[Libreoffice-commits] core.git: Branch 'distro/collabora/cp-4.4' - 15 commits - filter/qa filter/source oox/source sw/inc sw/qa sw/source vcl/inc vcl/qa vcl/source vcl/win

Stephan Bergmann sbergman at redhat.com
Fri Sep 4 08:10:57 PDT 2015


 filter/qa/cppunit/data/met/fail/hang-2.met            |binary
 filter/qa/cppunit/data/pict/fail/hang-1.pct           |binary
 filter/source/graphicfilter/ios2met/ios2met.cxx       |   25 +++++++---
 filter/source/graphicfilter/ipict/ipict.cxx           |   10 ++--
 oox/source/ppt/slidefragmenthandler.cxx               |    2 
 oox/source/shape/WpsContext.cxx                       |   33 ++++++++++++-
 sw/inc/IDocumentUndoRedo.hxx                          |    4 +
 sw/inc/drawdoc.hxx                                    |    2 
 sw/qa/core/data/ww8/pass/hang-6.doc                   |binary
 sw/qa/core/data/ww8/pass/hang-7.doc                   |binary
 sw/qa/core/data/ww8/pass/hang-8.doc                   |binary
 sw/qa/extras/ooxmlexport/data/tdf93676-1.odt          |binary
 sw/qa/extras/ooxmlimport/data/tdf87924.docx           |binary
 sw/qa/extras/ooxmlimport/ooxmlimport.cxx              |    8 +++
 sw/source/core/draw/drawdoc.cxx                       |    8 +++
 sw/source/core/inc/UndoManager.hxx                    |    1 
 sw/source/core/txtnode/fntcache.cxx                   |   10 ++++
 sw/source/core/undo/docundo.cxx                       |    5 ++
 sw/source/filter/ww8/docxsdrexport.cxx                |   10 ++--
 sw/source/filter/ww8/rtfattributeoutput.cxx           |   10 ++--
 sw/source/filter/ww8/ww8par.cxx                       |   22 +++++----
 sw/source/filter/ww8/ww8par2.cxx                      |    9 +++
 sw/source/filter/ww8/ww8scan.cxx                      |   13 +++++
 sw/source/filter/ww8/ww8toolbar.cxx                   |   44 ++++++++++--------
 sw/source/uibase/docvw/edtwin.cxx                     |   33 +++++++++----
 sw/source/uibase/inc/view.hxx                         |    4 -
 sw/source/uibase/shells/frmsh.cxx                     |    6 --
 sw/source/uibase/shells/textsh.cxx                    |    7 ++
 vcl/inc/outdev.h                                      |    7 ++
 vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-4.wmf |binary
 vcl/source/filter/wmf/winwmf.cxx                      |    2 
 vcl/source/gdi/bitmap3.cxx                            |   12 ++--
 vcl/source/outdev/font.cxx                            |   15 ++++--
 vcl/win/source/gdi/winlayout.cxx                      |    2 
 34 files changed, 226 insertions(+), 78 deletions(-)

New commits:
commit 6ade2bdd434a1b9a53da1c7a0753b4983c14313d
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Thu Sep 3 16:29:31 2015 +0200

    Fix mis-merge
    
    ...where fb6f2e1109abdd09e80dbcd6660a9530fc06ff0f "Resolves: #i121407# Gallery
    reorganizations..." first cherry-picked the younger 8012fae6cedcf325130d70adf0a486e8918f452f
    before f7d373d18f965b36f310d44044bdba6476f6eb03 "Added ColorDepth change test with assertion to
    the Bitmap::Scale method" then cherry-picked the older 4be8cc079667cca2cae91dba9e46c16ccff1537f,
    leading to the two checks at the top of Bitmap::Scale to not return early as intended.
    
    Thanks to clang-tidy clang-analyzer-deadcode.DeadStores for flagging this.
    
    Change-Id: Id89cc517a9f7efdff040c70f3b0e640d969cf24d
    (cherry picked from commit 0aa9cd69598e1c022aa676f81dc7bc2f03e58b2c)
    Reviewed-on: https://gerrit.libreoffice.org/18311
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/vcl/source/gdi/bitmap3.cxx b/vcl/source/gdi/bitmap3.cxx
index 6891289..a38f6d5 100644
--- a/vcl/source/gdi/bitmap3.cxx
+++ b/vcl/source/gdi/bitmap3.cxx
@@ -859,22 +859,20 @@ bool Bitmap::ImplConvertGhosted()
 
 bool Bitmap::Scale( const double& rScaleX, const double& rScaleY, sal_uInt32 nScaleFlag )
 {
-    bool bRetval(false);
-
-    const sal_uInt16 nStartCount(GetBitCount());
-
     if(basegfx::fTools::equalZero(rScaleX) || basegfx::fTools::equalZero(rScaleY))
     {
         // no scale
-        bRetval = true;
+        return true;
     }
 
     if(basegfx::fTools::equal(rScaleX, 1.0) && basegfx::fTools::equal(rScaleY, 1.0))
     {
         // no scale
-        bRetval = true;
+        return true;
     }
 
+    const sal_uInt16 nStartCount(GetBitCount());
+
     if( mpImpBmp )
     {
         // implementation specific scaling
@@ -910,6 +908,8 @@ bool Bitmap::Scale( const double& rScaleX, const double& rScaleY, sal_uInt32 nSc
     if (nStartCount == 1 && nScaleFlag != BMP_SCALE_NONE)
         nScaleFlag = BMP_SCALE_FAST;
 
+    bool bRetval(false);
+
     switch(nScaleFlag)
     {
         case BMP_SCALE_NONE :
commit d29a3f39a59b0fc4d26483d667b0f08f96c85080
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Sep 3 11:33:36 2015 +0100

    Related: tdf#93676 special 255 Percent Flag should not be exported to docx
    
    as a true percentage value. 255 is a special flag that the value is synced to
    the other dimension. Without this word gives the frame in the attached example
    a huge height.
    
    (cherry picked from commit b2ad33fd5a1ee0cd9a1e657725aedc90da659f24)
    
    Change-Id: Ida0c15779d4583ca075428d77b8dc03c32f22edb
    Reviewed-on: https://gerrit.libreoffice.org/18303
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/sw/qa/extras/ooxmlexport/data/tdf93676-1.odt b/sw/qa/extras/ooxmlexport/data/tdf93676-1.odt
new file mode 100644
index 0000000..37d621b
Binary files /dev/null and b/sw/qa/extras/ooxmlexport/data/tdf93676-1.odt differ
diff --git a/sw/source/filter/ww8/docxsdrexport.cxx b/sw/source/filter/ww8/docxsdrexport.cxx
index a7dc475..7c21a11 100644
--- a/sw/source/filter/ww8/docxsdrexport.cxx
+++ b/sw/source/filter/ww8/docxsdrexport.cxx
@@ -1525,23 +1525,25 @@ void DocxSdrExport::writeDMLTextFrame(sw::Frame* pParentFrame, int nAnchorId, bo
         pFS->endElementNS(XML_a, XML_graphic);
 
