[Libreoffice-commits] core.git: filter/source sw/source

[Stephan Bergmann]

 filter/source/msfilter/msdffimp.cxx |    2 +-
 sw/source/filter/ww8/ww8par.cxx     |    4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

New commits:
commit 0fad62c2178d6b8157b07ff30fe9e2fc8173d393
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Tue Sep 1 09:46:29 2015 +0200

    -fsanitize=enum
    
    ...as happens in CppunitTest_sw_filters_test with
    sw/qa/core/data/ww8/pass/CVE-2015-2467-1.doc, first at:
    
    > filter/source/msfilter/msdffimp.cxx:1477:17: runtime error: load of value 8193, which is not a valid value for type 'MSO_Anchor'
    >  DffPropertyReader::ApplyCustomShapeTextAttributes(SfxItemSet&) const filter/source/msfilter/msdffimp.cxx:1477:17
    >  DffPropertyReader::ApplyAttributes(SvStream&, SfxItemSet&, DffObjData&) const filter/source/msfilter/msdffimp.cxx:2694:9
    >  SvxMSDffManager::ImportShape(DffRecordHeader const&, SvStream&, void*, Rectangle&, Rectangle const&, int, int*) filter/source/msfilter/msdffimp.cxx:4332:21
    >  SvxMSDffManager::ImportGroup(DffRecordHeader const&, SvStream&, void*, Rectangle&, Rectangle const&, int, int*) filter/source/msfilter/msdffimp.cxx:4119:39
    >  SvxMSDffManager::ImportGroup(DffRecordHeader const&, SvStream&, void*, Rectangle&, Rectangle const&, int, int*) filter/source/msfilter/msdffimp.cxx:4106:39
    >  SvxMSDffManager::ImportGroup(DffRecordHeader const&, SvStream&, void*, Rectangle&, Rectangle const&, int, int*) filter/source/msfilter/msdffimp.cxx:4106:39
    >  SvxMSDffManager::ImportGroup(DffRecordHeader const&, SvStream&, void*, Rectangle&, Rectangle const&, int, int*) filter/source/msfilter/msdffimp.cxx:4106:39
    >  SvxMSDffManager::ImportObj(SvStream&, void*, Rectangle&, Rectangle const&, int, int*) filter/source/msfilter/msdffimp.cxx:4033:16
    >  SvxMSDffManager::GetShape(unsigned long, SdrObject*&, SvxMSDffImportData&) filter/source/msfilter/msdffimp.cxx:6210:23
    >  SwWW8ImplReader::Read_GrafLayer(long) sw/source/filter/ww8/ww8graf.cxx:2502:17
    >  SwWW8ImplReader::ReadChar(long, long) sw/source/filter/ww8/ww8par.cxx:3634:17
    >  SwWW8ImplReader::ReadChars(int&, int, long, long) sw/source/filter/ww8/ww8par.cxx:3436:27
    >  SwWW8ImplReader::ReadText(int, int, ManTypes) sw/source/filter/ww8/ww8par.cxx:3974:22
    >  SwWW8ImplReader::CoreLoad(WW8Glossary*) sw/source/filter/ww8/ww8par.cxx:5175:9
    >  SwWW8ImplReader::LoadThroughDecryption(WW8Glossary*) sw/source/filter/ww8/ww8par.cxx:5773:19
    >  SwWW8ImplReader::LoadDoc(WW8Glossary*) sw/source/filter/ww8/ww8par.cxx:6045:19
    >  WW8Reader::Read(SwDoc&, rtl::OUString const&, SwPaM&, rtl::OUString const&) sw/source/filter/ww8/ww8par.cxx:6167:20
    >  SwReader::Read(Reader const&) sw/source/filter/basflt/shellio.cxx:175:18
    >  SwDocShell::ConvertFrom(SfxMedium&) sw/source/uibase/app/docsh.cxx:258:22
    >  SfxObjectShell::DoLoad(SfxMedium*) sfx2/source/doc/objstor.cxx:790:23
    >  SwFiltersTest::filter(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) sw/qa/core/filters-test.cxx:112:20
    
    Change-Id: Iafc548b5ba21a985521790770732f7f03e2485c9

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index a7f1ec7..6c723a8 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -1472,7 +1472,7 @@ void DffPropertyReader::ApplyCustomShapeTextAttributes( SfxItemSet& rSet ) const
         eTHA = SDRTEXTHORZADJUST_BLOCK;
 
         // read text anchor
-        MSO_Anchor eTextAnchor = (MSO_Anchor)GetPropertyValue( DFF_Prop_anchorText, mso_anchorTop );
+        sal_uInt32 eTextAnchor = GetPropertyValue( DFF_Prop_anchorText, mso_anchorTop );
 
         switch( eTextAnchor )
         {
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index b02ae71..d6a25cc 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -896,8 +896,8 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt,
             pImpRec->nDyTextBottom  = nTextBottom;
 
             // Taking the correct default (which is mso_anchorTop)
-            MSO_Anchor eTextAnchor =
-                (MSO_Anchor)GetPropertyValue( DFF_Prop_anchorText, mso_anchorTop );
+            sal_uInt32 eTextAnchor =
+                GetPropertyValue( DFF_Prop_anchorText, mso_anchorTop );
 
             SdrTextVertAdjust eTVA = bVerticalText
                                      ? SDRTEXTVERTADJUST_BLOCK