[Libreoffice-commits] core.git: Branch 'distro/collabora/cp-5.1' - 23 commits - configure.ac cui/uiconfig download.lst editeng/source embeddedobj/source external/lcms2 include/svx odk/settings sc/inc sc/source sd/source svx/source sw/inc sw/qa sw/source sw/uiconfig vcl/inc vcl/source writerfilter/qa writerfilter/source

Andras Timar andras.timar at collabora.com
Tue Sep 20 21:11:05 UTC 2016


 configure.ac                                                     |    2 
 cui/uiconfig/ui/textflowpage.ui                                  |    5 
 download.lst                                                     |    4 
 editeng/source/misc/svxacorr.cxx                                 |    5 
 embeddedobj/source/commonembedding/visobj.cxx                    |    6 
 embeddedobj/source/general/docholder.cxx                         |   11 +
 external/lcms2/0001-Added-an-extra-check-to-MLU-bounds.patch.1   |   25 ++
 external/lcms2/UnpackedTarball_lcms2.mk                          |    1 
 include/svx/svdoole2.hxx                                         |   16 +
 odk/settings/settings.mk                                         |   10 -
 sc/inc/documentlinkmgr.hxx                                       |    5 
 sc/source/core/data/column2.cxx                                  |    4 
 sc/source/core/tool/interpr2.cxx                                 |   22 +-
 sc/source/ui/docshell/docsh.cxx                                  |    7 
 sc/source/ui/docshell/docsh4.cxx                                 |   12 +
 sc/source/ui/docshell/documentlinkmgr.cxx                        |   26 ++-
 sc/source/ui/view/tabvwsh4.cxx                                   |    2 
 sd/source/core/drawdoc.cxx                                       |    6 
 sd/source/ui/docshell/docshel4.cxx                               |    5 
 svx/source/svdraw/svdoole2.cxx                                   |   18 --
 svx/source/unodraw/unoshap4.cxx                                  |    4 
 sw/inc/IDocumentLinksAdministration.hxx                          |    2 
 sw/qa/core/data/rtf/fail/table-2.rtf                             |binary
 sw/source/core/doc/DocumentLinksAdministrationManager.cxx        |   85 +++++-----
 sw/source/core/inc/DocumentLinksAdministrationManager.hxx        |    2 
 sw/source/core/unocore/unosett.cxx                               |    2 
 sw/source/core/unocore/unotext.cxx                               |    2 
 sw/source/filter/basflt/shellio.cxx                              |    2 
 sw/source/filter/html/css1atr.cxx                                |    6 
 sw/source/uibase/app/docsh.cxx                                   |    2 
 sw/source/uibase/app/docshini.cxx                                |    3 
 sw/uiconfig/swriter/toolbar/changes.xml                          |   24 +-
 sw/uiconfig/swriter/ui/charurlpage.ui                            |   12 +
 vcl/inc/helpwin.hxx                                              |    1 
 vcl/source/app/help.cxx                                          |   11 +
 writerfilter/qa/cppunittests/rtftok/data/fail/propheight-1.rtf   |binary
 writerfilter/qa/cppunittests/rtftok/data/fail/tablemanager-6.rtf |binary
 writerfilter/qa/cppunittests/rtftok/data/fail/tablemanager-7.rtf |binary
 writerfilter/qa/cppunittests/rtftok/data/pass/parser-state-1.rtf |binary
 writerfilter/qa/cppunittests/rtftok/data/pass/valuelist-1.rtf    |binary
 writerfilter/source/dmapper/DomainMapper_Impl.cxx                |    4 
 writerfilter/source/dmapper/NumberingManager.cxx                 |   11 -
 writerfilter/source/dmapper/PropertyMap.cxx                      |    2 
 writerfilter/source/rtftok/rtfdocumentimpl.cxx                   |   15 -
 writerfilter/source/rtftok/rtfdocumentimpl.hxx                   |    3 
 writerfilter/source/rtftok/rtftokenizer.cxx                      |    2 
 46 files changed, 263 insertions(+), 124 deletions(-)

New commits:
commit 006c01038db88afa045efa12d5b778830a285ef7
Author: Andras Timar <andras.timar at collabora.com>
Date:   Tue Sep 20 23:09:52 2016 +0200

    Bump version to 5.1-7
    
    Change-Id: Ib204a5f7bb985a946ead74fcd47b29bc92835d81

diff --git a/configure.ac b/configure.ac
index a5cc28c..0b1097a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -9,7 +9,7 @@ dnl in order to create a configure script.
 # several non-alphanumeric characters, those are split off and used only for the
 # ABOUTBOXPRODUCTVERSIONSUFFIX in openoffice.lst. Why that is necessary, no idea.
 
-AC_INIT([Collabora Office],[5.1.10.6],[],[],[https://collaboraoffice.com/])
+AC_INIT([Collabora Office],[5.1.10.7],[],[],[https://collaboraoffice.com/])
 
 AC_PREREQ([2.59])
 
commit 20ad6a7d62c70f6fa031d363084ecf655f1354d9
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 13 12:32:04 2016 +0100

    disable generation of ole previews in ODF format until after load
    
    so the user update links dialog can control their generation
    
    SdrEmbedObjectLink becomes exposed to calc so it can
    detect if the link dialog needs to be used to update
    ole links.
    