         // Relative size of the Text Frame.
-        if (rSize.GetWidthPercent())
+        const sal_uInt8 nWidthPercent = rSize.GetWidthPercent();
+        if (nWidthPercent && nWidthPercent != 0xff)
         {
             pFS->startElementNS(XML_wp14, XML_sizeRelH,
                                 XML_relativeFrom, (rSize.GetWidthPercentRelation() == text::RelOrientation::PAGE_FRAME ? "page" : "margin"),
                                 FSEND);
             pFS->startElementNS(XML_wp14, XML_pctWidth, FSEND);
-            pFS->writeEscaped(OUString::number(rSize.GetWidthPercent() * oox::drawingml::PER_PERCENT));
+            pFS->writeEscaped(OUString::number(nWidthPercent * oox::drawingml::PER_PERCENT));
             pFS->endElementNS(XML_wp14, XML_pctWidth);
             pFS->endElementNS(XML_wp14, XML_sizeRelH);
         }
-        if (rSize.GetHeightPercent())
+        const sal_uInt8 nHeightPercent = rSize.GetHeightPercent();
+        if (nHeightPercent && nHeightPercent != 0xff)
         {
             pFS->startElementNS(XML_wp14, XML_sizeRelV,
                                 XML_relativeFrom, (rSize.GetHeightPercentRelation() == text::RelOrientation::PAGE_FRAME ? "page" : "margin"),
                                 FSEND);
             pFS->startElementNS(XML_wp14, XML_pctHeight, FSEND);
-            pFS->writeEscaped(OUString::number(rSize.GetHeightPercent() * oox::drawingml::PER_PERCENT));
+            pFS->writeEscaped(OUString::number(nHeightPercent * oox::drawingml::PER_PERCENT));
             pFS->endElementNS(XML_wp14, XML_pctHeight);
             pFS->endElementNS(XML_wp14, XML_sizeRelV);
         }
diff --git a/sw/source/filter/ww8/rtfattributeoutput.cxx b/sw/source/filter/ww8/rtfattributeoutput.cxx
index da8f01f..d9550c0 100644
--- a/sw/source/filter/ww8/rtfattributeoutput.cxx
+++ b/sw/source/filter/ww8/rtfattributeoutput.cxx
@@ -1610,9 +1610,10 @@ void lcl_TextFrameRelativeSize(std::vector< std::pair<OString, OString> >& rFlyP
     const SwFmtFrmSize& rSize = rFrmFmt.GetFrmSize();
 
     // Relative size of the Text Frame.
-    if (rSize.GetWidthPercent())
+    const sal_uInt8 nWidthPercent = rSize.GetWidthPercent();
+    if (nWidthPercent && nWidthPercent != 0xff)
     {
-        rFlyProperties.push_back(std::make_pair<OString, OString>("pctHoriz", OString::number(rSize.GetWidthPercent() * 10)));
+        rFlyProperties.push_back(std::make_pair<OString, OString>("pctHoriz", OString::number(nWidthPercent * 10)));
 
         OString aRelation;
         switch (rSize.GetWidthPercentRelation())
@@ -1626,9 +1627,10 @@ void lcl_TextFrameRelativeSize(std::vector< std::pair<OString, OString> >& rFlyP
         }
         rFlyProperties.push_back(std::make_pair("sizerelh", aRelation));
     }
-    if (rSize.GetHeightPercent())
+    const sal_uInt8 nHeightPercent = rSize.GetHeightPercent();
+    if (nHeightPercent && nHeightPercent != 0xff)
     {
-        rFlyProperties.push_back(std::make_pair<OString, OString>("pctVert", OString::number(rSize.GetHeightPercent() * 10)));
+        rFlyProperties.push_back(std::make_pair<OString, OString>("pctVert", OString::number(nHeightPercent * 10)));
 
         OString aRelation;
         switch (rSize.GetHeightPercentRelation())
commit f899802d7b839d46cbd4f628e0a246e65ad8181a
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Sep 2 20:44:06 2015 +0100

    doc para property ranges cannot be 0 length
    
    Change-Id: If946204873343d8bbc0c1d391ca2c65d8b2f8561
    (cherry picked from commit ed7d22049596ac91ad75bfad1a5675c13714e203)
    Reviewed-on: https://gerrit.libreoffice.org/18300
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/sw/qa/core/data/ww8/pass/hang-8.doc b/sw/qa/core/data/ww8/pass/hang-8.doc
new file mode 100644
index 0000000..4f0e30e
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/hang-8.doc differ
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 0cd7b68..c8afe52 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -4364,6 +4364,19 @@ bool WW8PLCFx_AtnBook::getIsEnd() const
 // dadurch kein AErger zu erwarten ist.
 void WW8PLCFMan::AdjustEnds( WW8PLCFxDesc& rDesc )
 {
+    // might be necessary to do this for pChp and/or pSep as well,
+    // but its definitely the case for paragraphs that EndPos > StartPos
+    // for a well formed paragraph as those always have a paragraph
+    // <cr> in them
+    if (&rDesc == pPap && rDesc.bRealLineEnd)
+    {
+        if (rDesc.nStartPos == rDesc.nEndPos && rDesc.nEndPos != WW8_CP_MAX)
+        {
+            SAL_WARN("sw.ww8", "WW8PLCFxDesc End same as Start, abandoning to avoid looping");
+            rDesc.nEndPos = WW8_CP_MAX;
+        }
+    }
+
     //Store old end position for supercool new property finder that uses
     //cp instead of fc's as nature intended
     rDesc.nOrigEndPos = rDesc.nEndPos;
commit dcd056b2af8a5095d7b03a1818202eaa955bf2a9
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Mon Aug 10 09:14:27 2015 +0200

    tdf#87922 SwDrawTextInfo::ApplyAutoColor: handle fill attributes
    
    With this, if page background is set to e.g. black, then automatic color
    of text is again white, not black.
    
    (cherry picked from commit d48d0e81971266ff4625721b0f069a62ec7014e2)
    
    Change-Id: I8246fa4b7834f60872b0737f03906ccc86948cc1
    Reviewed-on: https://gerrit.libreoffice.org/18293
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sw/source/core/txtnode/fntcache.cxx b/sw/source/core/txtnode/fntcache.cxx
index 76d3500..8cb2188 100644
--- a/sw/source/core/txtnode/fntcache.cxx
+++ b/sw/source/core/txtnode/fntcache.cxx
@@ -47,6 +47,7 @@
 #include <swmodule.hxx>
 #include <accessibilityoptions.hxx>
 #include <svtools/accessibilityoptions.hxx>
+#include <svx/sdr/attribute/sdrallfillattributeshelper.hxx>
 #include <doc.hxx>
 #include <editeng/fhgtitem.hxx>
 #include <docsh.hxx>
@@ -2496,6 +2497,7 @@ bool SwDrawTextInfo::ApplyAutoColor( vcl::Font* pFont )
         {
             // check if current background has a user defined setting
             const Color* pCol = GetFont() ? GetFont()->GetBackColor() : NULL;
+            Color aColor;
             if( ! pCol || COL_TRANSPARENT == pCol->GetColor() )
             {
                 const SvxBrushItem* pItem;
@@ -2512,6 +2514,14 @@ bool SwDrawTextInfo::ApplyAutoColor( vcl::Font* pFont )
                 ///     is a background brush and its color is *not* "no fill"/"auto fill".
                 if( GetFrm()->GetBackgroundBrush( aFillAttributes, pItem, pCol, aOrigBackRect, false ) )
                 {
+                    if (aFillAttributes.get() && aFillAttributes->isUsed())
+                    {
+                        // First see if fill atttributes provide a color.
+                        aColor = Color(aFillAttributes->getAverageColor(aGlobalRetoucheColor.getBColor()));
+                        pCol = &aColor;
+                    }
+
+                    // If not, then fall back to the old brush item.
                     if ( !pCol )
                     {
                         pCol = &pItem->GetColor();
commit f2b46813603d85ce2e86d805fde0a2a8e94d3a73
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Mon Aug 3 09:19:17 2015 +0200

    tdf#87924 DOCX import: rot=90 and vert=vert270 means no text rotation
    
    If the shape is rotated 90 degrees clockwise and the text is further
    rotated 270 degrees clockwise that means we shouldn't do anything with
    the text and the result will be correct.
    
