()
+bool HStreamIODev::read2b(unsigned short &out)
 {
     int res = (compressed) ? GZREAD(rBuf, 2) : _stream.readBytes(rBuf, 2);
 
-    if (res <= 0)
-        return -1;
-    else
-        return ((unsigned char) rBuf[1] << 8 | (unsigned char) rBuf[0]);
-}
+    if (res < 2)
+        return false;
 
+    out = ((unsigned char) rBuf[1] << 8 | (unsigned char) rBuf[0]);
+    return true;
+}
 
-long HStreamIODev::read4b()
+bool HStreamIODev::read4b(unsigned int &out)
 {
     int res = (compressed) ? GZREAD(rBuf, 4) : _stream.readBytes(rBuf, 4);
 
-    if (res <= 0)
-        return -1;
-    else
-        return ((unsigned char) rBuf[3] << 24 | (unsigned char) rBuf[2] << 16 |
-            (unsigned char) rBuf[1] << 8 | (unsigned char) rBuf[0]);
+    if (res < 4)
+        return false;
+
+    out = ((unsigned char) rBuf[3] << 24 | (unsigned char) rBuf[2] << 16 |
+        (unsigned char) rBuf[1] << 8 | (unsigned char) rBuf[0]);
+    return true;
 }
 
+bool HStreamIODev::read4b(int &out)
+{
+    unsigned int tmp32;
+    if (!read4b(tmp32))
+        return false;
+    out = tmp32;
+    return true;
+}
 
 int HStreamIODev::readBlock(void *ptr, int size)
 {
@@ -223,7 +242,6 @@ int HStreamIODev::readBlock(void *ptr, int size)
     return count;
 }
 
-
 int HStreamIODev::skipBlock(int size)
 {
     if (compressed){
@@ -298,36 +316,56 @@ bool HMemIODev::setCompressed(bool )
     return false;
 }
 
-
-int HMemIODev::read1b()
+bool HMemIODev::read1b(unsigned char &out)
 {
     if (pos <= length)
-         return ptr[pos++];
-     else
-         return 0;
+    {
+        out = ptr[pos++];
+        return true;
+    }
+    return false;
 }
 
+bool HMemIODev::read1b(char &out)
+{
+    unsigned char tmp8;
+    if (!read1b(tmp8))
+        return false;
+    out = tmp8;
+    return true;
+}
 
-int HMemIODev::read2b()
+bool HMemIODev::read2b(unsigned short &out)
 {
     pos += 2;
     if (pos <= length)
-         return ptr[pos - 1] << 8 | ptr[pos - 2];
-     else
-         return 0;
+    {
+         out = ptr[pos - 1] << 8 | ptr[pos - 2];
+         return true;
+    }
+    return false;
 }
 
-
-long HMemIODev::read4b()
+bool HMemIODev::read4b(unsigned int &out)
 {
     pos += 4;
     if (pos <= length)
-         return DWORD(ptr[pos - 1] << 24 | ptr[pos - 2] << 16 |
-        ptr[pos - 3] << 8 | ptr[pos - 4]);
-     else
-         return 0;
+    {
+        out = static_cast<unsigned int>(ptr[pos - 1] << 24 | ptr[pos - 2] << 16 |
+                    ptr[pos - 3] << 8 | ptr[pos - 4]);
+        return true;
+    }
+    return false;
 }
 
+bool HMemIODev::read4b(int &out)
+{
+    unsigned int tmp32;
+    if (!read4b(tmp32))
+        return false;
+    out = tmp32;
+    return true;
+}
 
 int HMemIODev::readBlock(void *p, int size)
 {
@@ -338,7 +376,6 @@ int HMemIODev::readBlock(void *p, int size)
     return size;
 }
 
-
 int HMemIODev::skipBlock(int size)
 {
     if (length < pos + size)
diff --git a/hwpfilter/source/hiodev.h b/hwpfilter/source/hiodev.h
index bc8a82b..3deae90 100644
--- a/hwpfilter/source/hiodev.h
+++ b/hwpfilter/source/hiodev.h
@@ -51,9 +51,11 @@ class DLLEXPORT HIODev
 /* gzip routine wrapper */
         virtual bool setCompressed( bool ) = 0;
 
-        virtual int read1b() = 0;
-        virtual int read2b() = 0;
-        virtual long read4b() = 0;
+        virtual bool read1b(unsigned char &out) = 0;
+        virtual bool read1b(char &out) = 0;
+        virtual bool read2b(unsigned short &out) = 0;
+        virtual bool read4b(unsigned int &out) = 0;
+        virtual bool read4b(int &out) = 0;
         virtual int readBlock( void *ptr, int size ) = 0;
         virtual int skipBlock( int size ) = 0;
 