    Reviewed-on: https://gerrit.libreoffice.org/28879
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 74844277cc2194c9e43f5bd7a6f78a9603da32f3)
    
    detangle gadzillion checks into something readable
    
    no logic change intended
    
    (cherry picked from commit fad9786b06d188ba6e354620f57176f3d94a6637)
    
    + partial merge of
    
    commit c09b3e32372537be739182b02ae83a96386d1e1c
    Author: Noel Grandin <noel at peralex.com>
    Date:   Tue Mar 8 13:13:59 2016 +0200
    
        loplugin:constantparam in sw
    
    for bool bUI is always true in UpdateLinks
    
    Unmodified default SdrOle2Obj size is 101x101
    
    svx/source/unodraw/unoshape.cxx
    
    sets a css::awt::Size maSize to 100, 100
    
    svx/source/unodraw/unopage.cxx
    
    increases that by 1, 1
    
    awt::Size aSize = xShape->getSize();
    aSize.Width += 1;
    aSize.Height += 1;
    
    to call SdrObjFactory::MakeNewObject with 101, 101
    so default size is 101x101 (getWidth() vs GetWidth() confusion ?)
    
    Reviewed-on: https://gerrit.libreoffice.org/28895
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 7f0a219c9ad38ae33b51ff69d545f69659691c1e)
    
    b6af93afc1f80b7fc36239c96d5e0a71fcbcb789
    4d4375dff64d7b8e236d1a24322e749e04ee530f
    Reviewed-on: https://gerrit.libreoffice.org/28930
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>
    
    (cherry picked from commit 2ff4c68b63c4842ec85a21287317096b6ca8e66e)
    
    Change-Id: Id1dd7ea17342140eab9307d546528747e3a98090

diff --git a/embeddedobj/source/commonembedding/visobj.cxx b/embeddedobj/source/commonembedding/visobj.cxx
index fea7c3a..3ee8585 100644
--- a/embeddedobj/source/commonembedding/visobj.cxx
+++ b/embeddedobj/source/commonembedding/visobj.cxx
@@ -174,7 +174,11 @@ embed::VisualRepresentation SAL_CALL OCommonEmbeddedObject::getPreferredVisualRe
     bool bBackToLoaded = false;
     if ( m_nObjectState == embed::EmbedStates::LOADED )
     {
-        changeState( embed::EmbedStates::RUNNING );
+        awt::Size aOrigSize = getVisualAreaSize(nAspect);
+        changeState(embed::EmbedStates::RUNNING);
+        awt::Size aNewSize = getVisualAreaSize(nAspect);
+        if (aOrigSize.Width != aNewSize.Width || aOrigSize.Height != aNewSize.Height)
+            setVisualAreaSize(nAspect, aOrigSize);
 
         // the links should be switched back to loaded state for now to avoid locking problems
         bBackToLoaded = m_bIsLink;
diff --git a/include/svx/svdoole2.hxx b/include/svx/svdoole2.hxx
index 2d0b49d..239284b 100644
--- a/include/svx/svdoole2.hxx
+++ b/include/svx/svdoole2.hxx
@@ -22,6 +22,7 @@
 
 #include <svx/svdorect.hxx>
 #include <svx/svxdllapi.h>
+#include <sfx2/linkmgr.hxx>
 
 #include <com/sun/star/uno/Reference.h>
 
@@ -176,6 +177,21 @@ public:
     virtual SdrObject* DoConvertToPolyObj(bool bBezier, bool bAddText) const override;
 };
 
+class SVX_DLLPUBLIC SdrEmbedObjectLink : public sfx2::SvBaseLink
+{
+    SdrOle2Obj*         pObj;
+
+public:
+    explicit            SdrEmbedObjectLink(SdrOle2Obj* pObj);
+    virtual             ~SdrEmbedObjectLink();
+
+    virtual void        Closed() override;
+    virtual ::sfx2::SvBaseLink::UpdateResult DataChanged(
+        const OUString& rMimeType, const css::uno::Any & rValue ) override;
+
+    bool                Connect() { return GetRealObject() != nullptr; }
+};
+
 #endif // INCLUDED_SVX_SVDOOLE2_HXX
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sc/inc/documentlinkmgr.hxx b/sc/inc/documentlinkmgr.hxx
index 3f9cc0c..a50175f 100644
--- a/sc/inc/documentlinkmgr.hxx
+++ b/sc/inc/documentlinkmgr.hxx
@@ -54,14 +54,17 @@ public:
     bool idleCheckLinks();
 
     bool hasDdeLinks() const;
+    bool hasDdeOrOleLinks() const;
 
-    bool updateDdeLinks( vcl::Window* pWin );
+    bool updateDdeOrOleLinks(vcl::Window* pWin);
 
     bool updateDdeLink( const OUString& rAppl, const OUString& rTopic, const OUString& rItem );
 
     size_t getDdeLinkCount() const;
 
     void disconnectDdeLinks();
+private:
+    bool hasDdeOrOleLinks(bool bDde, bool bOle) const;
 };
 
 }
diff --git a/sc/source/ui/docshell/docsh.cxx b/sc/source/ui/docshell/docsh.cxx
index 73936d6..35af076 100644
--- a/sc/source/ui/docshell/docsh.cxx
+++ b/sc/source/ui/docshell/docsh.cxx
@@ -560,9 +560,12 @@ bool ScDocShell::Load( SfxMedium& rMedium )
 