    Also: cid#1315264 incorrect expression
    
    (cherry picked from commit dbfed66eebde65f5844a0f1a2cfe548ad4eda962 and
    1c09657c5c25cf941588610eeab653217399f9b5)
    
    Change-Id: I7c65319258136288520bd24fa2bf8e3c598b0878
    Reviewed-on: https://gerrit.libreoffice.org/18274
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/oox/source/shape/WpsContext.cxx b/oox/source/shape/WpsContext.cxx
index a22d6b8..657071b 100644
--- a/oox/source/shape/WpsContext.cxx
+++ b/oox/source/shape/WpsContext.cxx
@@ -13,6 +13,9 @@
 #include <drawingml/shapestylecontext.hxx>
 #include <com/sun/star/beans/XPropertySet.hpp>
 #include <com/sun/star/beans/XPropertyState.hpp>
+#include <com/sun/star/drawing/HomogenMatrix3.hpp>
+#include <basegfx/tuple/b2dtuple.hxx>
+#include <svx/svdtrans.hxx>
 
 #include <boost/optional.hpp>
 
@@ -76,9 +79,33 @@ oox::core::ContextHandlerRef WpsContext::onCreateContext(sal_Int32 nElementToken
                 }
                 else
                 {
-                    comphelper::SequenceAsHashMap aCustomShapeGeometry(xPropertySet->getPropertyValue("CustomShapeGeometry"));
-                    aCustomShapeGeometry["TextPreRotateAngle"] = uno::makeAny(sal_Int32(-270));
-                    xPropertySet->setPropertyValue("CustomShapeGeometry", uno::makeAny(aCustomShapeGeometry.getAsConstPropertyValueList()));
+                    // Get the existing rotation of the shape.
+                    drawing::HomogenMatrix3 aMatrix;
+                    xPropertySet->getPropertyValue("Transformation") >>= aMatrix;
+                    basegfx::B2DHomMatrix aTransformation;
+                    aTransformation.set(0, 0, aMatrix.Line1.Column1);
+                    aTransformation.set(0, 1, aMatrix.Line1.Column2);
+                    aTransformation.set(0, 2, aMatrix.Line1.Column3);
+                    aTransformation.set(1, 0, aMatrix.Line1.Column1);
+                    aTransformation.set(1, 1, aMatrix.Line2.Column2);
+                    aTransformation.set(1, 2, aMatrix.Line3.Column3);
+                    aTransformation.set(2, 0, aMatrix.Line1.Column1);
+                    aTransformation.set(2, 1, aMatrix.Line2.Column2);
+                    aTransformation.set(2, 2, aMatrix.Line3.Column3);
+                    basegfx::B2DTuple aScale;
+                    basegfx::B2DTuple aTranslate;
+                    double fRotate = 0;
+                    double fShearX = 0;
+                    aTransformation.decompose(aScale, aTranslate, fRotate, fShearX);
+
+                    // If the text is not rotated the way the shape wants it already, set the angle.
+                    const sal_Int32 nRotation = -270;
+                    if (basegfx::rad2deg(fRotate) != static_cast<double>(NormAngle360(nRotation * 100)) / 100)
+                    {
+                        comphelper::SequenceAsHashMap aCustomShapeGeometry(xPropertySet->getPropertyValue("CustomShapeGeometry"));
+                        aCustomShapeGeometry["TextPreRotateAngle"] = uno::makeAny(nRotation);
+                        xPropertySet->setPropertyValue("CustomShapeGeometry", uno::makeAny(aCustomShapeGeometry.getAsConstPropertyValueList()));
+                    }
                 }
             }
 
diff --git a/sw/qa/extras/ooxmlimport/data/tdf87924.docx b/sw/qa/extras/ooxmlimport/data/tdf87924.docx
new file mode 100644
index 0000000..5265d66
Binary files /dev/null and b/sw/qa/extras/ooxmlimport/data/tdf87924.docx differ
diff --git a/sw/qa/extras/ooxmlimport/ooxmlimport.cxx b/sw/qa/extras/ooxmlimport/ooxmlimport.cxx
index c1ef511..20cb6fe 100644
--- a/sw/qa/extras/ooxmlimport/ooxmlimport.cxx
+++ b/sw/qa/extras/ooxmlimport/ooxmlimport.cxx
@@ -2633,6 +2633,14 @@ DECLARE_OOXMLIMPORT_TEST(testTdf86374, "tdf86374.docx")
     CPPUNIT_ASSERT_EQUAL(text::SizeType::MIN, getProperty<sal_Int16>(xTableRows->getByIndex(0), "SizeType"));
 }
 
+DECLARE_OOXMLIMPORT_TEST(testTdf87924, "tdf87924.docx")
+{
+    uno::Reference<beans::XPropertySet> xPropertySet(getShape(1), uno::UNO_QUERY);
+    comphelper::SequenceAsHashMap aGeometry(xPropertySet->getPropertyValue("CustomShapeGeometry"));
+    // This was -270, the text rotation angle was set when it should not be rotated.
+    CPPUNIT_ASSERT_EQUAL(static_cast<sal_Int32>(0), aGeometry["TextPreRotateAngle"].get<sal_Int32>());
+}
+
 #endif
 
 CPPUNIT_PLUGIN_IMPLEMENT();
commit 442d4bd3b38bca15bcd1af18476e82a317045ada
Author: Ashod Nakashian <ashodnakashian at yahoo.com>
Date:   Sat Jul 11 12:53:08 2015 -0400

    tdf#92612 Right-clicking after applying "paint buckets" leads to multiple Undo
    
    In paint bucket mode the user can undo by right-clicking.
    Undoing, however, is only possible after the first paint op.
    After undoing is enabled, the user can undo indefinetely by
    righ-clicking. This is not consistent and can be confusing.
    
    This patch tracks the changes done after entering the paint
    bucket mode, and allows the user to undo them using right-clicking
    until they reach the first operation before entering this context.
    
    Because the user can undo/redo using other means, the patch takes
    it into account and will reset its tracking to accomodate this.
    
    Ultimately, the user is able to make any changes in paint bucket
    mode and undo them all by right-clicking, but no further than that.
    