@@ -103,17 +105,19 @@ class HStreamIODev : public HIODev
  * Read one byte from stream
  */
         using HIODev::read1b;
-        virtual int read1b() SAL_OVERRIDE;
+        virtual bool read1b(unsigned char &out) SAL_OVERRIDE;
+        virtual bool read1b(char &out) SAL_OVERRIDE;
 /**
  * Read 2 bytes from stream
  */
         using HIODev::read2b;
-        virtual int read2b() SAL_OVERRIDE;
+        virtual bool read2b(unsigned short &out) SAL_OVERRIDE;
 /**
  * Read 4 bytes from stream
  */
         using HIODev::read4b;
-        virtual long read4b() SAL_OVERRIDE;
+        virtual bool read4b(unsigned int &out) SAL_OVERRIDE;
+        virtual bool read4b(int &out) SAL_OVERRIDE;
 /**
  * Read some bytes from stream to given pointer as amount of size
  */
@@ -149,11 +153,13 @@ class HMemIODev : public HIODev
 /* gzip routine wrapper */
         virtual bool setCompressed( bool ) SAL_OVERRIDE;
         using HIODev::read1b;
-        virtual int read1b() SAL_OVERRIDE;
+        virtual bool read1b(unsigned char &out) SAL_OVERRIDE;
+        virtual bool read1b(char &out) SAL_OVERRIDE;
         using HIODev::read2b;
-        virtual int read2b() SAL_OVERRIDE;
+        virtual bool read2b(unsigned short &out) SAL_OVERRIDE;
         using HIODev::read4b;
-        virtual long read4b() SAL_OVERRIDE;
+        virtual bool read4b(unsigned int &out) SAL_OVERRIDE;
+        virtual bool read4b(int &out) SAL_OVERRIDE;
         virtual int readBlock( void *ptr, int size ) SAL_OVERRIDE;
         virtual int skipBlock( int size ) SAL_OVERRIDE;
     protected:
diff --git a/hwpfilter/source/hpara.cxx b/hwpfilter/source/hpara.cxx
index bc17e0c..66abf78 100644
--- a/hwpfilter/source/hpara.cxx
+++ b/hwpfilter/source/hpara.cxx
@@ -31,14 +31,28 @@
 
 bool LineInfo::Read(HWPFile & hwpf, HWPPara *pPara)
 {
-    pos = sal::static_int_cast<unsigned short>(hwpf.Read2b());
-    space_width = (short) hwpf.Read2b();
-    height = (short) hwpf.Read2b();
+    if (!hwpf.Read2b(pos))
+        return false;
+    unsigned short tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    space_width = tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    height = tmp16;
 // internal information
-    pgy = (short) hwpf.Read2b();
-    sx = (short) hwpf.Read2b();
-    psx = (short) hwpf.Read2b();
-    pex = (short) hwpf.Read2b();
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    pgy = tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    sx = tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    psx = tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    pex = tmp16;
     height_sp = 0;
 
     if( pex >> 15 & 0x01 )
@@ -210,7 +224,10 @@ ParaShape *HWPPara::GetParaShape(void)
 
 HBox *HWPPara::readHBox(HWPFile & hwpf)
 {
-    hchar hh = sal::static_int_cast<hchar>(hwpf.Read2b());
+    hchar hh;
+    if (!hwpf.Read2b(hh))
+        return 0;
+
     HBox *hbox = 0;
 
     if (hwpf.State() != HWP_NoError)
diff --git a/hwpfilter/source/htags.h b/hwpfilter/source/htags.h
index a9c35fe..9000d56 100644
--- a/hwpfilter/source/htags.h
+++ b/hwpfilter/source/htags.h
@@ -54,7 +54,7 @@ struct HyperText
 struct OlePicture
 {
     int   size;
-    ulong signature;
+    uint signature;
 #ifdef WIN32
     IStorage *pis;
 #else
diff --git a/hwpfilter/source/hwpfile.cxx b/hwpfilter/source/hwpfile.cxx
index dabca79..1da5d07 100644
--- a/hwpfilter/source/hwpfile.cxx
+++ b/hwpfilter/source/hwpfile.cxx
@@ -132,44 +132,55 @@ int HWPFile::Open(HStream & stream)
     return HWP_NoError;
 }
 
-
 int HWPFile::State(void) const
 {
     return error_code;
 }
 
-
 int HWPFile::SetState(int errcode)
 {
     error_code = errcode;
     return error_code;
 }
 
