[Libreoffice-commits] core.git: 28 commits - chart2/source editeng/source filter/source include/editeng include/vcl sc/source svx/source sw/source tools/source vcl/source vcl/unx

Caolán McNamara caolanm at redhat.com
Tue Sep 29 03:10:58 PDT 2015


 chart2/source/view/main/3DChartObjects.cxx  |    2 -
 editeng/source/outliner/outliner.cxx        |    1 
 editeng/source/outliner/overflowingtxt.cxx  |   16 ++++++++----
 filter/source/graphicfilter/ipict/ipict.cxx |   32 ++++++++++++++-----------
 include/editeng/overflowingtxt.hxx          |    2 -
 include/vcl/salbtype.hxx                    |    7 -----
 sc/source/ui/view/editsh.cxx                |    2 -
 svx/source/svdraw/svdedxv.cxx               |   35 +++++++++++++---------------
 svx/source/svdraw/svdotxed.cxx              |   13 ++++++++--
 svx/source/svdraw/textchainflow.cxx         |   11 ++++++--
 svx/source/xoutdev/_xoutbmp.cxx             |    6 +++-
 svx/source/xoutdev/xattrbmp.cxx             |    8 ++++--
 sw/source/core/doc/tblrwcl.cxx              |    2 -
 sw/source/core/layout/trvlfrm.cxx           |    2 -
 tools/source/inet/inetmime.cxx              |   29 -----------------------
 vcl/source/filter/wmf/winwmf.cxx            |    7 ++++-
 vcl/source/gdi/bitmap3.cxx                  |    9 ++++---
 vcl/source/gdi/dibtools.cxx                 |   17 ++++++++-----
 vcl/unx/generic/gdi/salbmp.cxx              |    6 ++--
 19 files changed, 107 insertions(+), 100 deletions(-)

New commits:
commit 97a2ca5d689612a44a93cc7932eb2e7e46be4a68
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:39:54 2015 +0100

    coverity#1242658 Untrusted loop bound
    
    Change-Id: I0a279e47a4d87f561f39d5a8ca65fa17e2bc4a65

diff --git a/filter/source/graphicfilter/ipict/ipict.cxx b/filter/source/graphicfilter/ipict/ipict.cxx
index 5caa437..d926079 100644
--- a/filter/source/graphicfilter/ipict/ipict.cxx
+++ b/filter/source/graphicfilter/ipict/ipict.cxx
@@ -84,16 +84,15 @@ namespace PictReaderInternal {
   };
 
   sal_uLong Pattern::read(SvStream &stream) {
-    short nx,ny;
     unsigned char nbyte[8];
     sal_uLong nHiBytes, nLoBytes;
     isColor = false;
 
     // count the no of bits in pattern which are set to 1:
     nBitCount=0;
-    for (ny=0; ny<8; ny++) {
+    for (short ny=0; ny<8; ny++) {
       stream.ReadChar( reinterpret_cast<char&>(nbyte[ny]) );
-      for (nx=0; nx<8; nx++) {
+      for (short nx=0; nx<8; nx++) {
     if ( (nbyte[ny] & (1<<nx)) != 0 ) nBitCount++;
       }
     }
@@ -706,7 +705,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
     Bitmap              aBitmap;
     BitmapWriteAccess*  pAcc = NULL;
     BitmapReadAccess*   pReadAcc = NULL;
-    sal_uInt16              ny, nx, nColTabSize;
+    sal_uInt16              nColTabSize;
     sal_uInt16              nRowBytes, nBndX, nBndY, nWidth, nHeight, nVersion, nPackType, nPixelType,
                         nPixelSize, nCmpCount, nCmpSize;
     sal_uInt32          nPackSize, nPlaneBytes, nHRes, nVRes;
@@ -835,9 +834,14 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
         if ( nRowBytes < nSrcBPL || nRowBytes > nDestBPL )
             BITMAPERROR;
 
-        for ( ny = 0; ny < nHeight; ny++ )
+        if ( nRowBytes < 8 || nPackType == 1 ) {
+            if (pPict->remainingSize() < sizeof(sal_uInt8) * nHeight * nRowBytes)
+                BITMAPERROR;
+        }
+
+        for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
         {
-            nx = 0;
+            sal_uInt16 nx = 0;
             if ( nRowBytes < 8 || nPackType == 1 )
             {
                 for ( i = 0; i < nRowBytes; i++ )
@@ -908,9 +912,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
                 BITMAPERROR;
         }
 
-        for ( ny = 0; ny < nHeight; ny++ )
+        for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
         {
-            nx = 0;
+            sal_uInt16 nx = 0;
             if ( nRowBytes < 8 || nPackType == 1 )
             {
                 for ( i = 0; i < nWidth; i++ )
@@ -1005,9 +1009,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
             if (nWidth > nMaxCols)
                 BITMAPERROR;
 
-            for ( ny = 0; ny < nHeight; ny++ )
+            for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
             {
-                for ( nx = 0; nx < nWidth; nx++ )
+                for (sal_uInt16 nx = 0; nx < nWidth; ++nx)
                 {
                     pPict->ReadUChar( nDummy ).ReadUChar( nRed ).ReadUChar( nGreen ).ReadUChar( nBlue );
                     pAcc->SetPixel( ny, nx, BitmapColor( nRed, nGreen, nBlue) );
@@ -1025,9 +1029,9 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
             if (nWidth > nMaxCols)
                 BITMAPERROR;
 