    Reviewed-on: https://gerrit.libreoffice.org/16951
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Thorsten Behrens <Thorsten.Behrens at CIB.de>
    (cherry picked from commit d0489d0827fc6cef04d0f3602023d82ceda82480)
    
    Change-Id: I93380fb60db83aee37a1d324218ba6ab1700a2e5
    Reviewed-on: https://gerrit.libreoffice.org/18256
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>

diff --git a/sw/inc/IDocumentUndoRedo.hxx b/sw/inc/IDocumentUndoRedo.hxx
index ee67ba0..206617f 100644
--- a/sw/inc/IDocumentUndoRedo.hxx
+++ b/sw/inc/IDocumentUndoRedo.hxx
@@ -193,6 +193,10 @@ public:
     */
     virtual bool IsUndoNodes(SwNodes const& rNodes) const = 0;
 
+    /** Get the number of Undo actions.
+    */
+    virtual size_t GetUndoActionCount(const bool bCurrentLevel = true) const = 0;
+
 protected:
     virtual ~IDocumentUndoRedo() {};
 };
diff --git a/sw/source/core/inc/UndoManager.hxx b/sw/source/core/inc/UndoManager.hxx
index 43c5995..df574fd 100644
--- a/sw/source/core/inc/UndoManager.hxx
+++ b/sw/source/core/inc/UndoManager.hxx
@@ -71,6 +71,7 @@ public:
     virtual void AppendUndo(SwUndo *const pUndo) SAL_OVERRIDE;
     virtual void ClearRedo() SAL_OVERRIDE;
     virtual bool IsUndoNodes(SwNodes const& rNodes) const SAL_OVERRIDE;
+    virtual size_t GetUndoActionCount(const bool bCurrentLevel = true) const SAL_OVERRIDE;
 
     // ::svl::IUndoManager
     virtual void AddUndoAction(SfxUndoAction *pAction,
diff --git a/sw/source/core/undo/docundo.cxx b/sw/source/core/undo/docundo.cxx
index 470abe1..1b50ec4 100644
--- a/sw/source/core/undo/docundo.cxx
+++ b/sw/source/core/undo/docundo.cxx
@@ -79,6 +79,11 @@ bool UndoManager::IsUndoNodes(SwNodes const& rNodes) const
     return & rNodes == m_xUndoNodes.get();
 }
 
+size_t UndoManager::GetUndoActionCount(const bool bCurrentLevel) const
+{
+    return SdrUndoManager::GetUndoActionCount(bCurrentLevel);
+}
+
 void UndoManager::DoUndo(bool const bDoUndo)
 {
     if(!isTextEditActive())
diff --git a/sw/source/uibase/docvw/edtwin.cxx b/sw/source/uibase/docvw/edtwin.cxx
index d10edec..7d16052 100644
--- a/sw/source/uibase/docvw/edtwin.cxx
+++ b/sw/source/uibase/docvw/edtwin.cxx
@@ -76,6 +76,7 @@
 #include <wrtsh.hxx>
 #include <IDocumentSettingAccess.hxx>
 #include <IDocumentDrawModelAccess.hxx>
+#include <IDocumentUndoRedo.hxx>
 #include <textboxhelper.hxx>
 #include <dcontact.hxx>
 #include <fldbas.hxx>
@@ -4767,15 +4768,15 @@ void SwEditWin::MouseButtonUp(const MouseEvent& rMEvt)
             {
                 if( rSh.IsSelection() && !rSh.HasReadonlySel() )
                 {
-                    if(nId == RES_CHRATR_BACKGROUND)
+                    m_pApplyTempl->nUndo =
+                        std::min(m_pApplyTempl->nUndo, rSh.GetDoc()->GetIDocumentUndoRedo().GetUndoActionCount());
+                    if (nId == RES_CHRATR_BACKGROUND)
                         rSh.SetAttrItem( SvxBrushItem( SwEditWin::m_aTextBackColor, nId ) );
                     else
                         rSh.SetAttrItem( SvxColorItem( SwEditWin::m_aTextColor, nId ) );
                     rSh.UnSetVisCrsr();
                     rSh.EnterStdMode();
                     rSh.SetVisCrsr(aDocPt);
-
-                    m_pApplyTempl->bUndo = true;
                     bCallBase = false;
                     m_aTemplateTimer.Stop();
                 }
@@ -4796,7 +4797,8 @@ void SwEditWin::MouseButtonUp(const MouseEvent& rMEvt)
                          & eSelection ) && !rSh.HasReadonlySel() )
                     {
                         rSh.SetTxtFmtColl( m_pApplyTempl->aColl.pTxtColl );
-                        m_pApplyTempl->bUndo = true;
+                        m_pApplyTempl->nUndo =
+                            std::min(m_pApplyTempl->nUndo, rSh.GetDoc()->GetIDocumentUndoRedo().GetUndoActionCount());
                         bCallBase = false;
                         if ( m_pApplyTempl->aColl.pTxtColl )
                             aStyleName = m_pApplyTempl->aColl.pTxtColl->GetName();
@@ -4810,7 +4812,8 @@ void SwEditWin::MouseButtonUp(const MouseEvent& rMEvt)
                         rSh.UnSetVisCrsr();
                         rSh.EnterStdMode();
                         rSh.SetVisCrsr(aDocPt);
-                        m_pApplyTempl->bUndo = true;
+                        m_pApplyTempl->nUndo =
+                            std::min(m_pApplyTempl->nUndo, rSh.GetDoc()->GetIDocumentUndoRedo().GetUndoActionCount());
                         bCallBase = false;
                         if ( m_pApplyTempl->aColl.pCharFmt )
                             aStyleName = m_pApplyTempl->aColl.pCharFmt->GetName();
@@ -4822,7 +4825,8 @@ void SwEditWin::MouseButtonUp(const MouseEvent& rMEvt)
                     if(PTR_CAST(SwFlyFrmFmt, pFmt))
                     {
                         rSh.SetFrmFmt( m_pApplyTempl->aColl.pFrmFmt, false, &aDocPt );
-                        m_pApplyTempl->bUndo = true;
+                        m_pApplyTempl->nUndo =
+                            std::min(m_pApplyTempl->nUndo, rSh.GetDoc()->GetIDocumentUndoRedo().GetUndoActionCount());
                         bCallBase = false;
                         if( m_pApplyTempl->aColl.pFrmFmt )
                             aStyleName = m_pApplyTempl->aColl.pFrmFmt->GetName();
@@ -4834,6 +4838,8 @@ void SwEditWin::MouseButtonUp(const MouseEvent& rMEvt)
                     rSh.ChgCurPageDesc( *m_pApplyTempl->aColl.pPageDesc );
                     if ( m_pApplyTempl->aColl.pPageDesc )
                         aStyleName = m_pApplyTempl->aColl.pPageDesc->GetName();
+                    m_pApplyTempl->nUndo =
+                        std::min(m_pApplyTempl->nUndo, rSh.GetDoc()->GetIDocumentUndoRedo().GetUndoActionCount());
                     bCallBase = false;
                     break;
                 case SFX_STYLE_FAMILY_PSEUDO:
@@ -4843,7 +4849,8 @@ void SwEditWin::MouseButtonUp(const MouseEvent& rMEvt)
                                            false,
                                            m_pApplyTempl->aColl.pNumRule->GetDefaultListId() );
                         bCallBase = false;
-                        m_pApplyTempl->bUndo = true;
+                        m_pApplyTempl->nUndo =
+                            std::min(m_pApplyTempl->nUndo, rSh.GetDoc()->GetIDocumentUndoRedo().GetUndoActionCount());
                         if( m_pApplyTempl->aColl.pNumRule )
                             aStyleName = m_pApplyTempl->aColl.pNumRule->GetName();
                     }
@@ -4892,14 +4899,16 @@ void SwEditWin::SetApplyTemplate(const SwApplyTemplate &rTempl)
     if(rTempl.m_pFormatClipboard)
     {
         m_pApplyTempl = new SwApplyTemplate( rTempl );
+        m_pApplyTempl->nUndo = rSh.GetDoc()->GetIDocumentUndoRedo().GetUndoActionCount();
               SetPointer( POINTER_FILL );//@todo #i20119# maybe better a new brush pointer here in future
-              rSh.NoEdit( false );
-              bIdle = rSh.GetViewOptions()->IsIdle();
+        rSh.NoEdit( false );
+        bIdle = rSh.GetViewOptions()->IsIdle();
               ((SwViewOption *)rSh.GetViewOptions())->SetIdle( false );
     }
     else if(rTempl.nColor)
     {
         m_pApplyTempl = new SwApplyTemplate( rTempl );
+        m_pApplyTempl->nUndo = rSh.GetDoc()->GetIDocumentUndoRedo().GetUndoActionCount();
         SetPointer( POINTER_FILL );
         rSh.NoEdit( false );
         bIdle = rSh.GetViewOptions()->IsIdle();
@@ -4908,6 +4917,7 @@ void SwEditWin::SetApplyTemplate(const SwApplyTemplate &rTempl)
     else if( rTempl.eType )
     {
         m_pApplyTempl = new SwApplyTemplate( rTempl );
+        m_pApplyTempl->nUndo = rSh.GetDoc()->GetIDocumentUndoRedo().GetUndoActionCount();
         SetPointer( POINTER_FILL  );
         rSh.NoEdit( false );
         bIdle = rSh.GetViewOptions()->IsIdle();
@@ -5214,8 +5224,11 @@ void SwEditWin::Command( const CommandEvent& rCEvt )
                     else if ( !m_rView.ExecSpellPopup( aDocPos ) )
                         SfxDispatcher::ExecutePopup( 0, this, &aPixPos);
                 }
-                else if (m_pApplyTempl->bUndo)
+                else if (m_pApplyTempl->nUndo < rSh.GetDoc()->GetIDocumentUndoRedo().GetUndoActionCount())
+                {
+                    // Undo until we reach the point when we entered this context.
                     rSh.Do(SwWrtShell::UNDO);
+                }
                 bCallBase = false;
             }
         }
diff --git a/sw/source/uibase/inc/view.hxx b/sw/source/uibase/inc/view.hxx
index e624560..1399b95 100644
--- a/sw/source/uibase/inc/view.hxx
+++ b/sw/source/uibase/inc/view.hxx
@@ -130,13 +130,13 @@ struct SwApplyTemplate
     int eType;
     sal_uInt16 nColor;
     SwFormatClipboard* m_pFormatClipboard;
-    bool bUndo;
+    size_t nUndo; //< The initial undo stack depth.
 