     GetUndoManager()->Clear();
 
-    bool bRet = SfxObjectShell::Load( rMedium );
-    if( bRet )
+    bool bRet = SfxObjectShell::Load(rMedium);
+    if (bRet)
     {
+        comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = getEmbeddedObjectContainer();
+        rEmbeddedObjectContainer.setUserAllowsLinkUpdate(false);
+
         if (GetMedium())
         {
             const SfxUInt16Item* pUpdateDocItem = SfxItemSet::GetItem<SfxUInt16Item>(rMedium.GetItemSet(), SID_UPDATEDOCMODE, false);
diff --git a/sc/source/ui/docshell/docsh4.cxx b/sc/source/ui/docshell/docsh4.cxx
index 4228d8a..d233649 100644
--- a/sc/source/ui/docshell/docsh4.cxx
+++ b/sc/source/ui/docshell/docsh4.cxx
@@ -29,6 +29,7 @@ using namespace ::com::sun::star;
 
 #include "scitems.hxx"
 #include <sfx2/fcontnr.hxx>
+#include <sfx2/linkmgr.hxx>
 #include <sfx2/objface.hxx>
 #include <sfx2/docfile.hxx>
 #include <svtools/ehdl.hxx>
@@ -42,6 +43,7 @@ using namespace ::com::sun::star;
 #include <svx/drawitem.hxx>
 #include <svx/fmshell.hxx>
 #include <svtools/xwindowitem.hxx>
+#include <svx/svdoole2.hxx>
 #include <sfx2/passwd.hxx>
 #include <sfx2/filedlghelper.hxx>
 #include <sfx2/dispatch.hxx>
@@ -410,6 +412,9 @@ void ScDocShell::Execute( SfxRequest& rReq )
             break;
         case SID_UPDATETABLINKS:
             {
+                comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = getEmbeddedObjectContainer();
+                rEmbeddedObjectContainer.setUserAllowsLinkUpdate(true);
+
                 ScDocument& rDoc = GetDocument();
 
                 ScLkUpdMode nSet = rDoc.GetLinkMode();
@@ -453,9 +458,9 @@ void ScDocShell::Execute( SfxRequest& rReq )
                     ReloadTabLinks();
                     aDocument.UpdateExternalRefLinks(GetActiveDialogParent());
 
-                    bool bAny = aDocument.GetDocLinkManager().updateDdeLinks(GetActiveDialogParent());
+                    bool bAnyDde = aDocument.GetDocLinkManager().updateDdeOrOleLinks(GetActiveDialogParent());
 
-                    if (bAny)
+                    if (bAnyDde)
                     {
                         //  Formeln berechnen und painten wie im TrackTimeHdl
                         aDocument.TrackFormulas();
@@ -471,7 +476,10 @@ void ScDocShell::Execute( SfxRequest& rReq )
                     rReq.Done();
                 }
                 else
+                {
+                    rEmbeddedObjectContainer.setUserAllowsLinkUpdate(false);
                     rReq.Ignore();
+                }
             }
             break;
 
diff --git a/sc/source/ui/docshell/documentlinkmgr.cxx b/sc/source/ui/docshell/documentlinkmgr.cxx
index 9609781..069d39c 100644
--- a/sc/source/ui/docshell/documentlinkmgr.cxx
+++ b/sc/source/ui/docshell/documentlinkmgr.cxx
@@ -23,7 +23,7 @@
 #include <sc.hrc>
 #include <scresid.hxx>
 
-#include <sfx2/linkmgr.hxx>
+#include <svx/svdoole2.hxx>
 #include <vcl/layout.hxx>
 
 #include <boost/noncopyable.hpp>
@@ -113,6 +113,16 @@ bool DocumentLinkManager::idleCheckLinks()
 
 bool DocumentLinkManager::hasDdeLinks() const
 {
+    return hasDdeOrOleLinks(true, false);
+}
+
+bool DocumentLinkManager::hasDdeOrOleLinks() const
+{
+    return hasDdeOrOleLinks(true, true);
+}
+
+bool DocumentLinkManager::hasDdeOrOleLinks(bool bDde, bool bOle) const
+{
     if (!mpImpl->mpLinkManager)
         return false;
 
@@ -120,14 +130,16 @@ bool DocumentLinkManager::hasDdeLinks() const
     for (size_t i = 0, n = rLinks.size(); i < n; ++i)
     {
         sfx2::SvBaseLink* pBase = rLinks[i].get();
-        if (dynamic_cast<ScDdeLink*>(pBase))
+        if (bDde && dynamic_cast<ScDdeLink*>(pBase))
+            return true;
+        if (bOle && dynamic_cast<SdrEmbedObjectLink*>(pBase))
             return true;
     }
 