-            for ( ny = 0; ny < nHeight; ny++ )
+            for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
             {
-                for ( nx = 0; nx < nWidth; nx++ )
+                for (sal_uInt16 nx = 0; nx < nWidth; ++nx)
                 {
                     pPict->ReadUChar( nRed ).ReadUChar( nGreen ).ReadUChar( nBlue );
                     pAcc->SetPixel( ny, nx, BitmapColor( nRed, nGreen, nBlue ) );
@@ -1040,7 +1044,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
             if ( ( nCmpCount == 3 ) || ( nCmpCount == 4 ) )
             {
                 std::unique_ptr<sal_uInt8[]> pScanline(new sal_uInt8[static_cast<size_t>(nWidth) * nCmpCount]);
-                for ( ny = 0; ny < nHeight; ny++ )
+                for (sal_uInt16 ny = 0; ny < nHeight; ++ny)
                 {
                     nSrcBitsPos = pPict->Tell();
                     if ( nRowBytes > 250 )
@@ -1086,7 +1090,7 @@ sal_uLong PictReader::ReadPixMapEtc( Bitmap &rBitmap, bool bBaseAddr, bool bColo
                     sal_uInt8* pTmp = pScanline.get();
                     if ( nCmpCount == 4 )
                         pTmp += nWidth;
-                    for ( nx = 0; nx < nWidth; pTmp++ )
+                    for (sal_uInt16 nx = 0; nx < nWidth; pTmp++)
                         pAcc->SetPixel( ny, nx++, BitmapColor( *pTmp, pTmp[ nWidth ], pTmp[ 2 * nWidth ] ) );
                     nDataSize += (sal_uLong)nByteCount;
                     pPict->Seek( nSrcBitsPos + (sal_uLong)nByteCount );
commit 6a0adc9aeaa4976c03500231a5984c9fee7048f7
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:33:35 2015 +0100

    fix coverity#1325071
    
    Change-Id: I36e2e15b3c01c3d648feb23d8c886ea26301a5fd

diff --git a/svx/source/svdraw/svdotxed.cxx b/svx/source/svdraw/svdotxed.cxx
index 149a1bb..b2cc9d6 100644
--- a/svx/source/svdraw/svdotxed.cxx
+++ b/svx/source/svdraw/svdotxed.cxx
@@ -23,6 +23,7 @@
 #include <svx/svdoutl.hxx>
 #include <editeng/editdata.hxx>
 #include <editeng/outliner.hxx>
+#include <editeng/outlobj.hxx>
 #include <editeng/overflowingtxt.hxx>
 #include <editeng/editstat.hxx>
 #include <svl/itemset.hxx>
commit d49430893e88bd4327e0f004c0e4b32c65225117
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:30:44 2015 +0100

    coverity#1325077 Uninitialized pointer field
    
    Change-Id: I74121c1cc94edf338cf40a3d186308491e1d2409

diff --git a/editeng/source/outliner/overflowingtxt.cxx b/editeng/source/outliner/overflowingtxt.cxx
index 945a845..6ead858 100644
--- a/editeng/source/outliner/overflowingtxt.cxx
+++ b/editeng/source/outliner/overflowingtxt.cxx
@@ -135,16 +135,15 @@ ESelection OverflowingText::GetInsertionPointSel()
 
 // class NonOverflowingText
 
-NonOverflowingText::NonOverflowingText(const EditTextObject *pTObj,  bool bLastParaInterrupted)
-    : mpContentTextObj(pTObj->Clone()),
-      mbLastParaInterrupted(bLastParaInterrupted)
+NonOverflowingText::NonOverflowingText(const EditTextObject * /*pTObj*/,  bool bLastParaInterrupted)
+    : mbLastParaInterrupted(bLastParaInterrupted)
 {
      // XXX: may have to delete pTObj
 }
 
 NonOverflowingText::NonOverflowingText(const ESelection &aSel, bool bLastParaInterrupted)
-    : maContentSel(aSel),
-      mbLastParaInterrupted(bLastParaInterrupted)
+    : maContentSel(aSel)
+    , mbLastParaInterrupted(bLastParaInterrupted)
 {
 }
 
diff --git a/include/editeng/overflowingtxt.hxx b/include/editeng/overflowingtxt.hxx
index 9eec07e..faa77f8 100644
--- a/include/editeng/overflowingtxt.hxx
+++ b/include/editeng/overflowingtxt.hxx
@@ -96,7 +96,6 @@ private:
     NonOverflowingText(const ESelection &aSel, bool bLastParaInterrupted);
 
     friend class Outliner;
-    const EditTextObject *mpContentTextObj;
     const ESelection maContentSel;
     const bool mbLastParaInterrupted;
 };
@@ -112,6 +111,7 @@ class EDITENG_DLLPUBLIC OFlowChainedText
 {
 public:
     OFlowChainedText(Outliner *, bool );
+    ~OFlowChainedText();
 
     OutlinerParaObject *InsertOverflowingText(Outliner *, OutlinerParaObject *);
     OutlinerParaObject *RemoveOverflowingText(Outliner *);
commit 4d5979d35ae4a58f62e00c42b1af071f13686baa
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:27:15 2015 +0100

    coverity1325072 Resource leak
    
    Change-Id: I78db1f189d4773ba2ced52fee82add2344b7435e

diff --git a/svx/source/svdraw/textchainflow.cxx b/svx/source/svdraw/textchainflow.cxx
index cfdb6ce..248c1c4 100644
--- a/svx/source/svdraw/textchainflow.cxx
+++ b/svx/source/svdraw/textchainflow.cxx
@@ -301,8 +301,8 @@ void EditingTextChainFlow::CheckForFlowEvents(SdrOutliner *pFlowOutl)
 
 void EditingTextChainFlow::impLeaveOnlyNonOverflowingText(SdrOutliner *pNonOverflOutl)
 {
-    //OutlinerParaObject *pNewText =
-    mpOverflChText->RemoveOverflowingText(pNonOverflOutl);
+    OutlinerParaObject *pNewText = mpOverflChText->RemoveOverflowingText(pNonOverflOutl);
+    delete pNewText;
     //impSetTextForEditingOutliner(pNewText); //XXX: Don't call it since we do everything with NonOverflowingText::ToParaObject // XXX: You may need this for Underflow
 