     SwApplyTemplate() :
         eType(0),
         nColor(0),
         m_pFormatClipboard(0),
-        bUndo(false)
+        nUndo(0)
     {
         aColl.pTxtColl = 0;
     }
commit 6c34bd4a954df6ea5ed7f0d62942804ee70a3ef9
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Sep 2 15:13:33 2015 +0100

    detect if new offsets are the same as the previous ones and avoid loop
    
    Change-Id: I4c53d4bce9a69d79e34bdd634c296d9b495e1904
    (cherry picked from commit 137cf76573c89ea1b0b1f716a50731419a187473)
    Reviewed-on: https://gerrit.libreoffice.org/18275
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index f214746..64df102 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -414,6 +414,8 @@ bool SwWW8ImplReader::SearchRowEnd(WW8PLCFx_Cp_FKP* pPap, WW8_CP &rStartCp,
     WW8PLCFxDesc aRes;
     aRes.pMemPos = 0;
     aRes.nEndPos = rStartCp;
+    bool bReadRes(false);
+    WW8PLCFxDesc aPrevRes;
 
     while (pPap->HasFkp() && rStartCp != WW8_CP_MAX)
     {
@@ -446,6 +448,13 @@ bool SwWW8ImplReader::SearchRowEnd(WW8PLCFx_Cp_FKP* pPap, WW8_CP &rStartCp,
         }
         pPap->GetSprms(&aRes);
         pPap->SetDirty(false);
+        if (bReadRes && aRes.nEndPos == aPrevRes.nEndPos && aRes.nStartPos == aPrevRes.nStartPos)
+        {
+            SAL_WARN("sw.ww8", "SearchRowEnd, loop in paragraph property chain");
+            break;
+        }
+        bReadRes = true;
+        aPrevRes = aRes;
         //Update our aRes to get the new starting point of the next properties
         rStartCp = aRes.nEndPos;
     }
commit 2322691e5739cddc34ae1a9c70392598c271d252
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 31 15:11:03 2015 +0100

    check for over long record len and check reads
    
    Change-Id: Ib77ce1b95db2dc4396f4fd2fdcff4c0344b20c9e
    (cherry picked from commit 0c191e2b757555b147ebab1688e72acde28062a1)
    Reviewed-on: https://gerrit.libreoffice.org/18180
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/sw/qa/core/data/ww8/pass/hang-7.doc b/sw/qa/core/data/ww8/pass/hang-7.doc
new file mode 100644
index 0000000..a52a452f
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/hang-7.doc differ
diff --git a/sw/source/filter/ww8/ww8toolbar.cxx b/sw/source/filter/ww8/ww8toolbar.cxx
index e33a8c5..1232d44 100644
--- a/sw/source/filter/ww8/ww8toolbar.cxx
+++ b/sw/source/filter/ww8/ww8toolbar.cxx
@@ -167,7 +167,7 @@ bool SwCTBWrapper::Read( SvStream& rS )
     {
         rCustomizations[ *it ].bIsDroppedMenuTB = true;
     }
-    return true;
+    return rS.good();
 }
 
 SwTBC* SwCTBWrapper::GetTBCAtOffset( sal_uInt32 nStreamOffset )
@@ -285,7 +285,7 @@ bool Customization::Read( SvStream &rS)
         if ( !customizationDataCTB->Read( rS ) )
                 return false;
     }
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -455,7 +455,7 @@ bool TBDelta::Read(SvStream &rS)
     nOffSet = rS.Tell();
     rS.ReadUChar( doprfatendFlags ).ReadUChar( ibts ).ReadInt32( cidNext ).ReadInt32( cid ).ReadInt32( fc ) ;
     rS.ReadUInt16( CiTBDE ).ReadUInt16( cbTBC );
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -525,7 +525,7 @@ bool SwCTB::Read( SvStream &rS)
             rTBC.push_back( aTBC );
         }
     }
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -638,7 +638,7 @@ bool SwTBC::Read( SvStream &rS )
         if ( !tbcd->Read( rS ) )
             return false;
     }
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -778,7 +778,7 @@ Xst::Read( SvStream& rS )
     SAL_INFO("sw.ww8","Xst::Read() stream pos 0x" << std::hex << rS.Tell() );
     nOffSet = rS.Tell();
     sString = read_uInt16_PascalString(rS);
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -914,7 +914,7 @@ bool Tcg255::Read(SvStream &rS)
         nId = 0x40;
         rS.ReadUChar( nId );
     }
-    return true;
+    return rS.good();
     // Peek at
 }
 
@@ -946,7 +946,7 @@ bool Tcg255SubStruct::Read(SvStream &rS)
     nOffSet = rS.Tell();
     if ( mbReadId )
         rS.ReadUChar( ch );
-    return true;
+    return rS.good();
 }
 