     return false;
 }
 
-bool DocumentLinkManager::updateDdeLinks( vcl::Window* pWin )
+bool DocumentLinkManager::updateDdeOrOleLinks( vcl::Window* pWin )
 {
     if (!mpImpl->mpLinkManager)
         return false;
@@ -141,6 +153,14 @@ bool DocumentLinkManager::updateDdeLinks( vcl::Window* pWin )
     for (size_t i = 0, n = rLinks.size(); i < n; ++i)
     {
         sfx2::SvBaseLink* pBase = rLinks[i].get();
+
+        SdrEmbedObjectLink* pOleLink = dynamic_cast<SdrEmbedObjectLink*>(pBase);
+        if (pOleLink)
+        {
+            pOleLink->Update();
+            continue;
+        }
+
         ScDdeLink* pDdeLink = dynamic_cast<ScDdeLink*>(pBase);
         if (!pDdeLink)
             continue;
diff --git a/sc/source/ui/view/tabvwsh4.cxx b/sc/source/ui/view/tabvwsh4.cxx
index 9d91dec..e5b86c7 100644
--- a/sc/source/ui/view/tabvwsh4.cxx
+++ b/sc/source/ui/view/tabvwsh4.cxx
@@ -1566,7 +1566,7 @@ void ScTabViewShell::Construct( TriState nForceDesignMode )
             if (!bLink)
             {
                 const sc::DocumentLinkManager& rMgr = rDoc.GetDocLinkManager();
-                if (rMgr.hasDdeLinks() || rDoc.HasAreaLinks())
+                if (rMgr.hasDdeOrOleLinks() || rDoc.HasAreaLinks())
                     bLink = true;
             }
             if (bLink)
diff --git a/sd/source/core/drawdoc.cxx b/sd/source/core/drawdoc.cxx
index 3e1aff8..77f4199 100644
--- a/sd/source/core/drawdoc.cxx
+++ b/sd/source/core/drawdoc.cxx
@@ -729,6 +729,12 @@ void SdDrawDocument::UpdateAllLinks()
     {
         s_pDocLockedInsertingLinks = this; // lock inserting links. only links in this document should by resolved
 
+        if (mpDocSh)
+        {
+            comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = mpDocSh->getEmbeddedObjectContainer();
+            rEmbeddedObjectContainer.setUserAllowsLinkUpdate(true);
+        }
+
         pLinkManager->UpdateAllLinks();  // query box: update all links?
 
         if (s_pDocLockedInsertingLinks == this)
diff --git a/sd/source/ui/docshell/docshel4.cxx b/sd/source/ui/docshell/docshel4.cxx
index 64d25b8..6728237 100644
--- a/sd/source/ui/docshell/docshel4.cxx
+++ b/sd/source/ui/docshell/docshel4.cxx
@@ -287,8 +287,11 @@ bool DrawDocShell::Load( SfxMedium& rMedium )
     }
 
     bRet = SfxObjectShell::Load( rMedium );
-    if( bRet )
+    if (bRet)
     {
+        comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = getEmbeddedObjectContainer();
+        rEmbeddedObjectContainer.setUserAllowsLinkUpdate(false);
+
         bRet = SdXMLFilter( rMedium, *this, true, SDXMLMODE_Normal, SotStorage::GetVersion( rMedium.GetStorage() ) ).Import( nError );
     }
 
diff --git a/svx/source/svdraw/svdoole2.cxx b/svx/source/svdraw/svdoole2.cxx
index 49fdf63..598a618 100644
--- a/svx/source/svdraw/svdoole2.cxx
+++ b/svx/source/svdraw/svdoole2.cxx
@@ -58,7 +58,6 @@
 #include <comphelper/classids.hxx>
 
 #include <sot/formats.hxx>
-#include <sfx2/linkmgr.hxx>
 #include <svtools/transfer.hxx>
 #include <cppuhelper/implbase.hxx>
 
@@ -588,23 +587,6 @@ void SdrLightEmbeddedClient_Impl::setWindow(const uno::Reference< awt::XWindow >
     m_xWindow = _xWindow;
 }
 
-
-class SdrEmbedObjectLink : public sfx2::SvBaseLink
-{
-    SdrOle2Obj*         pObj;
-
-public:
-    explicit            SdrEmbedObjectLink(SdrOle2Obj* pObj);
-    virtual             ~SdrEmbedObjectLink();
-
-    virtual void        Closed() override;
-    virtual ::sfx2::SvBaseLink::UpdateResult DataChanged(
-        const OUString& rMimeType, const css::uno::Any & rValue ) override;
-
-    bool                Connect() { return GetRealObject() != nullptr; }
-};
-
-
 SdrEmbedObjectLink::SdrEmbedObjectLink(SdrOle2Obj* pObject):
     ::sfx2::SvBaseLink( ::SfxLinkUpdateMode::ONCALL, SotClipboardFormatId::SVXB ),
     pObj(pObject)
diff --git a/svx/source/unodraw/unoshap4.cxx b/svx/source/unodraw/unoshap4.cxx
index e71b916..526d5fb 100644
--- a/svx/source/unodraw/unoshap4.cxx
+++ b/svx/source/unodraw/unoshap4.cxx
@@ -420,7 +420,7 @@ bool SvxOle2Shape::createObject( const SvGlobalName &aClassName )
     if( xObj.is() )
     {
         Rectangle aRect = pOle2Obj->GetLogicRect();
-        if ( aRect.GetWidth() == 100 && aRect.GetHeight() == 100 )
+        if ( aRect.GetWidth() == 101 && aRect.GetHeight() == 101 )
         {
             // TODO/LATER: is it possible that this method is used to create an iconified object?
             // default size
@@ -488,7 +488,7 @@ bool SvxOle2Shape::createLink( const OUString& aLinkURL )
     if( xObj.is() )
     {
         Rectangle aRect = pOle2Obj->GetLogicRect();
-        if ( aRect.GetWidth() == 100 && aRect.GetHeight() == 100 )
+        if ( aRect.GetWidth() == 101 && aRect.GetHeight() == 101 )
         {
             // default size
             try
diff --git a/sw/inc/IDocumentLinksAdministration.hxx b/sw/inc/IDocumentLinksAdministration.hxx
index db7aebe..0c9edea 100644
--- a/sw/inc/IDocumentLinksAdministration.hxx
+++ b/sw/inc/IDocumentLinksAdministration.hxx
@@ -46,7 +46,7 @@ using rtl::OUString;
     /** #i42634# Moved common code of SwReader::Read() and
         SwDocShell::UpdateLinks() to new SwDoc::UpdateLinks():
     */
-    virtual void UpdateLinks(bool bUI) = 0;
+    virtual void UpdateLinks() = 0;
 