-
-int HWPFile::Read1b(void)
+bool HWPFile::Read1b(unsigned char &out)
 {
-    return hiodev ? hiodev->read1b() : -1;
+    return hiodev ? hiodev->read1b(out) : false;
 }
 
-
-int HWPFile::Read2b(void)
+bool HWPFile::Read1b(char &out)
 {
-    return hiodev ? hiodev->read2b() : -1;
+    unsigned char tmp8;
+    if (!Read1b(tmp8))
+        return false;
+    out = tmp8;
+    return true;
 }
 
+bool HWPFile::Read2b(unsigned short &out)
+{
+    return hiodev ? hiodev->read2b(out) : false;
+}
 
-long HWPFile::Read4b(void)
+bool HWPFile::Read4b(unsigned int &out)
 {
-    return hiodev ? hiodev->read4b() : -1;
+    return hiodev ? hiodev->read4b(out) : false;
 }
 
+bool HWPFile::Read4b(int &out)
+{
+    unsigned int tmp32;
+    if (!Read4b(tmp32))
+        return false;
+    out = tmp32;
+    return true;
+}
 
 int HWPFile::Read1b(void *ptr, size_t nmemb)
 {
     return hiodev ? hiodev->read1b(ptr, nmemb) : 0;
 }
 
-
 int HWPFile::Read2b(void *ptr, size_t nmemb)
 {
     return hiodev ? hiodev->read2b(ptr, nmemb) : 0;
@@ -271,23 +282,23 @@ bool HWPFile::ReadParaList(std::list < HWPPara* > &aplist, unsigned char flag)
     return true;
 }
 
-
-bool HWPFile::TagsRead(void)
+void HWPFile::TagsRead(void)
 {
-    ulong tag;
-    long size;
-
     while (true)
     {
-        tag = Read4b();
-        size = Read4b();
+        uint tag;
+        if (!Read4b(tag))
+            return;
+        uint size;
+        if (!Read4b(size))
+            return;
         if (size <= 0 && tag > 0){
             continue;
           }
 
         if (tag == FILETAG_END_OF_COMPRESSED ||
             tag == FILETAG_END_OF_UNCOMPRESSED)
-            return true;
+            return;
         switch (tag)
         {
             case FILETAG_EMBEDDED_PICTURE:
@@ -311,29 +322,39 @@ bool HWPFile::TagsRead(void)
                 if( (size % 617) != 0 )
                     SkipBlock( size );
                 else
-                    for( int i = 0 ; i < size/617 ; i++)
                 {
-                    HyperText *hypert = new HyperText;
-                    hypert->Read(*this);
-                    hyperlist.push_back(hypert);
+                    for( uint i = 0 ; i < size/617 ; i++)
+                    {
+                        HyperText *hypert = new HyperText;
+                        hypert->Read(*this);
+                        hyperlist.push_back(hypert);
+                    }
                 }
                 break;
             }
                 case 6:
                 {
                      ReadBlock(_hwpInfo.back_info.reserved1, 8);
-                     _hwpInfo.back_info.luminance = Read4b();
-                     _hwpInfo.back_info.contrast = Read4b();
-                     _hwpInfo.back_info.effect = sal::static_int_cast<char>(Read1b());
+                     if (!Read4b(_hwpInfo.back_info.luminance))
+                        return;
+                     if (!Read4b(_hwpInfo.back_info.contrast))
+                        return;
+                     if (!Read1b(_hwpInfo.back_info.effect))
+                        return;
                      ReadBlock(_hwpInfo.back_info.reserved2, 7);
                      ReadBlock(_hwpInfo.back_info.filename, 260);
                      ReadBlock(_hwpInfo.back_info.color, 3);
-                     unsigned short nFlag = sal::static_int_cast<unsigned short>(Read2b());
+                     unsigned short nFlag;
+                     if (!Read2b(nFlag))
+                        return;
                      _hwpInfo.back_info.flag = nFlag >> 8 ;
-                     int nRange = Read4b();
+                     int nRange;
+                     if (!Read4b(nRange))
+                        return;
                      _hwpInfo.back_info.range = nRange >> 24;
                      ReadBlock(_hwpInfo.back_info.reserved3, 27);
-                     _hwpInfo.back_info.size = Read4b();
+                     if (!Read4b(_hwpInfo.back_info.size))
+                        return;
 