 PlfMcd::PlfMcd(bool bReadId)
@@ -970,7 +970,7 @@ bool PlfMcd::Read(SvStream &rS)
                 return false;
         }
     }
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -1005,7 +1005,15 @@ bool PlfAcd::Read( SvStream &rS)
     nOffSet = rS.Tell();
     Tcg255SubStruct::Read( rS );
     rS.ReadInt32( iMac );
-    if ( iMac )
+    if (iMac < 0)
+        return false;
+    auto nMaxPossibleRecords = rS.remainingSize() / (sizeof(sal_uInt16)*2);
+    if (static_cast<sal_uInt32>(iMac) > nMaxPossibleRecords)
+    {
+        SAL_WARN("sw.ww8", iMac << " records claimed, but max possible is " << nMaxPossibleRecords);
+        iMac = nMaxPossibleRecords;
+    }
+    if (iMac)
     {
         rgacd = new Acd[ iMac ];
         for ( sal_Int32 index = 0; index < iMac; ++index )
@@ -1014,7 +1022,7 @@ bool PlfAcd::Read( SvStream &rS)
                 return false;
         }
     }
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -1058,7 +1066,7 @@ bool PlfKme::Read(SvStream &rS)
                 return false;
         }
     }
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -1126,7 +1134,7 @@ bool TcgSttbfCore::Read( SvStream& rS )
             rS.ReadUInt16( dataItems[ index ].extraData );
         }
     }
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -1176,7 +1184,7 @@ bool MacroNames::Read( SvStream &rS)
                 return false;
         }
     }
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -1230,7 +1238,7 @@ Xstz::Read(SvStream &rS)
     rS.ReadUInt16( chTerm );
     if ( chTerm != 0 ) // should be an assert
         return false;
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -1263,7 +1271,7 @@ Kme::Read(SvStream &rS)
     SAL_INFO("sw.ww8","Kme::Read() stream pos 0x" << std::hex << rS.Tell() );
     nOffSet = rS.Tell();
     rS.ReadInt16( reserved1 ).ReadInt16( reserved2 ).ReadUInt16( kcm1 ).ReadUInt16( kcm2 ).ReadUInt16( kt ).ReadUInt32( param );
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -1291,7 +1299,7 @@ bool Acd::Read(SvStream &rS)
     SAL_INFO("sw.ww8","Acd::Read() stream pos 0x" << std::hex << rS.Tell() );
     nOffSet = rS.Tell();
     rS.ReadInt16( ibst ).ReadUInt16( fciBasedOnABC );
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
@@ -1354,7 +1362,7 @@ bool MCD::Read(SvStream &rS)
     nOffSet = rS.Tell();
     rS.ReadSChar( reserved1 ).ReadUChar( reserved2 ).ReadUInt16( ibst ).ReadUInt16( ibstName ).ReadUInt16( reserved3 );
     rS.ReadUInt32( reserved4 ).ReadUInt32( reserved5 ).ReadUInt32( reserved6 ).ReadUInt32( reserved7 );
-    return true;
+    return rS.good();
 }
 
 #if OSL_DEBUG_LEVEL > 1
commit 8d471ba56d413adb177214af2434b2b6f54b0a4e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 31 11:11:27 2015 +0100

    check for legal field sizes before reading
    
    Change-Id: I3cdb647e1a057be5bb4b32d119ee5bcbbedf7473
    (cherry picked from commit ad6d83defb33c414885ce6d4bfa85571d463f3c3)
    Reviewed-on: https://gerrit.libreoffice.org/18170
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/filter/qa/cppunit/data/met/fail/hang-2.met b/filter/qa/cppunit/data/met/fail/hang-2.met
new file mode 100644
index 0000000..e807d58
Binary files /dev/null and b/filter/qa/cppunit/data/met/fail/hang-2.met differ
diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx
index e0d8736..88cc418 100644
--- a/filter/source/graphicfilter/ios2met/ios2met.cxx
+++ b/filter/source/graphicfilter/ios2met/ios2met.cxx
@@ -2678,21 +2678,34 @@ void OS2METReader::ReadOS2MET( SvStream & rStreamOS2MET, GDIMetaFile & rGDIMetaF
         pOS2MET->ReadUInt16(nFieldType);
 
         pOS2MET->SeekRel(3);
-        nPos+=8; nFieldSize-=8;
 
-        if (pOS2MET->GetError()) break;
-        if (pOS2MET->IsEof()) {
+        if (pOS2MET->GetError())
+            break;
+
+        if (nFieldType==EndDocumnMagic)
+            break;
+
+        if (pOS2MET->IsEof() || nFieldSize < 8)
+        {
             pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR);
             ErrorCode=8;
             break;
         }
 
-        if (nFieldType==EndDocumnMagic) break;
+        nPos+=8; nFieldSize-=8;
+
+        if (nFieldSize > pOS2MET->remainingSize())
+        {
+            pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR);
+            ErrorCode=8;
+            break;
+        }
 
         ReadField(nFieldType, nFieldSize);
+        nPos += nFieldSize;
 
-        nPos+=(sal_uLong)nFieldSize;
-        if (pOS2MET->Tell()>nPos)  {
+        if (pOS2MET->Tell() > nPos)
+        {
             pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR);
             ErrorCode=9;
             break;
commit 5d210fba65ec1cc145366117da5fecd349d4fada
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 1 09:39:58 2015 +0100

    Resolves: tdf#91060 don't crash on loading certain pptx
    
    Change-Id: Ibf32ef644222a59c5fe6a9736ff64739ab24b74f
    (cherry picked from commit c874bf3f7bd6bbe31416506d9b4213bcbbbac4fa)
    Reviewed-on: https://gerrit.libreoffice.org/18227
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/oox/source/ppt/slidefragmenthandler.cxx b/oox/source/ppt/slidefragmenthandler.cxx
index 95ea839..5a27ea3 100644
--- a/oox/source/ppt/slidefragmenthandler.cxx
+++ b/oox/source/ppt/slidefragmenthandler.cxx
@@ -194,7 +194,7 @@ SlideFragmentHandler::~SlideFragmentHandler()
     case PPT_TOKEN( cmLst ):
         break;
     case PPT_TOKEN( cm ):
-        if(!mpSlidePersistPtr->getCommentsList().cmLst.empty())
+        if (!mpSlidePersistPtr->getCommentsList().cmLst.empty() && !getCharVector().empty())
         {
             // set comment text for earlier comment
             mpSlidePersistPtr->getCommentsList().cmLst.back().setText( getCharVector().back() );
commit 337a44066deeb56b1c4bb32128678d02dc5b6235
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 31 13:21:19 2015 +0100