     // XXX: I'm not sure whether we need this (after all operations such as Paste don't change this - as far as I understand)
commit a0c42a13de26d5b5cf070b452ebf93b831e0916d
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:25:48 2015 +0100

    coverity#1325071 Resource leak
    
    Change-Id: If045233eeb0d8f6fab89dff4c4307a3b8bde5a92

diff --git a/svx/source/svdraw/svdotxed.cxx b/svx/source/svdraw/svdotxed.cxx
index 4e07027..149a1bb 100644
--- a/svx/source/svdraw/svdotxed.cxx
+++ b/svx/source/svdraw/svdotxed.cxx
@@ -278,8 +278,6 @@ void SdrTextObj::TakeTextEditArea(Size* pPaperMin, Size* pPaperMax, Rectangle* p
 
 void SdrTextObj::EndTextEdit(SdrOutliner& rOutl)
 {
-    OutlinerParaObject* pNewText = NULL;
-
     if(rOutl.IsModified())
     {
 
@@ -287,7 +285,8 @@ void SdrTextObj::EndTextEdit(SdrOutliner& rOutl)
         rOutl.UpdateFields();
 
         sal_Int32 nParaAnz = rOutl.GetParagraphCount();
-        pNewText = rOutl.CreateParaObject( 0, nParaAnz );
+        bool bNewTextTransferred = false;
+        OutlinerParaObject* pNewText = rOutl.CreateParaObject( 0, nParaAnz );
 
         // need to end edit mode early since SetOutlinerParaObject already
         // uses GetCurrentBoundRect() which needs to take the text into account
@@ -298,10 +297,17 @@ void SdrTextObj::EndTextEdit(SdrOutliner& rOutl)
         if (IsChainable() && GetTextChain()->GetSwitchingToNextBox(this)) {
             GetTextChain()->SetSwitchingToNextBox(this, false);
             if( getActiveText() )
+            {
                 getActiveText()->SetOutlinerParaObject( pNewText);
+                bNewTextTransferred = true;
+            }
         } else { // If we are not doing in-chaining switching just set the ParaObject
             SetOutlinerParaObject(pNewText);
+            bNewTextTransferred = true;
         }
+
+        if (!bNewTextTransferred)
+            delete pNewText;
     }
 
     /* Beginning Chaining-related code */
commit 2f50e9008040c4ff4c4fa516f784f0ae3624534e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:23:39 2015 +0100

    coverity#1325070 Resource leak
    
    Change-Id: I9ae845f1350095e5049ca4e56956fe9f5c7c918f

diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx
index dbd69d8..4010743 100644
--- a/vcl/source/gdi/dibtools.cxx
+++ b/vcl/source/gdi/dibtools.cxx
@@ -1537,7 +1537,7 @@ bool ImplWriteDIB(
 
         rOStm.SetEndian(SvStreamEndian::LITTLE);
 
-        if(pAcc)
+        if (pAcc)
         {
             if(bFileHeader)
             {
@@ -1552,11 +1552,11 @@ bool ImplWriteDIB(
             }
 
             Bitmap::ReleaseAccess(pAcc);
+        }
 
-            if(pAccAlpha)
-            {
-                Bitmap::ReleaseAccess(pAccAlpha);
-            }
+        if (pAccAlpha)
+        {
+            Bitmap::ReleaseAccess(pAccAlpha);
         }
 
         if(!bRet)
commit cea187b6ea2ca4dc8bda51c3616eafb6393531ba
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:21:52 2015 +0100

    coverity#1325069 Resource leak
    
    Change-Id: Ie02b77e17403474c65fbafa9ee2aa17bf0132417

diff --git a/chart2/source/view/main/3DChartObjects.cxx b/chart2/source/view/main/3DChartObjects.cxx
index 89caf0a..1b8cc7b 100644
--- a/chart2/source/view/main/3DChartObjects.cxx
+++ b/chart2/source/view/main/3DChartObjects.cxx
@@ -106,7 +106,7 @@ const TextCacheItem& TextCache::getText(OUString const & rText, bool bIs3dText)
     memcpy(pBitmapBuf, buf, 3* nBmpWidth * nBmpHeight);
     TextCacheItem *pItem = new TextCacheItem(pBitmapBuf, aText.GetSizePixel());
     maTextCache.insert(rText, pItem);
-
+    Bitmap::ReleaseAccess(pAcc);
     return *maTextCache.find(rText)->second;
 }
 
commit e2c8fbb535c5df91073fd5acbeccf51b2f3153c0
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:20:30 2015 +0100

    coverity#1325068 Resource leak
    
    Change-Id: I608140eb05703f6f0cf2920be7ed706ef30e2a7d

diff --git a/editeng/source/outliner/outliner.cxx b/editeng/source/outliner/outliner.cxx
index 1f077c2..72c9a4b 100644
--- a/editeng/source/outliner/outliner.cxx
+++ b/editeng/source/outliner/outliner.cxx
@@ -418,6 +418,7 @@ void Outliner::SetToEmptyText()
 {
     OutlinerParaObject *pEmptyTxt =  GetEmptyParaObject();
     SetText(*pEmptyTxt);
+    delete pEmptyTxt;
 }
 
 void Outliner::SetText( const OUString& rText, Paragraph* pPara )
commit acf83365fcea4b8471f087cf88a548e77b4b26e5
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:19:14 2015 +0100