                      _hwpInfo.back_info.data = new char[(unsigned int)_hwpInfo.back_info.size];
                      ReadBlock(_hwpInfo.back_info.data, _hwpInfo.back_info.size);
@@ -664,7 +685,8 @@ int HWPFile::compareParaShape(ParaShape *shape)
                 shape->outline == pshape->outline  &&
                      shape->pagebreak == pshape->pagebreak)
             {
-                    if( shape->cshape->size == pshape->cshape->size &&
+                    if( shape->cshape && pshape->cshape &&
+                         shape->cshape->size == pshape->cshape->size &&
                          shape->cshape->font[0] == pshape->cshape->font[0] &&
                          shape->cshape->ratio[0] == pshape->cshape->ratio[0] &&
                          shape->cshape->space[0] == pshape->cshape->space[0] &&
diff --git a/hwpfilter/source/hwpfile.h b/hwpfilter/source/hwpfile.h
index a7bf4fa..9ec157e 100644
--- a/hwpfilter/source/hwpfile.h
+++ b/hwpfilter/source/hwpfile.h
@@ -124,15 +124,17 @@ class DLLEXPORT HWPFile
 /**
  * Reads one byte from HIODev
  */
-        int Read1b( void );
+        bool Read1b(char &out);
+        bool Read1b(unsigned char &out);
 /**
  * Reads two byte from HIODev
  */
-        int Read2b( void );
+        bool Read2b(unsigned short &out);
 /**
  * Reads four byte from HIODev
  */
-        long Read4b( void );
+        bool Read4b(unsigned int &out);
+        bool Read4b(int &out);
 /**
  * Reads nmemb byte array from HIODev
  */
@@ -191,7 +193,7 @@ class DLLEXPORT HWPFile
 /**
  * Reads additional information like embedded image of hwp file from HIODev
  */
-        bool TagsRead(void);
+        void TagsRead();
 
         enum Paper
         {
diff --git a/hwpfilter/source/hwplib.h b/hwpfilter/source/hwplib.h
index efa5b66..278fbb3 100644
--- a/hwpfilter/source/hwplib.h
+++ b/hwpfilter/source/hwplib.h
@@ -35,22 +35,11 @@ typedef unsigned char       kchar;
 typedef unsigned char       echar;
 #endif                                            // _HCHAR_
 
-#if !defined(WIN32)
-#if !defined(_BOOL_T_) && !defined(OS2)
-typedef unsigned short  BOOL;
-#endif                                            /* _BOOL_T_ */
-typedef unsigned short  WORD;
-typedef int     SIZE;
-typedef unsigned long   DWORD;
-typedef long        LONG;
-#endif                                            /* WIN32 */
-
 #ifndef _UTYPE_
 #define _UTYPE_
 typedef unsigned char   uchar;
 typedef unsigned short  ushort;
 typedef unsigned int    uint;
-typedef unsigned long   ulong;
 #endif                                            /* _UTYPE_ */
 
 typedef ::std::basic_string<hchar> hchar_string;
diff --git a/hwpfilter/source/hwpread.cxx b/hwpfilter/source/hwpread.cxx
index 5763a5b..d2201da 100644
--- a/hwpfilter/source/hwpread.cxx
+++ b/hwpfilter/source/hwpread.cxx
@@ -61,12 +61,12 @@ bool SkipData::Read(HWPFile & hwpf)
 // Field code(5)
 bool FieldCode::Read(HWPFile & hwpf)
 {
-    ulong size;
+    uint size;
     hchar dummy;
-    ulong len1;       /* hchar타입의 문자열 테이터 #1의 길이 */
-    ulong len2;       /* hchar타입의 문자열 테이터 #2의 길이 */
-    ulong len3;       /* hchar타입의 문자열 테이터 #3의 길이 */
-    ulong binlen;     /* 임의 형식의 바이너리 데이타 길이 */
+    uint len1;       /* hchar타입의 문자열 테이터 #1의 길이 */
+    uint len2;       /* hchar타입의 문자열 테이터 #2의 길이 */
+    uint len3;       /* hchar타입의 문자열 테이터 #3의 길이 */
+    uint binlen;     /* 임의 형식의 바이너리 데이타 길이 */
 
     hwpf.Read4b(&size, 1);
     hwpf.Read2b(&dummy, 1);
@@ -79,9 +79,9 @@ bool FieldCode::Read(HWPFile & hwpf)
     hwpf.Read4b(&len3, 1);
     hwpf.Read4b(&binlen, 1);
 