    check for ridiculous lengths and check stream status
    
    Change-Id: Iefe943794e005f03b2a6ea5fc642b8c3d21b3334
    (cherry picked from commit 858257d465b7e7ce54819cc2f631efcb20632863)
    Reviewed-on: https://gerrit.libreoffice.org/18174
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/sw/qa/core/data/ww8/pass/hang-6.doc b/sw/qa/core/data/ww8/pass/hang-6.doc
new file mode 100644
index 0000000..48293c5
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/hang-6.doc differ
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 2b0170b..ad69a1f 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -677,16 +677,22 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt,
                                              SEEK_FROM_CURRENT_AND_RESTART )
             && maShapeRecords.Current()->nRecLen )
         {
-            sal_uInt32  nBytesLeft = maShapeRecords.Current()->nRecLen;
-            sal_uInt32  nUDData;
-            sal_uInt16  nPID;
+            sal_uInt32 nBytesLeft = maShapeRecords.Current()->nRecLen;
+            auto nAvailableBytes = rSt.remainingSize();
+            if (nBytesLeft > nAvailableBytes)
+            {
+                SAL_WARN("sw.ww8", "Document claimed to have shape record of " << nBytesLeft << " bytes, but only " << nAvailableBytes << " available");
+                nBytesLeft = nAvailableBytes;
+            }
             while( 5 < nBytesLeft )
             {
-                rSt.ReadUInt16( nPID );
-                if ( rSt.GetError() != 0 )
+                sal_uInt16 nPID(0);
+                rSt.ReadUInt16(nPID);
+                sal_uInt32 nUDData(0);
+                rSt.ReadUInt32(nUDData);
+                if (!rSt.good())
                     break;
-                rSt.ReadUInt32( nUDData );
-                switch( nPID )
+                switch (nPID)
                 {
                     case 0x038F: pImpRec->nXAlign = nUDData; break;
                     case 0x0390:
@@ -714,8 +720,6 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt,
                         pImpRec->isHorizontalRule = true;
                         break;
                 }
-                if ( rSt.GetError() != 0 )
-                    break;
                 nBytesLeft  -= 6;
             }
         }
commit c0b828d4fa6a80d3a4ace485f95477a9bc6b4a39
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 31 15:06:27 2015 +0100

    check stream status
    
    Change-Id: I27bb289288d319a93201e9c3d703114924ca258c
    (cherry picked from commit daf1578d752531e2b48d183531d9a4a7cedfc37e)
    Reviewed-on: https://gerrit.libreoffice.org/18178
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-4.wmf b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-4.wmf
new file mode 100644
index 0000000..f16b60c
Binary files /dev/null and b/vcl/qa/cppunit/graphicfilter/data/wmf/fail/hang-4.wmf differ
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index 4667844..0a5fd12 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -627,7 +627,7 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
                 pAcc = aBmp.AcquireWriteAccess();
                 if ( pAcc )
                 {
-                    for (sal_uInt16 y = 0; y < nHeight; y++ )
+                    for (sal_uInt16 y = 0; y < nHeight && pWMF->good(); ++y)
                     {
                         sal_uInt16 x = 0;
                         for (sal_uInt16 scan = 0; scan < nBytesPerScan; scan++ )
commit 0d5a671b4c848f077b03c21a3159f3a30495b432
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 31 09:55:37 2015 +0100

    check stream status
    
    Change-Id: I65ed5979d35d8739367294a71620782b832cfd71
    (cherry picked from commit a8fe085f973b4ccf846fe231af0fa25eda59911e)
    Reviewed-on: https://gerrit.libreoffice.org/18161
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    Tested-by: Miklos Vajna <vmiklos at collabora.co.uk>

diff --git a/filter/qa/cppunit/data/pict/fail/hang-1.pct b/filter/qa/cppunit/data/pict/fail/hang-1.pct
new file mode 100644
index 0000000..735ce0a
Binary files /dev/null and b/filter/qa/cppunit/data/pict/fail/hang-1.pct differ
diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx
index 4f0e431..6fd4fbb 100644
--- a/filter/source/graphicfilter/ipict/ipict.cxx
+++ b/filter/source/graphicfilter/ipict/ipict.cxx
@@ -832,8 +832,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
     // read and write Bitmap bits:
     if ( nPixelSize == 1 || nPixelSize == 2 || nPixelSize == 4 || nPixelSize == 8 )
     {
-        sal_uInt8   nByteCountAsByte, nFlagCounterByte;
-        sal_uInt16  nByteCount, nSrcBPL, nDestBPL;
+        sal_uInt16  nSrcBPL, nDestBPL;
         size_t nCount;
 
         if      ( nPixelSize == 1 ) nSrcBPL = ( nWidth + 7 ) >> 3;
@@ -859,6 +858,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
             }
             else
             {
+                sal_uInt16 nByteCount(0);
                 if ( nRowBytes > 250 )
                 {
                     pPict->ReadUInt16( nByteCount );
@@ -866,14 +866,16 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
                 }
                 else
                 {
+                    sal_uInt8 nByteCountAsByte(0);
                     pPict->ReadUChar( nByteCountAsByte );
                     nByteCount = ( (sal_uInt16)nByteCountAsByte ) & 0x00ff;
                     nDataSize += 1 + (sal_uLong)nByteCount;
                 }
 
-                while ( nByteCount )
+                while (pPict->good() && nByteCount)
                 {
-                    pPict->ReadUChar( nFlagCounterByte );
+                    sal_uInt8 nFlagCounterByte(0);
+                    pPict->ReadUChar(nFlagCounterByte);
                     if ( ( nFlagCounterByte & 0x80 ) == 0 )
                     {
                         nCount = ( (sal_uInt16)nFlagCounterByte ) + 1;
commit e8405fbe2a0efb8dea2b0777097153563bee4bd8
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Fri Jul 31 09:15:14 2015 +0200

    tdf#88986 sw: add missing XPropertyList pool items on TextFrame insertion
    
    Regression from commit 6e61ecd09679a66060f932835622821d39e92f01 (Merge
    back branch alg_writerframes to trunk, 2014-03-19), the problem was
    while SwFrameShell::Execute() was modified to put the various pool items
    related to fill types (colors, gradients, etc) to the item set of the
    dialog, the same was missing in SwTextShell::ExecInsert(), so colors
    were missing on inserting a new frame, but not when editing an existing
    one.
    
    (cherry picked from commit 6c3ca675509101732d3d878d6ceb6226026cd9ac)
    
    Conflicts:
    	sw/inc/drawdoc.hxx
    
    Change-Id: Id009f914c1c3b6509e31a4887e32a00624678cf4
    Reviewed-on: https://gerrit.libreoffice.org/18232
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/inc/drawdoc.hxx b/sw/inc/drawdoc.hxx
index 2bc65c6..ddcf713 100644
--- a/sw/inc/drawdoc.hxx
+++ b/sw/inc/drawdoc.hxx
@@ -33,6 +33,8 @@ public:
 
     const SwDoc& GetDoc() const { return *pDoc; }
           SwDoc& GetDoc()       { return *pDoc; }
+    /// Put needed items for XPropertyList entries from the DrawModel.
+    void PutAreaListItems(SfxItemSet& rSet) const;
 
     virtual SdrPage* AllocPage(bool bMasterPage) SAL_OVERRIDE;
 
diff --git a/sw/source/core/draw/drawdoc.cxx b/sw/source/core/draw/drawdoc.cxx
index 149408b..8d312b3 100644
--- a/sw/source/core/draw/drawdoc.cxx
+++ b/sw/source/core/draw/drawdoc.cxx
@@ -150,4 +150,12 @@ uno::Reference< uno::XInterface > SwDrawModel::createUnoModel()
     return xModel;
 }
 