    coverity#1325067 Resource leak
    
    Change-Id: I1db24c81a2698ff49dd2441ddd1bc94a1a3e6f58

diff --git a/vcl/source/gdi/dibtools.cxx b/vcl/source/gdi/dibtools.cxx
index ebab16d..dbd69d8 100644
--- a/vcl/source/gdi/dibtools.cxx
+++ b/vcl/source/gdi/dibtools.cxx
@@ -748,8 +748,13 @@ bool ImplReadDIBBody( SvStream& rIStm, Bitmap& rBmp, Bitmap* pBmpAlpha, sal_uLon
         BitmapPalette aDummyPal;
         Bitmap aNewBmp(aSizePixel, nBitCount, &aDummyPal);
         BitmapWriteAccess* pAcc = aNewBmp.AcquireWriteAccess();
-        if (!pAcc || pAcc->Width() != aHeader.nWidth || pAcc->Height() != aHeader.nHeight)
+        if (!pAcc)
             return false;
+        if (pAcc->Width() != aHeader.nWidth || pAcc->Height() != aHeader.nHeight)
+        {
+            Bitmap::ReleaseAccess(pAcc);
+            return false;
+        }
         Bitmap aNewBmpAlpha;
         BitmapWriteAccess* pAccAlpha = 0;
         bool bAlphaPossible(pBmpAlpha && aHeader.nBitCount == 32);
commit 1faa4dd2fb27543395b1241cb4adc18ce58895e2
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:17:52 2015 +0100

    coverity#1325066 Resource leak
    
    Change-Id: I8065898bcce11f8b0243aea23854edee6fb05595

diff --git a/svx/source/svdraw/svdedxv.cxx b/svx/source/svdraw/svdedxv.cxx
index 042fa2e..9224918 100644
--- a/svx/source/svdraw/svdedxv.cxx
+++ b/svx/source/svdraw/svdedxv.cxx
@@ -1311,8 +1311,8 @@ bool SdrObjEditView::KeyInput(const KeyEvent& rKEvt, vcl::Window* pWin)
         /* Start special handling of keys within a chain */
         // We possibly move to another box before any handling
         bool bHandled = false;
-        TextChainCursorManager *pCursorManager =
-            ImpHandleMotionThroughBoxesKeyInput(rKEvt, pWin, &bHandled);
+        std::unique_ptr<TextChainCursorManager> xCursorManager(
+            ImpHandleMotionThroughBoxesKeyInput(rKEvt, pWin, &bHandled));
         if (bHandled)
             return true;
         /* End special handling of keys within a chain */
@@ -1327,7 +1327,7 @@ bool SdrObjEditView::KeyInput(const KeyEvent& rKEvt, vcl::Window* pWin)
 
             /* Start chaining processing */
             ImpChainingEventHdl();
-            ImpMoveCursorAfterChainingEvent(pCursorManager);
+            ImpMoveCursorAfterChainingEvent(xCursorManager.get());
             /* End chaining processing */
 
             if (pWin!=NULL && pWin!=pTextEditWin) SetTextEditWin(pWin);
commit 8a7dfe0fa51730ea7276a28a524395c989fb7e37
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:15:28 2015 +0100

    coverity#1325065 Resource leak
    
    Change-Id: I87550b4972f65a34632f0cfe02eba1dc9fe22640

diff --git a/svx/source/svdraw/svdedxv.cxx b/svx/source/svdraw/svdedxv.cxx
index ce29308..042fa2e 100644
--- a/svx/source/svdraw/svdedxv.cxx
+++ b/svx/source/svdraw/svdedxv.cxx
@@ -556,8 +556,8 @@ IMPL_LINK_NOARG_TYPED(SdrObjEditView,ImpAfterCutOrPasteChainingEventHdl, LinkPar
     if (!pTextObj)
         return;
     ImpChainingEventHdl();
-    TextChainCursorManager *pCursorManager = new TextChainCursorManager(this, pTextObj);
-    ImpMoveCursorAfterChainingEvent(pCursorManager);
+    TextChainCursorManager aCursorManager(this, pTextObj);
+    ImpMoveCursorAfterChainingEvent(&aCursorManager);
 }
 
 void SdrObjEditView::ImpMoveCursorAfterChainingEvent(TextChainCursorManager *pCursorManager)
commit d6377753ef481de643ce77db2d977177b67eb0cb
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:13:18 2015 +0100

    coverit#1325064 Resource leak
    
    Change-Id: Iaf0798fdddf38698816dba6a1c512d8ce3a4db39

diff --git a/svx/source/svdraw/textchainflow.cxx b/svx/source/svdraw/textchainflow.cxx
index c8de6c6..cfdb6ce 100644
--- a/svx/source/svdraw/textchainflow.cxx
+++ b/svx/source/svdraw/textchainflow.cxx
@@ -160,9 +160,9 @@ bool TextChainFlow::IsUnderflow() const
 // XXX:Would it be possible to unify undeflow and its possibly following overrflow?
 void TextChainFlow::ExecuteUnderflow(SdrOutliner *pOutl)
 {
-
     //GetTextChain()->SetNilChainingEvent(mpTargetLink, true);
     // making whole text
+    bool bNewTextTransferred = false;
     OutlinerParaObject *pNewText = impGetMergedUnderflowParaObject(pOutl);
 
     // Set the other box empty; it will be replaced by the rest of the text if overflow occurs
@@ -174,13 +174,18 @@ void TextChainFlow::ExecuteUnderflow(SdrOutliner *pOutl)
 
     // This should not be done in editing mode!! //XXX
     if (!mpTargetLink->IsInEditMode())
+    {
         mpTargetLink->NbcSetOutlinerParaObject(pNewText);
+        bNewTextTransferred = true;
+    }
 
     // Restore size and set new text
     //pOutl->SetMaxAutoPaperSize(aOldSize); // XXX (it seems to be working anyway without this)
     pOutl->SetText(*pNewText);
 
     //GetTextChain()->SetNilChainingEvent(mpTargetLink, false);
+    if (!bNewTextTransferred)
+        delete pNewText;
 