-    ulong const len1_ = ((len1 > 1024) ? 1024 : len1) / sizeof(hchar);
-    ulong const len2_ = ((len2 > 1024) ? 1024 : len2) / sizeof(hchar);
-    ulong const len3_ = ((len3 > 1024) ? 1024 : len3) / sizeof(hchar);
+    uint const len1_ = ((len1 > 1024) ? 1024 : len1) / sizeof(hchar);
+    uint const len2_ = ((len2 > 1024) ? 1024 : len2) / sizeof(hchar);
+    uint const len3_ = ((len3 > 1024) ? 1024 : len3) / sizeof(hchar);
 
     str1 = new hchar[len1_ ? len1_ : 1];
     str2 = new hchar[len2_ ? len2_ : 1];
@@ -114,14 +114,14 @@ bool FieldCode::Read(HWPFile & hwpf)
     return true;
 }
 
-
 // book mark(6)
 bool Bookmark::Read(HWPFile & hwpf)
 {
     long len;
 
     hwpf.Read4b(&len, 1);
-    dummy = sal::static_int_cast<hchar>(hwpf.Read2b());
+    if (!hwpf.Read2b(dummy))
+        return false;
 
     if (!(len == 34))// 2 * (BMK_COMMENT_LEN + 1) + 2
      {
@@ -133,31 +133,28 @@ bool Bookmark::Read(HWPFile & hwpf)
 
     hwpf.Read2b(id, BMK_COMMENT_LEN + 1);
     hwpf.Read2b(&type, 1);
-//return hwpf.Read2b(&type, 1);
     return true;
 }
 
-
 // date format(7)
-
 bool DateFormat::Read(HWPFile & hwpf)
 {
     hwpf.Read2b(format, DATE_SIZE);
-    dummy = sal::static_int_cast<hchar>(hwpf.Read2b());
+    if (!hwpf.Read2b(dummy))
+        return false;
     if (!(hh == dummy && CH_DATE_FORM == dummy)){
         return hwpf.SetState(HWP_InvalidFileFormat);
      }
     return true;
 }
 
-
 // date code(8)
-
 bool DateCode::Read(HWPFile & hwpf)
 {
     hwpf.Read2b(format, DATE_SIZE);
     hwpf.Read2b(date, 6);
-    dummy = sal::static_int_cast<hchar>(hwpf.Read2b());
+    if (!hwpf.Read2b(dummy))
+        return false;
     if (!(hh == dummy && CH_DATE_CODE == dummy)){
         return hwpf.SetState(HWP_InvalidFileFormat);
      }
@@ -165,30 +162,30 @@ bool DateCode::Read(HWPFile & hwpf)
     return true;
 }
 
-
 // tab(9)
-
 bool Tab::Read(HWPFile & hwpf)
 {
-    width = hwpf.Read2b();
-    leader = sal::static_int_cast<unsigned short>(hwpf.Read2b());
-    dummy = sal::static_int_cast<hchar>(hwpf.Read2b());
+    unsigned short tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    width = tmp16;
+    if (!hwpf.Read2b(leader))
+        return false;
+    if (!hwpf.Read2b(dummy))
+        return false;
     if (!(hh == dummy && CH_TAB == dummy)){
         return hwpf.SetState(HWP_InvalidFileFormat);
      }
     return true;
 }
 
-
 // tbox(10) TABLE BOX MATH BUTTON HYPERTEXT
-
 static void UpdateBBox(FBox * fbox)
 {
     fbox->boundsy = fbox->pgy;
     fbox->boundey = fbox->pgy + fbox->ys - 1;
 }
 
-
 void Cell::Read(HWPFile & hwpf)
 {
     hwpf.Read2b(&p, 1);
@@ -413,10 +410,19 @@ bool Picture::Read(HWPFile & hwpf)
 
     hwpf.Read1b(&pictype, 1);                     /* 그림종류 */
 
-    skip[0] = (short) hwpf.Read2b();              /* 그림에서 실제 표시를 시작할 위치 가로 */
-    skip[1] = (short) hwpf.Read2b();              /* 세로 */
-    scale[0] = (short) hwpf.Read2b();             /* 확대비율 : 0 고정, 이외 퍼센트 단위 가로 */
-    scale[1] = (short) hwpf.Read2b();             /* 세로 */
+    unsigned short tmp16;
+    if (!hwpf.Read2b(tmp16))                      /* 그림에서 실제 표시를 시작할 위치 가로 */
+        return false;
+    skip[0] = tmp16;
+    if (!hwpf.Read2b(tmp16))                      /* 세로 */
+        return false;
+    skip[1] = tmp16;
+    if (!hwpf.Read2b(tmp16))                      /* 확대비율 : 0 고정, 이외 퍼센트 단위 가로 */
+        return false;
+    scale[0] = tmp16;
+    if (!hwpf.Read2b(tmp16))                      /* 세로 */
+        return false;
+    scale[1] = tmp16;
 