     /** SS fuers Linken von Dokumentteilen  / ?? for linking of parts of documents.
     */
diff --git a/sw/source/core/doc/DocumentLinksAdministrationManager.cxx b/sw/source/core/doc/DocumentLinksAdministrationManager.cxx
index 27dba28..9a83f73 100644
--- a/sw/source/core/doc/DocumentLinksAdministrationManager.cxx
+++ b/sw/source/core/doc/DocumentLinksAdministrationManager.cxx
@@ -197,47 +197,58 @@ const sfx2::LinkManager& DocumentLinksAdministrationManager::GetLinkManager() co
 
 // #i42634# Moved common code of SwReader::Read() and SwDocShell::UpdateLinks()
 // to new SwDoc::UpdateLinks():
-void DocumentLinksAdministrationManager::UpdateLinks( bool bUI )
+void DocumentLinksAdministrationManager::UpdateLinks()
 {
-    SfxObjectCreateMode eMode;
-    sal_uInt16 nLinkMode = m_rDoc.GetDocumentSettingManager().getLinkUpdateMode( true );
-    if ( m_rDoc.GetDocShell()) {
-        sal_uInt16 nUpdateDocMode = m_rDoc.GetDocShell()->GetUpdateDocMode();
-        if( (nLinkMode != NEVER ||  document::UpdateDocMode::FULL_UPDATE == nUpdateDocMode) &&
-            !GetLinkManager().GetLinks().empty() &&
-            SfxObjectCreateMode::INTERNAL !=
-                        ( eMode = m_rDoc.GetDocShell()->GetCreateMode()) &&
-            SfxObjectCreateMode::ORGANIZER != eMode &&
-            SfxObjectCreateMode::PREVIEW != eMode &&
-            !m_rDoc.GetDocShell()->IsPreview() )
+    if (!m_rDoc.GetDocShell())
+        return;
+    SfxObjectCreateMode eMode = m_rDoc.GetDocShell()->GetCreateMode();
+    if (eMode == SfxObjectCreateMode::INTERNAL)
+        return;
+    if (eMode == SfxObjectCreateMode::ORGANIZER)
+        return;
+    if (eMode == SfxObjectCreateMode::PREVIEW)
+        return;
+    if (m_rDoc.GetDocShell()->IsPreview())
+        return;
+    if (GetLinkManager().GetLinks().empty())
+        return;
+    sal_uInt16 nLinkMode = m_rDoc.GetDocumentSettingManager().getLinkUpdateMode(true);
+    sal_uInt16 nUpdateDocMode = m_rDoc.GetDocShell()->GetUpdateDocMode();
+    if (nLinkMode == NEVER && nUpdateDocMode != document::UpdateDocMode::FULL_UPDATE)
+        return;
+
+    bool bAskUpdate = nLinkMode == MANUAL;
+    bool bUpdate = true;
+    switch(nUpdateDocMode)
+    {
+        case document::UpdateDocMode::NO_UPDATE:   bUpdate = false;break;
+        case document::UpdateDocMode::QUIET_UPDATE:bAskUpdate = false; break;
+        case document::UpdateDocMode::FULL_UPDATE: bAskUpdate = true; break;
+    }
+    if (nLinkMode == AUTOMATIC && !bAskUpdate)
+    {
+        SfxMedium * medium = m_rDoc.GetDocShell()->GetMedium();
+        if (!SvtSecurityOptions().isTrustedLocationUriForUpdatingLinks(
+                medium == nullptr ? OUString() : medium->GetName()))
         {
-            bool bAskUpdate = nLinkMode == MANUAL;
-            bool bUpdate = true;
-            switch(nUpdateDocMode)
-            {
-                case document::UpdateDocMode::NO_UPDATE:   bUpdate = false;break;
-                case document::UpdateDocMode::QUIET_UPDATE:bAskUpdate = false; break;
-                case document::UpdateDocMode::FULL_UPDATE: bAskUpdate = true; break;
-            }
-            if (nLinkMode == AUTOMATIC && !bAskUpdate)
-            {
-                SfxMedium * medium = m_rDoc.GetDocShell()->GetMedium();
-                if (!SvtSecurityOptions().isTrustedLocationUriForUpdatingLinks(
-                        medium == nullptr ? OUString() : medium->GetName()))
-                {
-                    bAskUpdate = true;
-                }
-            }
-            if( bUpdate && (bUI || !bAskUpdate) )
-            {
-                SfxMedium* pMedium = m_rDoc.GetDocShell()->GetMedium();
-                SfxFrame* pFrame = pMedium ? pMedium->GetLoadTargetFrame() : nullptr;
-                vcl::Window* pDlgParent = pFrame ? &pFrame->GetWindow() : nullptr;
-
-                GetLinkManager().UpdateAllLinks( bAskUpdate, true, false, pDlgParent );
-            }
+            bAskUpdate = true;
         }
     }
+    comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = m_rDoc.GetDocShell()->getEmbeddedObjectContainer();
+    if (bUpdate)
+    {
+        rEmbeddedObjectContainer.setUserAllowsLinkUpdate(true);
+
+        SfxMedium* pMedium = m_rDoc.GetDocShell()->GetMedium();
+        SfxFrame* pFrame = pMedium ? pMedium->GetLoadTargetFrame() : nullptr;
+        vcl::Window* pDlgParent = pFrame ? &pFrame->GetWindow() : nullptr;
+
+        GetLinkManager().UpdateAllLinks( bAskUpdate, true, false, pDlgParent );
+    }
+    else
+    {
+        rEmbeddedObjectContainer.setUserAllowsLinkUpdate(false);
+    }
 }
 