     // Check for new overflow
     CheckForFlowEvents(pOutl);
commit d643165f8161fbc4d2ade3a0f315565a87da0d63
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:09:58 2015 +0100

    coverity#1325063 Resource leak
    
    Change-Id: I45f4f770a64d27ee5f5b323fa7079958b224fbac

diff --git a/vcl/source/gdi/bitmap3.cxx b/vcl/source/gdi/bitmap3.cxx
index 7bca988..9afad3f 100644
--- a/vcl/source/gdi/bitmap3.cxx
+++ b/vcl/source/gdi/bitmap3.cxx
@@ -1121,8 +1121,9 @@ bool Bitmap::ImplScaleFast( const double& rScaleX, const double& rScaleY )
                     }
 
                     bRet = true;
-                    ReleaseAccess( pWriteAcc );
                 }
+
+                ReleaseAccess( pWriteAcc );
             }
             ReleaseAccess( pReadAcc );
 
commit b62ff0cd434f0044b4becb8c5fdf72fe7e70aea6
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:08:51 2015 +0100

    coverity#1325062 Resource leak
    
    Change-Id: I111b7d2f9fc0a15c07b2393acefde26e54065dc1

diff --git a/vcl/source/gdi/bitmap3.cxx b/vcl/source/gdi/bitmap3.cxx
index 643f46b..7bca988 100644
--- a/vcl/source/gdi/bitmap3.cxx
+++ b/vcl/source/gdi/bitmap3.cxx
@@ -2610,9 +2610,11 @@ bool Bitmap::Adjust( short nLuminancePercent, short nContrastPercent,
 
 bool Bitmap::ImplConvolutionPass(Bitmap& aNewBitmap, BitmapReadAccess* pReadAcc, int aNumberOfContributions, double* pWeights, int* pPixels, int* pCount)
 {
-    BitmapWriteAccess* pWriteAcc = aNewBitmap.AcquireWriteAccess();
+    if (!pReadAcc)
+        return false;
 
-    if (!pReadAcc || !pWriteAcc)
+    BitmapWriteAccess* pWriteAcc = aNewBitmap.AcquireWriteAccess();
+    if (!pWriteAcc)
         return false;
 
     const int nHeight = GetSizePixel().Height();
commit 966f51376b593fea9417d6f6800e574f0672dd11
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:07:50 2015 +0100

    coverity#1325061 Resource leak
    
    Change-Id: If680e1f9236ab6c1eb43f3d234cf36ef00442079

diff --git a/vcl/unx/generic/gdi/salbmp.cxx b/vcl/unx/generic/gdi/salbmp.cxx
index 8204449..8487b5e 100644
--- a/vcl/unx/generic/gdi/salbmp.cxx
+++ b/vcl/unx/generic/gdi/salbmp.cxx
@@ -553,15 +553,15 @@ XImage* X11SalBitmap::ImplCreateXImage(
 #endif
                 // set data in buffer as data member in pImage
                 pImage->data = reinterpret_cast<char*>(pDstBuf->mpBits);
-
-                // destroy buffer; don't destroy allocated data in buffer
-                delete pDstBuf;
             }
             else
             {
                 XDestroyImage( pImage );
                 pImage = NULL;
             }
+
+            // destroy buffer; doesn't destroy allocated data in buffer
+            delete pDstBuf;
         }
     }
 
commit ebce6f0bb7b0320391c1e3d9d54dd29014c5d39e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:04:52 2015 +0100

    coverity#1325058 Dereference after null check
    
    Change-Id: I6290ab4a5951ada1588b9b7641b7e047cc82a9ee

diff --git a/sc/source/ui/view/editsh.cxx b/sc/source/ui/view/editsh.cxx
index c225286..9b1f66c 100644
--- a/sc/source/ui/view/editsh.cxx
+++ b/sc/source/ui/view/editsh.cxx
@@ -334,7 +334,7 @@ void ScEditShell::Execute( SfxRequest& rReq )
             return;
         case SID_UNICODE_NOTATION_TOGGLE:
             {
-                EditView* pActiveView = pHdl ? pHdl->GetActiveView() : pEditView;
+                EditView* pActiveView = pHdl->GetActiveView();
                 if( pActiveView )
                 {
                     OUString sInput = pEngine->GetText();
commit 41df45af6ae710c0dc6077b2e232f36d561fe975
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 10:02:39 2015 +0100

    coverity#1325057 Dereference after null check
    
    Change-Id: I561751aa08831d65dd1762ffcd80b4ae9ff04a7d

diff --git a/svx/source/svdraw/svdedxv.cxx b/svx/source/svdraw/svdedxv.cxx
index ad9c7f5..ce29308 100644
--- a/svx/source/svdraw/svdedxv.cxx
+++ b/svx/source/svdraw/svdedxv.cxx
@@ -517,13 +517,14 @@ void SdrObjEditView::ImpChainingEventHdl()
             // Handling Undo
             const int nText = 0; // XXX: hardcoded index (SdrTextObj::getText handles only 0)
 
-            SdrUndoObjSetText *pTxtUndo  = dynamic_cast< SdrUndoObjSetText* >
-                ( GetModel()->GetSdrUndoFactory().CreateUndoObjectSetText(*pTextObj, nText ) );
+            const bool bUndoEnabled = GetModel() && IsUndoEnabled();
+            SdrUndoObjSetText *pTxtUndo = bUndoEnabled ? dynamic_cast< SdrUndoObjSetText* >
+                ( GetModel()->GetSdrUndoFactory().CreateUndoObjectSetText(*pTextObj, nText ) ) : nullptr;
 
             // trigger actual chaining
             pTextObj->onChainingEvent();
 