     hwpf.Read1b(picinfo.picun.path, 256);         /* 그림파일 이름 : 종류가 Drawing이 아닐때. */
     hwpf.Read1b(reserved3, 9);                    /* 밝기/명암/그림효과 등 */
@@ -602,7 +608,10 @@ bool Footnote::Read(HWPFile & hwpf)
     hwpf.Read1b(info, 8);
     hwpf.Read2b(&number, 1);
     hwpf.Read2b(&type, 1);
-    width = (short) hwpf.Read2b();
+    unsigned short tmp16;
+    if (!hwpf.Read2b(tmp16))
+        return false;
+    width = tmp16;
     hwpf.ReadParaList(plist, CH_FOOTNOTE);
 
     return !hwpf.State();
commit 89e01e22b4dc617fb45922620217f59e2d29e3e0
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Wed Feb 25 09:08:35 2015 +0100

    Fix dangling pointer
    
    (cherry picked from commit 1c4e95db104cd5f732bc41a539a7dc5fd9269ef6)
    Conflicts:
            sw/source/core/doc/doctxm.cxx
    
    Change-Id: I352702ac50708a8f8c40e2752821178223052b7c
    Reviewed-on: https://gerrit.libreoffice.org/14633
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 76f57ccc93558a2b6c6c734c0b5e3a51755136fd)

diff --git a/sw/source/core/doc/doctxm.cxx b/sw/source/core/doc/doctxm.cxx
index c16f576..5536387 100644
--- a/sw/source/core/doc/doctxm.cxx
+++ b/sw/source/core/doc/doctxm.cxx
@@ -19,6 +19,7 @@
 
 #include <limits.h>
 #include <hintids.hxx>
+#include <boost/scoped_ptr.hpp>
 #include <comphelper/string.hxx>
 #include <editeng/langitem.hxx>
 #include <editeng/formatbreakitem.hxx>
@@ -162,6 +163,7 @@ void SwDoc::DeleteTOXMark( const SwTOXMark* pTOXMark )
     SwTxtNode& rTxtNd = const_cast<SwTxtNode&>(pTxtTOXMark->GetTxtNode());
     OSL_ENSURE( rTxtNd.GetpSwpHints(), "cannot be deleted" );
 
+    boost::scoped_ptr<SwRegHistory> aRHst;
     if (GetIDocumentUndoRedo().DoesUndo())
     {
         // save attributes for Undo
@@ -170,8 +172,8 @@ void SwDoc::DeleteTOXMark( const SwTOXMark* pTOXMark )
             RES_TXTATR_TOXMARK );
         GetIDocumentUndoRedo().AppendUndo( pUndo );
 
-        SwRegHistory aRHst( rTxtNd, &pUndo->GetHistory() );
-        rTxtNd.GetpSwpHints()->Register( &aRHst );
+        aRHst.reset(new SwRegHistory(rTxtNd, &pUndo->GetHistory()));
+        rTxtNd.GetpSwpHints()->Register(aRHst.get());
     }
 
     rTxtNd.DeleteAttribute( const_cast<SwTxtTOXMark*>(pTxtTOXMark) );
commit 290df79d3f65b7b1d3d81d0cd81b6e3f31dfd581
Author: Eike Rathke <erack at redhat.com>
Date:   Fri Feb 20 15:11:36 2015 +0100

    Resolves: tdf#89500 catch ISO 8601 datetime in all locales
    
    Change-Id: I906ebdc6aa5c365df98a29e9e0f319f89f6833c6
    (cherry picked from commit 5d572e673dec3396487b14bb1f9e86aa8ab86786)
    Reviewed-on: https://gerrit.libreoffice.org/14566
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit b5339e73a52c2eb45f5eb4707ee846af4bab99ef)