 bool DocumentLinksAdministrationManager::GetData( const OUString& rItem, const OUString& rMimeType,
diff --git a/sw/source/core/inc/DocumentLinksAdministrationManager.hxx b/sw/source/core/inc/DocumentLinksAdministrationManager.hxx
index dcd3299..1fbd403 100644
--- a/sw/source/core/inc/DocumentLinksAdministrationManager.hxx
+++ b/sw/source/core/inc/DocumentLinksAdministrationManager.hxx
@@ -47,7 +47,7 @@ public:
 
     const sfx2::LinkManager& GetLinkManager() const override;
 
-    void UpdateLinks(bool bUI) override;
+    void UpdateLinks() override;
 
     bool GetData(const OUString& rItem, const OUString& rMimeType, css::uno::Any& rValue) const override;
 
diff --git a/sw/source/filter/basflt/shellio.cxx b/sw/source/filter/basflt/shellio.cxx
index a2e6a5c..eb95100 100644
--- a/sw/source/filter/basflt/shellio.cxx
+++ b/sw/source/filter/basflt/shellio.cxx
@@ -364,7 +364,7 @@ sal_uLong SwReader::Read( const Reader& rOptions )
         // #i42634# Moved common code of SwReader::Read() and
         // SwDocShell::UpdateLinks() to new SwDoc::UpdateLinks():
     // ATM still with Update
-        pDoc->getIDocumentLinksAdministration().UpdateLinks( true );
+        pDoc->getIDocumentLinksAdministration().UpdateLinks();
 
         // not insert: set the redline mode read from settings.xml
         eOld = static_cast<RedlineMode_t>(
diff --git a/sw/source/uibase/app/docsh.cxx b/sw/source/uibase/app/docsh.cxx
index 14d8cd8..20bf324 100644
--- a/sw/source/uibase/app/docsh.cxx
+++ b/sw/source/uibase/app/docsh.cxx
@@ -1213,7 +1213,7 @@ void SwDocShell::CalcLayoutForOLEObjects()
 // read by the binary filter:
 void SwDocShell::UpdateLinks()
 {
-    GetDoc()->getIDocumentLinksAdministration().UpdateLinks(true);
+    GetDoc()->getIDocumentLinksAdministration().UpdateLinks();
     // #i50703# Update footnote numbers
     SwTextFootnote::SetUniqueSeqRefNo( *GetDoc() );
     SwNodeIndex aTmp( GetDoc()->GetNodes() );
diff --git a/sw/source/uibase/app/docshini.cxx b/sw/source/uibase/app/docshini.cxx
index 7680258..4523d3b 100644
--- a/sw/source/uibase/app/docshini.cxx
+++ b/sw/source/uibase/app/docshini.cxx
@@ -492,6 +492,9 @@ bool  SwDocShell::Load( SfxMedium& rMedium )
     bool bRet = false;
     if( SfxObjectShell::Load( rMedium ))
     {
+        comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = getEmbeddedObjectContainer();
+        rEmbeddedObjectContainer.setUserAllowsLinkUpdate(false);
+
         SAL_INFO( "sw.ui", "after SfxInPlaceObject::Load" );
         if (m_pDoc)              // for last version!!
             RemoveLink();       // release the existing
commit e2f9a31323c488af7899a64a22b9a35aa5df6e9d
Author: Winfried Donkers <winfrieddonkers at libreoffice.org>
Date:   Fri Sep 9 13:18:42 2016 +0200

    tdf#101541 function WORKDAY.INTL not working properly
    
    When holidays are adjacent to weekend days, wrong results occurred.
    