+void SwDrawModel::PutAreaListItems(SfxItemSet& rSet) const
+{
+    rSet.Put(SvxColorListItem(GetColorList(), SID_COLOR_TABLE));
+    rSet.Put(SvxGradientListItem(GetGradientList(), SID_GRADIENT_LIST));
+    rSet.Put(SvxHatchListItem(GetHatchList(), SID_HATCH_LIST));
+    rSet.Put(SvxBitmapListItem(GetBitmapList(), SID_BITMAP_LIST));
+}
+
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/source/uibase/shells/frmsh.cxx b/sw/source/uibase/shells/frmsh.cxx
index 8ba06c9..2b7450c 100644
--- a/sw/source/uibase/shells/frmsh.cxx
+++ b/sw/source/uibase/shells/frmsh.cxx
@@ -447,11 +447,7 @@ void SwFrameShell::Execute(SfxRequest &rReq)
                 //UUUU create needed items for XPropertyList entries from the DrawModel so that
                 // the Area TabPage can access them
                 const SwDrawModel* pDrawModel = rSh.GetView().GetDocShell()->GetDoc()->getIDocumentDrawModelAccess().GetDrawModel();
-
-                aSet.Put(SvxColorListItem(pDrawModel->GetColorList(), SID_COLOR_TABLE));
-                aSet.Put(SvxGradientListItem(pDrawModel->GetGradientList(), SID_GRADIENT_LIST));
-                aSet.Put(SvxHatchListItem(pDrawModel->GetHatchList(), SID_HATCH_LIST));
-                aSet.Put(SvxBitmapListItem(pDrawModel->GetBitmapList(), SID_BITMAP_LIST));
+                pDrawModel->PutAreaListItems(aSet);
 
                 const SwViewOption* pVOpt = rSh.GetViewOptions();
                 if(nSel & nsSelectionType::SEL_OLE)
diff --git a/sw/source/uibase/shells/textsh.cxx b/sw/source/uibase/shells/textsh.cxx
index 89f0871..ae19de5 100644
--- a/sw/source/uibase/shells/textsh.cxx
+++ b/sw/source/uibase/shells/textsh.cxx
@@ -114,6 +114,8 @@ using namespace ::com::sun::star;
 #include <table.hrc>
 #include <frmui.hrc>
 #include <unomid.h>
+#include <IDocumentDrawModelAccess.hxx>
+#include <drawdoc.hxx>
 #include <boost/scoped_ptr.hpp>
 
 SFX_IMPL_INTERFACE(SwTextShell, SwBaseShell, SW_RES(STR_SHELLNAME_TEXT))
@@ -579,11 +581,16 @@ void SwTextShell::ExecInsert(SfxRequest &rReq)
                 SID_ATTR_PAGE_SIZE,     SID_ATTR_PAGE_SIZE,
                 FN_SET_FRM_NAME,        FN_SET_FRM_NAME,
                 SID_HTML_MODE,          SID_HTML_MODE,
+                SID_COLOR_TABLE,        SID_BITMAP_LIST,
                 0
             };
 
             SfxItemSet aSet(GetPool(), aFrmAttrRange );
             aSet.Put(SfxUInt16Item(SID_HTML_MODE, ::GetHtmlMode(GetView().GetDocShell())));
+
+            // For the Area tab page.
+            GetShell().GetDoc()->getIDocumentDrawModelAccess().GetDrawModel()->PutAreaListItems(aSet);
+
             const SwRect &rPg = GetShell().GetAnyCurRect(RECT_PAGE);
             SwFmtFrmSize aFrmSize(ATT_VAR_SIZE, rPg.Width(), rPg.Height());
             aFrmSize.SetWhich(GetPool().GetWhich(SID_ATTR_PAGE_SIZE));
commit 17066c347559de545bbdc0e16d1627b729c86a30
Author: Jan Holesovsky <kendy at collabora.com>
Date:   Mon Aug 31 15:37:22 2015 +0200

    vcl: Improve management of mnRef0Count.
    
    Follow-up to 34700400247e378e074ce4164ab2809edb092201; this fixes sw_ww8export
    unit test on Windows.
    
    Reviewed-on: https://gerrit.libreoffice.org/18175
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 44377b911f9e19e43f14e390b69db4055f423b6a)
    Signed-off-by: Michael Stahl <mstahl at redhat.com>
    
    Change-Id: Ic0c3228efb59a182e1562b73117418cd8b5e6017

diff --git a/vcl/inc/outdev.h b/vcl/inc/outdev.h
index 5581fe1..d8a27b3 100644
--- a/vcl/inc/outdev.h
+++ b/vcl/inc/outdev.h
@@ -154,7 +154,12 @@ public:
     ImplFontEntry*      GetFontEntry( PhysicalFontCollection*, FontSelectPattern& );
     ImplFontEntry*      GetGlyphFallbackFont( PhysicalFontCollection*, FontSelectPattern&,
                             int nFallbackLevel, OUString& rMissingCodes );
-    void                Release( ImplFontEntry* );
+
+    /// Increase the refcount of the given ImplFontEntry.
+    void                Acquire(ImplFontEntry*);
+    /// Decrease the refcount and potentially cleanup the entries with zero refcount from the cache.
+    void                Release(ImplFontEntry*);
+
     void                Invalidate();
 };
 
diff --git a/vcl/source/outdev/font.cxx b/vcl/source/outdev/font.cxx
index 6e46b80..c7faaef 100644
--- a/vcl/source/outdev/font.cxx
+++ b/vcl/source/outdev/font.cxx
@@ -1297,8 +1297,7 @@ ImplFontEntry* ImplFontCache::GetFontEntry( PhysicalFontCollection* pFontList,
     if( pEntry ) // cache hit => use existing font instance
     {
         // increase the font instance's reference count
-        if( !pEntry->mnRefCount++ )
-            --mnRef0Count;
+        Acquire(pEntry);
     }
 
     if (!pEntry && pFontData)// still no cache hit => create a new font instance
@@ -1371,7 +1370,15 @@ ImplFontEntry* ImplFontCache::GetGlyphFallbackFont( PhysicalFontCollection* pFon
     return pFallbackFont;
 }
 
-void ImplFontCache::Release( ImplFontEntry* pEntry )
+void ImplFontCache::Acquire(ImplFontEntry* pEntry)
+{
+    assert(pEntry->m_pFontCache == this);
+
+    if (0 == pEntry->mnRefCount++)
+        --mnRef0Count;
+}
+
+void ImplFontCache::Release(ImplFontEntry* pEntry)
 {
     static const int FONTCACHE_MAX = 50;
 
@@ -1382,6 +1389,8 @@ void ImplFontCache::Release( ImplFontEntry* pEntry )
     if (++mnRef0Count < FONTCACHE_MAX)
         return;
 
+    assert(CountUnreferencedEntries() == mnRef0Count);
+
     // remove unused entries from font instance cache
     FontInstanceList::iterator it_next = maFontInstanceList.begin();
     while( it_next != maFontInstanceList.end() )
diff --git a/vcl/win/source/gdi/winlayout.cxx b/vcl/win/source/gdi/winlayout.cxx
index d010985..11f6248a 100644
--- a/vcl/win/source/gdi/winlayout.cxx
+++ b/vcl/win/source/gdi/winlayout.cxx
@@ -115,7 +115,7 @@ WinLayout::WinLayout(HDC hDC, const ImplWinFontData& rWFD, ImplWinFontEntry& rWF
     mrWinFontEntry(rWFE),
     mbUseOpenGL(bUseOpenGL)
 {
-    ++mrWinFontEntry.mnRefCount; // keep it alive
+    mrWinFontEntry.m_pFontCache->Acquire(&mrWinFontEntry);
 }
 
 WinLayout::~WinLayout()


More information about the Libreoffice-commits mailing list