-           if (pTxtUndo!=NULL)
+            if (pTxtUndo)
             {
                 pTxtUndo->AfterSetText();
                 if (!pTxtUndo->IsDifferent())
@@ -846,7 +847,7 @@ bool SdrObjEditView::SdrBeginTextEdit(
             if( mxSelectionController.is() )
                 mxSelectionController->onSelectionHasChanged();
 
-            if(IsUndoEnabled() && GetModel() && !GetModel()->GetDisableTextEditUsesCommonUndoManager())
+            if (GetModel() && IsUndoEnabled() && !GetModel()->GetDisableTextEditUsesCommonUndoManager())
             {
                 SdrUndoManager* pSdrUndoManager = getSdrUndoManagerForEnhancedTextEdit();
 
@@ -926,7 +927,7 @@ SdrEndTextEditKind SdrObjEditView::SdrEndTextEdit(bool bDontDeleteReally)
     SdrUndoManager* pUndoEditUndoManager = 0;
     bool bNeedToUndoSavedRedoTextEdit(false);
 
-    if(IsUndoEnabled() && GetModel() && pTEObj && pTEOutliner && !GetModel()->GetDisableTextEditUsesCommonUndoManager())
+    if (GetModel() && IsUndoEnabled() && pTEObj && pTEOutliner && !GetModel()->GetDisableTextEditUsesCommonUndoManager())
     {
         // change back the UndoManager to the remembered original one
         ::svl::IUndoManager* pOriginal = pTEOutliner->SetUndoManager(mpOldTextEditUndoManager);
commit 0c4baf56147ac9f39b190d2468ac3aafdf5aac41
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 09:51:31 2015 +0100

    coverity#1325056 Unchecked dynamic_cast
    
    Change-Id: I34989b976f06627ce38cb7db11a96b85b1b89b4e

diff --git a/svx/source/svdraw/svdedxv.cxx b/svx/source/svdraw/svdedxv.cxx
index 3efb93b..ad9c7f5 100644
--- a/svx/source/svdraw/svdedxv.cxx
+++ b/svx/source/svdraw/svdedxv.cxx
@@ -1283,10 +1283,11 @@ TextChainCursorManager *SdrObjEditView::ImpHandleMotionThroughBoxesKeyInput(
 {
     *bOutHandled = false;
 
-    SdrTextObj* pTextObj = NULL;
-    if (mxTextEditObj.is())
-        pTextObj= dynamic_cast<SdrTextObj*>(mxTextEditObj.get());
-    else
+    if (!mxTextEditObj.is())
+        return NULL;
+
+    SdrTextObj* pTextObj = dynamic_cast<SdrTextObj*>(mxTextEditObj.get());
+    if (!pTextObj)
         return NULL;
 
     if (!pTextObj->GetNextLinkInChain() && !pTextObj->GetPrevLinkInChain())
@@ -1302,8 +1303,6 @@ TextChainCursorManager *SdrObjEditView::ImpHandleMotionThroughBoxesKeyInput(
     return pCursorManager;
 }
 
-
-
 bool SdrObjEditView::KeyInput(const KeyEvent& rKEvt, vcl::Window* pWin)
 {
     if(pTextEditOutlinerView)
commit 4121fc92065ce9422d8029adba323a29605c3096
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 09:50:18 2015 +0100

    coverity#1325055 Unchecked dynamic_cast
    
    Change-Id: Ib4017c3e771ed62a92328aced105c70159a2f1e2

diff --git a/svx/source/svdraw/svdedxv.cxx b/svx/source/svdraw/svdedxv.cxx
index 9c88120..3efb93b 100644
--- a/svx/source/svdraw/svdedxv.cxx
+++ b/svx/source/svdraw/svdedxv.cxx
@@ -567,13 +567,12 @@ void SdrObjEditView::ImpMoveCursorAfterChainingEvent(TextChainCursorManager *pCu
     SdrTextObj* pTextObj = dynamic_cast<SdrTextObj*>(mxTextEditObj.get());
 
     // Check if it has links to move it to
-    if (!pTextObj->IsChainable())
+    if (!pTextObj || !pTextObj->IsChainable())
         return;
 
     TextChain *pTextChain = pTextObj->GetTextChain();
     ESelection aNewSel = pTextChain->GetPostChainingSel(pTextObj);
 
-
     pCursorManager->HandleCursorEventAfterChaining(
         pTextChain->GetCursorEvent(pTextObj),
         aNewSel);
commit a796b2ba09087dcdd6df45b20bd8703d85f2726b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 09:49:20 2015 +0100

    coverity#1325054 Explicit null dereferenced
    
    Change-Id: I1378d822e03218a3a4c2ae1d08b11a00b15287f6

diff --git a/sw/source/core/doc/tblrwcl.cxx b/sw/source/core/doc/tblrwcl.cxx
index acc2d8e..b4abdb8 100644
--- a/sw/source/core/doc/tblrwcl.cxx
+++ b/sw/source/core/doc/tblrwcl.cxx
@@ -3856,7 +3856,7 @@ bool SwTable::SetColWidth( SwTableBox& rAktBox, sal_uInt16 eType,
 
         xFndBox.reset();
 
-        if( ppUndo && *ppUndo )
+        if (ppUndo && *ppUndo && aParam.pUndo)
         {
             aParam.pUndo->SetColWidthParam( nBoxIdx, static_cast<sal_uInt16>(eTableChgMode), eType,
                                             nAbsDiff, nRelDiff );
commit 4a031d7c971558f89693925bb504c1157ab6bd04
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 09:41:01 2015 +0100

    coverity#1325053 Dereference after null check
    
    pre-change !pSh logic inverted at
    
    commit 1b15f4863e6d4b0a280ccd61713cbb1209ffe33e
    Author: Miklos Vajna <vmiklos at collabora.co.uk>
    Date:   Fri Feb 6 12:12:02 2015 +0100
    