    Change-Id: I9ec86e00f1a62ea941ff70617a1b448601aff9cc
    Reviewed-on: https://gerrit.libreoffice.org/28771
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit 5e9d5eeb8a33fdcc500377d9eace40b5f5a7f750)
    Reviewed-on: https://gerrit.libreoffice.org/28970
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-on: https://gerrit.libreoffice.org/28973
    (cherry picked from commit 3bf31803959ccc54bb949630f936a768ef47a90b)

diff --git a/sc/source/core/tool/interpr2.cxx b/sc/source/core/tool/interpr2.cxx
index bd255fc..d287718 100644
--- a/sc/source/core/tool/interpr2.cxx
+++ b/sc/source/core/tool/interpr2.cxx
@@ -513,14 +513,16 @@ void ScInterpreter::ScWorkday_MS()
                     size_t nRef = 0;
                     while ( nDays )
                     {
-                        while ( nRef < nMax && nSortArray.at( nRef ) < nDate )
-                            nRef++;
-                        if ( !( nRef < nMax && nSortArray.at( nRef ) == nDate ) || nRef >= nMax )
-                             nDays--;
-
                         do
+                        {
                             ++nDate;
+                        }
                         while ( bWeekendMask[ GetDayOfWeek( nDate ) ] ); //jump over weekend day(s)
+
+                        while ( nRef < nMax && nSortArray.at( nRef ) < nDate )
+                            nRef++;
+                        if ( !( nRef < nMax && nSortArray.at( nRef ) == nDate ) || nRef >= nMax )
+                            nDays--;
                     }
                 }
                 else
@@ -528,14 +530,16 @@ void ScInterpreter::ScWorkday_MS()
                     sal_Int16 nRef = nMax - 1;
                     while ( nDays )
                     {
+                        do
+                        {
+                          --nDate;
+                        }
+                        while ( bWeekendMask[ GetDayOfWeek( nDate ) ] ); //jump over weekend day(s)
+
                         while ( nRef >= 0 && nSortArray.at( nRef ) > nDate )
                             nRef--;
                         if ( !( nRef >= 0 && nSortArray.at( nRef ) == nDate ) || nRef < 0 )
                              nDays++;
-
-                        do
-                          --nDate;
-                        while ( bWeekendMask[ GetDayOfWeek( nDate ) ] ); //jump over weekend day(s)
                     }
                 }
                 PushDouble( ( double ) ( nDate - nNullDate ) );
commit 0ed12ea86df7468a831ab55c06919d6bcdec81d5
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Sep 12 10:11:37 2016 +0100

    fftester: break as soon as an exception is required
    
    Change-Id: Ia787c42f484c00242f1bcaca8ea7459890ec5745
    Reviewed-on: https://gerrit.libreoffice.org/28830
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 0aa73cd0ff10c9b680c38e59147db684ff1ab14c)

diff --git a/sw/qa/core/data/rtf/fail/table-2.rtf b/sw/qa/core/data/rtf/fail/table-2.rtf
new file mode 100644
index 0000000..35e859b
Binary files /dev/null and b/sw/qa/core/data/rtf/fail/table-2.rtf differ
diff --git a/sw/source/core/unocore/unotext.cxx b/sw/source/core/unocore/unotext.cxx
index 454dda6..6505f27 100644
--- a/sw/source/core/unocore/unotext.cxx
+++ b/sw/source/core/unocore/unotext.cxx
@@ -2242,7 +2242,7 @@ throw (lang::IllegalArgumentException, uno::RuntimeException, std::exception)
             break;
         }
 
-        for (sal_Int32 nCell = 0; nCell < nCells; ++nCell)
+        for (sal_Int32 nCell = 0; !bExcept && nCell < nCells; ++nCell)
         {
             SwNodeRange *const pLastCell(
                 (nCell == 0)
commit 7a2528839f80cab67e8759f4176b79a02f9bfaff
Author: Yousuf Philips <philipz85 at hotmail.com>
Date:   Sun Sep 11 01:49:46 2016 +0400

    tdf#101566 Remove untranslatable labels from changes toolbar
    
    Change-Id: I62cb3b8d0f57f7fd79cffce3b5aed5e384390e24
    Reviewed-on: https://gerrit.libreoffice.org/28814
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Yousuf Philips <philipz85 at hotmail.com>
    (cherry picked from commit f37d6837bf864a08f567c10c5f5bc0d4e4b5f9f7)
    Reviewed-on: https://gerrit.libreoffice.org/28822
    Reviewed-by: Maxim Monastirsky <momonasmon at gmail.com>
    (cherry picked from commit 4b7707bb8bcf0965d2d81f9c82672cb11829737f)
    Reviewed-on: https://gerrit.libreoffice.org/28863
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 2e81f0770706758191ad871395fb36cfa5355cd4)