diff --git a/svl/source/numbers/zforfind.cxx b/svl/source/numbers/zforfind.cxx
index 993b712..9bdee3a 100644
--- a/svl/source/numbers/zforfind.cxx
+++ b/svl/source/numbers/zforfind.cxx
@@ -2452,16 +2452,35 @@ bool ImpSvNumberInputScan::ScanMidString( const OUString& rString,
                     SkipBlanks( rString, nPos );
                 }
             }
-            else if (nStringPos == 5 && nPos == 0 && rString.getLength() == 1 &&
-                     rString[ 0 ] == 'T' && MayBeIso8601())
+            else if (nPos == 0 && rString.getLength() == 1 && MayBeIso8601())
             {
-                // ISO 8601 combined date and time, yyyy-mm-ddThh:mm
-                ++nPos;
+                if (nStringPos == 5 && rString[0] == 'T')
+                {
+                    // ISO 8601 combined date and time, yyyy-mm-ddThh:mm
+                    ++nPos;
+                }
+                else if (nStringPos == 7 && rString[0] == ':')
+                {
+                    // ISO 8601 combined date and time, the time part; we reach
+                    // here if the locale's separator is not ':' so it couldn't
+                    // be detected above in the time block.
+                    if (nAnzNums >= 5)
+                        eScannedType = NUMBERFORMAT_DATETIME;
+                    ++nPos;
+                }
             }
             break;
-#if NF_RECOGNIZE_ISO8601_TIMEZONES
         case NUMBERFORMAT_DATETIME:
-            if (nPos == 0 && rString.getLength() == 1 && nStringPos >= 9 && MayBeIso8601())
+            if (nPos == 0 && rString.getLength() == 1 && MayBeIso8601())
+            {
+                if (nStringPos == 9 && rString[0] == ':')
+                {
+                    // ISO 8601 combined date and time, the time part continued.
+                    ++nPos;
+                }
+            }
+#if NF_RECOGNIZE_ISO8601_TIMEZONES
+            else if (nPos == 0 && rString.getLength() == 1 && nStringPos >= 9 && MayBeIso8601())
             {
                 // ISO 8601 timezone offset
                 switch (rString[ 0 ])
@@ -2488,8 +2507,8 @@ bool ImpSvNumberInputScan::ScanMidString( const OUString& rString,
                     break;
                 }
             }
-            break;
 #endif
+            break;
         }
     }
 
commit 9d5591ccd3b1812914d9dd52e872e5efd3a0dc5f
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Mon Feb 23 10:31:21 2015 +0100

    file UCP: Ensure myLocalTime is initialized
    
    When a file's time is epoch (1970-01-01 00:00:00, i.e., TimeValue temp is all
    zero) and the TZ is UTC or westward, osl_getLocalTimeFromSystemTime returns
    false and leaves myLocalTime uninitialized.  That e.g. confuses getModuleByUrl
    (scripting/source/pyprov/pythonscript.py), potentially re-loading a Python
    script with epoch time (as happens e.g. for the share/Scripts/python/ files in
    an xdg-app installation of LO) every time it is accessed, falsely assuming it
    has changed on disk since last load.
    
    Change-Id: I8d4228feb28e2697a7021e3488ae2c09e8439ed8
    (cherry picked from commit 94c9206399954d018aae8a1bd4e4b33354b9cdaf)
    Reviewed-on: https://gerrit.libreoffice.org/14588
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 8aeef8bcff2ed7ab873aa572728d266206dbcca5)

diff --git a/include/sal/log-areas.dox b/include/sal/log-areas.dox
index d42c8c2..c12740c 100644
--- a/include/sal/log-areas.dox
+++ b/include/sal/log-areas.dox
@@ -334,6 +334,7 @@ certain functionality.
 @li @c ucb.ucp
 @li @c ucb.ucp.cmis
 @li @c ucb.ucp.ext
+ at li @c ucb.ucp.file
 @li @c ucb.ucp.ftp
 @li @c ucb.ucp.gio
 @li @c ucb.ucp.gvfs
diff --git a/ucb/source/ucp/file/shell.cxx b/ucb/source/ucp/file/shell.cxx
index 6fc7814..d3b6a80 100644
--- a/ucb/source/ucp/file/shell.cxx
+++ b/ucb/source/ucp/file/shell.cxx
@@ -2440,7 +2440,14 @@ shell::commit( const shell::ContentMap::iterator& it,
 
             // Convert system time to local time (for EA)
             TimeValue myLocalTime;
-            osl_getLocalTimeFromSystemTime( &temp, &myLocalTime );
+            if (!osl_getLocalTimeFromSystemTime( &temp, &myLocalTime ))
+            {
+                SAL_WARN(
+                    "ucb.ucp.file",
+                    "cannot convert (" << temp.Seconds << ", " << temp.Nanosec
+                        << ") to local time");
+                myLocalTime = temp;
+            }
 
             oslDateTime myDateTime;
             osl_getDateTimeFromTimeValue( &myLocalTime, &myDateTime );
commit 093eae4fef6def6ea1569115dab9d41a8ba9e163
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Feb 12 21:18:29 2015 +0000

    Resolves: tdf#89227 if no SwView then disable accept/reject change buttons
    
    e.g. if the context is an embedded draw ole then we don't have a SwView
    
    (cherry picked from commit 25dd3d277e9b90a59e7b2a03202ef0cba7799b68)
    