        LOK: add LOK_CALLBACK_TEXT_SELECTION and implement it in sw
    
        Change-Id: I31662cb06add0d1a1c517b5f5416703aeaae1e77
    
    Change-Id: If42741c4efce943aaff5081a1a75108470b2a488

diff --git a/sw/source/core/layout/trvlfrm.cxx b/sw/source/core/layout/trvlfrm.cxx
index 381df40..f71639e 100644
--- a/sw/source/core/layout/trvlfrm.cxx
+++ b/sw/source/core/layout/trvlfrm.cxx
@@ -2018,7 +2018,7 @@ void SwRootFrm::CalcFrmRects(SwShellCrsr &rCrsr)
 
     SwViewShell *pSh = GetCurrShell();
 
-    bool bIgnoreVisArea = false;
+    bool bIgnoreVisArea = true;
     if (pSh)
         bIgnoreVisArea = pSh->GetViewOptions()->IsPDFExport() || pSh->isTiledRendering();
 
commit b72eea1dbf5bd3b9f6972b37a776cbc34dc59859
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 09:37:49 2015 +0100

    coverity#1325052 Logically dead code
    
    since
    
    commit 984780243c9a1ab1242f3af719c6dca3ddacf67a
    Author: Stephan Bergmann <sbergman at redhat.com>
    Date:   Thu Sep 17 19:15:26 2015 +0200
    
        HEADER_FIELD_TEXT is the only used HeaderFieldType
    
        Change-Id: Ia4e5554e1aaed9e821bdea18b9b3acff001dd6e7
    
    Change-Id: Id56790fd5c953d4d7f4a235c7d016c807ff37038

diff --git a/tools/source/inet/inetmime.cxx b/tools/source/inet/inetmime.cxx
index 16c7d2a..afdfdf7 100644
--- a/tools/source/inet/inetmime.cxx
+++ b/tools/source/inet/inetmime.cxx
@@ -2426,7 +2426,6 @@ OUString INetMIME::decodeHeaderFieldBody(const OString& rBody)
 
     /* bool bStartEncodedWord = true; */
     const sal_Char * pWSPBegin = pBegin;
-    sal_uInt32 nCommentLevel = 0;
 
     for (const sal_Char * p = pBegin; p != pEnd;)
     {
@@ -2704,8 +2703,6 @@ OUString INetMIME::decodeHeaderFieldBody(const OString& rBody)
                 break;
 
             case ')':
-                if (nCommentLevel > 0)
-                    --nCommentLevel;
                 /* bStartEncodedWord = false; */
                 break;
 
commit 1f1b1609029f4358f6b2dc3004ab256dbc3f49af
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 09:36:34 2015 +0100

    coverity#1325051 Logically dead code
    
    since
    
    commit 984780243c9a1ab1242f3af719c6dca3ddacf67a
    Author: Stephan Bergmann <sbergman at redhat.com>
    Date:   Thu Sep 17 19:15:26 2015 +0200
    
        HEADER_FIELD_TEXT is the only used HeaderFieldType
    
        Change-Id: Ia4e5554e1aaed9e821bdea18b9b3acff001dd6e7
    
    Change-Id: I94a1cba6e9813b7192a03ea59948bb40438c341b

diff --git a/tools/source/inet/inetmime.cxx b/tools/source/inet/inetmime.cxx
index e8a5053..16c7d2a 100644
--- a/tools/source/inet/inetmime.cxx
+++ b/tools/source/inet/inetmime.cxx
@@ -2426,7 +2426,6 @@ OUString INetMIME::decodeHeaderFieldBody(const OString& rBody)
 
     /* bool bStartEncodedWord = true; */
     const sal_Char * pWSPBegin = pBegin;
-    bool bQuotedEncodedText = false;
     sal_uInt32 nCommentLevel = 0;
 
     for (const sal_Char * p = pBegin; p != pEnd;)
@@ -2689,30 +2688,7 @@ OUString INetMIME::decodeHeaderFieldBody(const OString& rBody)
         }
 
         if (!sEncodedText.isEmpty())
-        {
-            if (bQuotedEncodedText)
-            {
-                sDecoded += "\"";
-                const sal_Unicode * pTextPtr = sEncodedText.getStr();
-                const sal_Unicode * pTextEnd = pTextPtr + sEncodedText.getLength();
-                for (;pTextPtr != pTextEnd; ++pTextPtr)
-                {
-                    switch (*pTextPtr)
-                    {
-                        case '"':
-                        case '\\':
-                        case '\x0D':
-                            sDecoded += "\\";
-                            break;
-                    }
-                    sDecoded += OUString(*pTextPtr);
-                }
-                sDecoded += "\"";
-            }
-            else
-                sDecoded += sEncodedText;
-            bQuotedEncodedText = false;
-        }
+            sDecoded += sEncodedText;
 
         if (p == pEnd)
             break;
commit 259fb99d340b17de056faeab5870b7927426864e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 09:34:07 2015 +0100

    coverity#1325050 Resource leak in object
    
    Change-Id: Ifb049feb653d1c345b3d40226e9afb1db877e6a0

diff --git a/editeng/source/outliner/overflowingtxt.cxx b/editeng/source/outliner/overflowingtxt.cxx
index 995216f..945a845 100644
--- a/editeng/source/outliner/overflowingtxt.cxx
+++ b/editeng/source/outliner/overflowingtxt.cxx
@@ -193,6 +193,13 @@ OFlowChainedText::OFlowChainedText(Outliner *pOutl, bool bIsDeepMerge)
     mbIsDeepMerge = bIsDeepMerge;
 }
 
+OFlowChainedText::~OFlowChainedText()
+{
+    delete mpNonOverflowingTxt;
+    delete mpOverflowingTxt;
+}
+
+
 ESelection OFlowChainedText::GetInsertionPointSel()
 {
     return OverflowingText::GetInsertionPointSel();
commit f1a9c5276d46988e9fb15943e7b019c224d5ad47
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 09:30:29 2015 +0100

    coverity#1242704 Untrusted loop bound
    
    Change-Id: Id8a80028ad00ec7ae79eaa9d877a1fef9f4d082c

diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index 9e446c0..463e8a8 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -643,7 +643,12 @@ void WMFReader::ReadRecordParams( sal_uInt16 nFunc )
             Point aPoint( ReadYX() );
             pWMF->ReadUInt16( nDontKnow ).ReadUInt16( nWidth ).ReadUInt16( nHeight ).ReadUInt16( nBytesPerScan ).ReadUChar( nPlanes ).ReadUChar( nBitCount );
 
-            if ( nWidth && nHeight && ( nPlanes == 1 ) && ( nBitCount == 1 ) )
+            bool bOk = nWidth && nHeight && nPlanes == 1 && nBitCount == 1;
+            if (bOk)
+            {
+                bOk = nBytesPerScan <= pWMF->remainingSize() / nHeight;
+            }
+            if (bOk)
             {
                 Bitmap aBmp( Size( nWidth, nHeight ), nBitCount );
                 BitmapWriteAccess* pAcc;
commit 7be2fba41dfb184a0bf6f5c7f197e2222d43f3e8
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 09:17:27 2015 +0100

    coverity#708213 ditch the empty ctor/dtors
    
    which should silence
    
    "708213 Uninitialized pointer field"
    
    Change-Id: I0e16a0b02f3d48c4da324f371cae2234ad4cb6e2

diff --git a/include/vcl/salbtype.hxx b/include/vcl/salbtype.hxx
index 82ae036..9f2dd65 100644
--- a/include/vcl/salbtype.hxx
+++ b/include/vcl/salbtype.hxx
@@ -109,8 +109,6 @@ public:
     inline              BitmapColor( const Color& rColor );
     explicit inline     BitmapColor( sal_uInt8 cIndex );
 
-    inline              ~BitmapColor() {};
-
     inline bool         operator==( const BitmapColor& rBitmapColor ) const;
     inline bool         operator!=( const BitmapColor& rBitmapColor ) const;
 
@@ -246,8 +244,6 @@ public:
     {
     }
 
-    ~ColorMask() {}
-
     inline sal_uInt32   GetRedMask() const;
     inline sal_uInt32   GetGreenMask() const;
     inline sal_uInt32   GetBlueMask() const;
@@ -279,9 +275,6 @@ struct VCL_DLLPUBLIC BitmapBuffer
     ColorMask       maColorMask;
     BitmapPalette   maPalette;
     sal_uInt8*      mpBits;
-
-                    BitmapBuffer(){}
-                    ~BitmapBuffer() {}
 };
 
 // - Access modes -
commit d654c1195450f21e112adbb76b8a13b3b09dfa73
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 09:10:40 2015 +0100

    coverity#705736 Resource leak
    
    Change-Id: I124f75e56aad1bd5008a7d9d64328b0e6e5f874c

diff --git a/svx/source/xoutdev/xattrbmp.cxx b/svx/source/xoutdev/xattrbmp.cxx
index b4cdfe3..bfc06ca 100644
--- a/svx/source/xoutdev/xattrbmp.cxx
+++ b/svx/source/xoutdev/xattrbmp.cxx
@@ -248,6 +248,8 @@ Bitmap createHistorical8x8FromArray(const sal_uInt16* pArray, Color aColorPix, C
 
 bool isHistorical8x8(const BitmapEx& rBitmapEx, BitmapColor& o_rBack, BitmapColor& o_rFront)
 {
+    bool bRet(false);
+
     if(!rBitmapEx.IsTransparent())
     {
         Bitmap aBitmap(rBitmapEx.GetBitmap());
@@ -269,14 +271,16 @@ bool isHistorical8x8(const BitmapEx& rBitmapEx, BitmapColor& o_rBack, BitmapColo
                         o_rFront = rPalette[1];
                         o_rBack = rPalette[0];
 
-                        return true;
+                        bRet = true;
                     }
+
+                    Bitmap::ReleaseAccess(pRead);
                 }
             }
         }
     }
 
-    return false;
+    return bRet;
 }
 
 XFillBitmapItem::XFillBitmapItem(SvStream& rIn, sal_uInt16 nVer)
commit 92ffbf51b3d74ceb45e473db84a7493e1219b7c4
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 29 09:08:10 2015 +0100

    coverity#705735 Resource leak
    
    Change-Id: I7d79c1332b6acde722d6134fcfe64b4333a4c2b9

diff --git a/svx/source/xoutdev/_xoutbmp.cxx b/svx/source/xoutdev/_xoutbmp.cxx
index 3993018..54cfc76 100644
--- a/svx/source/xoutdev/_xoutbmp.cxx
+++ b/svx/source/xoutdev/_xoutbmp.cxx
@@ -477,7 +477,7 @@ Bitmap XOutBitmap::DetectEdges( const Bitmap& rBmp, const sal_uInt8 cThreshold )
     }
 
     return aRetBmp;
-};
+}
 
 tools::Polygon XOutBitmap::GetCountour( const Bitmap& rBmp, const sal_uIntPtr nFlags,
                                         const sal_uInt8 cEdgeDetectThreshold,
@@ -610,10 +610,12 @@ tools::Polygon XOutBitmap::GetCountour( const Bitmap& rBmp, const sal_uIntPtr nF
             if( ( fFactorX != 0. ) && ( fFactorY != 0. ) )
                 aRetPoly.Scale( fFactorX, fFactorY );
         }
+
+        Bitmap::ReleaseAccess(pAcc);
     }
 
     return aRetPoly;
-};
+}
 
 bool DitherBitmap( Bitmap& rBitmap )
 {


More information about the Libreoffice-commits mailing list