    Conflicts:
    	sw/source/uibase/misc/redlndlg.cxx
    
    Change-Id: I6ba07f0ecf1c419e45f7e0ac628a82e6bd486668
    Reviewed-on: https://gerrit.libreoffice.org/14455
    Reviewed-by: Adolfo Jayme Barrientos <fitojb at ubuntu.com>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit a840857c2d2490ee8d1b0289df8d9bf588981c48)

diff --git a/sw/source/core/uibase/misc/redlndlg.cxx b/sw/source/core/uibase/misc/redlndlg.cxx
index 3a062a4..9d0e359 100644
--- a/sw/source/core/uibase/misc/redlndlg.cxx
+++ b/sw/source/core/uibase/misc/redlndlg.cxx
@@ -96,7 +96,6 @@ SwModelessRedlineAcceptDlg::SwModelessRedlineAcceptDlg(
 void SwModelessRedlineAcceptDlg::Activate()
 {
     SwView *pView = ::GetActiveView();
-
     if (!pView) // can happen when switching to another app, when a Listbox in dialog
         return; // had the focus previously (actually THs Bug)
 
@@ -159,6 +158,7 @@ SwRedlineAcceptDlg::SwRedlineAcceptDlg(Dialog *pParent, bool bAutoFmt) :
 {
     aTabPagesCTRL.SetHelpId(HID_REDLINE_CTRL);
     pTPView = aTabPagesCTRL.GetViewPage();
+
     pTable = pTPView->GetTableControl();
 
     pTPView->InsertWriterHeader();
@@ -167,6 +167,11 @@ SwRedlineAcceptDlg::SwRedlineAcceptDlg(Dialog *pParent, bool bAutoFmt) :
     pTPView->SetRejectClickHdl(LINK(this, SwRedlineAcceptDlg, RejectHdl));
     pTPView->SetRejectAllClickHdl(LINK(this, SwRedlineAcceptDlg, RejectAllHdl));
     pTPView->SetUndoClickHdl(LINK(this, SwRedlineAcceptDlg, UndoHdl));
+    //tdf#89227 default to disabled, and only enable if possible to accept/reject
+    pTPView->EnableAccept(false);
+    pTPView->EnableReject(false);
+    pTPView->EnableAcceptAll(false);
+    pTPView->EnableRejectAll(false);
 
     aTabPagesCTRL.GetFilterPage()->SetReadyHdl(LINK(this, SwRedlineAcceptDlg, FilterChangedHdl));
 
@@ -357,9 +362,14 @@ void SwRedlineAcceptDlg::Activate()
         return;
 
     SwView *pView = ::GetActiveView();
-
-    if (!pView) // can happen when switching to another app, when a Listbox in the dialog
-        return; // had the focus previously (actually THs Bug)
+    if (!pView) // can happen when switching to another app
+    {
+        pTPView->EnableAccept(false);
+        pTPView->EnableReject(false);
+        pTPView->EnableAcceptAll(false);
+        pTPView->EnableRejectAll(false);
+        return; // had the focus previously
+    }
 
     SwWait aWait( *pView->GetDocShell(), false );
 
commit e0130d0bf6a8af45605afe8dd805438d9fda5721
Author: Eike Rathke <erack at redhat.com>
Date:   Tue Feb 24 20:29:39 2015 +0100

    Resolves: tdf#89484 check that sheet reference is within selected sheets
    
    Change-Id: I88f1d0a134ffa3fbb9a5b5abdabbd4774f457e81
    (cherry picked from commit 5803c76f318b2a8b655bf83a8257f60cd112ac71)
    Reviewed-on: https://gerrit.libreoffice.org/14610
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit 8a0712e79a53c057e4a337c5b8570262dc5a33de)

diff --git a/sc/source/core/tool/token.cxx b/sc/source/core/tool/token.cxx
index f7dbbfa..1b550af 100644
--- a/sc/source/core/tool/token.cxx
+++ b/sc/source/core/tool/token.cxx
@@ -2680,6 +2680,10 @@ bool expandRangeByEdge( const sc::RefUpdateContext& rCxt, ScRange& rRefRange, co
         // Edge-expansion is turned off.
         return false;
 
+    if (!(rSelectedRange.aStart.Tab() <= rRefRange.aStart.Tab() && rRefRange.aEnd.Tab() <= rSelectedRange.aEnd.Tab()))
+        // Sheet references not within selected range.
+        return false;
+
     if (rCxt.mnColDelta > 0)
     {
         // Insert and shift right.


More information about the Libreoffice-commits mailing list