diff --git a/sw/uiconfig/swriter/toolbar/changes.xml b/sw/uiconfig/swriter/toolbar/changes.xml
index 3ba4ad5..f90a85e 100644
--- a/sw/uiconfig/swriter/toolbar/changes.xml
+++ b/sw/uiconfig/swriter/toolbar/changes.xml
@@ -18,19 +18,19 @@
  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
 -->
 <toolbar:toolbar xmlns:toolbar="http://openoffice.org/2001/toolbar" xmlns:xlink="http://www.w3.org/1999/xlink">
- <toolbar:toolbaritem xlink:href=".uno:ShowTrackedChanges" toolbar:text="Show" toolbar:helpid="10624"/>
- <toolbar:toolbaritem xlink:href=".uno:TrackChanges" toolbar:text="Record" toolbar:helpid="10725"/>
+ <toolbar:toolbaritem xlink:href=".uno:ShowTrackedChanges" toolbar:helpid="10624"/>
+ <toolbar:toolbaritem xlink:href=".uno:TrackChanges" toolbar:helpid="10725"/>
  <toolbar:toolbarseparator/>
- <toolbar:toolbaritem xlink:href=".uno:PreviousTrackedChange" toolbar:text="Previous"/>
- <toolbar:toolbaritem xlink:href=".uno:NextTrackedChange" toolbar:text="Next"/>
- <toolbar:toolbaritem xlink:href=".uno:AcceptTrackedChange" toolbar:text="Accept" toolbar:helpid="10625"/>
- <toolbar:toolbaritem xlink:href=".uno:RejectTrackedChange" toolbar:text="Reject" toolbar:helpid="10626"/>
- <toolbar:toolbaritem xlink:href=".uno:AcceptTrackedChanges" toolbar:text="List" toolbar:helpid="10622"/>
+ <toolbar:toolbaritem xlink:href=".uno:PreviousTrackedChange"/>
+ <toolbar:toolbaritem xlink:href=".uno:NextTrackedChange"/>
+ <toolbar:toolbaritem xlink:href=".uno:AcceptTrackedChange" toolbar:helpid="10625"/>
+ <toolbar:toolbaritem xlink:href=".uno:RejectTrackedChange" toolbar:helpid="10626"/>
+ <toolbar:toolbaritem xlink:href=".uno:AcceptTrackedChanges" toolbar:helpid="10622"/>
  <toolbar:toolbarseparator/>
- <toolbar:toolbaritem xlink:href=".uno:InsertAnnotation" toolbar:text="Regular Comment" toolbar:helpid="10625"/>
- <toolbar:toolbaritem xlink:href=".uno:CommentChangeTracking" toolbar:text="Change Comment" toolbar:helpid="10625"/>
+ <toolbar:toolbaritem xlink:href=".uno:InsertAnnotation" toolbar:helpid="10625"/>
+ <toolbar:toolbaritem xlink:href=".uno:CommentChangeTracking" toolbar:helpid="10625"/>
  <toolbar:toolbarseparator/>
- <toolbar:toolbaritem xlink:href=".uno:ProtectTraceChangeMode" toolbar:text="Protect" toolbar:helpid="10625"/>
- <toolbar:toolbaritem xlink:href=".uno:CompareDocuments" toolbar:text="Compare"/>
- <toolbar:toolbaritem xlink:href=".uno:MergeDocuments" toolbar:text="Merge" toolbar:visible="false"/>
+ <toolbar:toolbaritem xlink:href=".uno:ProtectTraceChangeMode" toolbar:helpid="10625"/>
+ <toolbar:toolbaritem xlink:href=".uno:CompareDocuments"/>
+ <toolbar:toolbaritem xlink:href=".uno:MergeDocuments"/>
 </toolbar:toolbar>
commit 0b4a9f6cd19e0a50b440aeac606ec6e08b57f199
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Mon Sep 12 16:08:38 2016 +0200

    tdf#91966: In SDK, set CPPU_ENV=mscx for 64-bit Windows
    
    Change-Id: Ib93b2db40f43f98d8369cb91ca35692cc92f023b
    (cherry picked from commit 3aaa820446f1ad3d3b0ddc557238b6fb3496dd54)
    Reviewed-on: https://gerrit.libreoffice.org/28873
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit f09fd93be5d3c73d94bf67818f067a70b1594c35)

diff --git a/odk/settings/settings.mk b/odk/settings/settings.mk
index b5bee39..5dd54f6 100644
--- a/odk/settings/settings.mk
+++ b/odk/settings/settings.mk
@@ -113,8 +113,14 @@ SDK_JAVA_INCLUDES = -I"$(OO_SDK_JAVA_HOME)/include" -I"$(OO_SDK_JAVA_HOME)/inclu
 # define for used compiler necessary for UNO
 # -DCPPU_ENV=msci -- windows msvc 4.x - 7.x
 
-CC_DEFINES_JNI=-DWIN32 -DWNT -D_DLL -DCPPU_ENV=msci
-CC_DEFINES=-DWIN32 -DWNT -D_DLL -DCPPU_ENV=msci
+ifeq "$(PROCTYPE)" "x86_64"
+CPPU_ENV=mscx
+else
+CPPU_ENV=msci
+endif
+
+CC_DEFINES_JNI=-DWIN32 -DWNT -D_DLL -DCPPU_ENV=$(CPPU_ENV)
+CC_DEFINES=-DWIN32 -DWNT -D_DLL -DCPPU_ENV=$(CPPU_ENV)
 CC_OUTPUT_SWITCH=-Fo
 
 LIBO_SDK_LDFLAGS_STDLIBS = $(LIBO_SDK_DETAIL_LDFLAGS_MSVCRT) kernel32.lib
commit cf914d77a0837feec567d0c0b67ac08bd9f2b610
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Sep 12 09:34:21 2016 +0100

    fftester: no table manager
    
    Change-Id: Icb3c640e04416f9120d37558646a570daeddf0a4
    Reviewed-on: https://gerrit.libreoffice.org/28827
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit d7c00a1e54f72427aeadded00a3c5be03c1c997b)

diff --git a/writerfilter/qa/cppunittests/rtftok/data/fail/tablemanager-7.rtf b/writerfilter/qa/cppunittests/rtftok/data/fail/tablemanager-7.rtf
new file mode 100644
index 0000000..df41b1f
Binary files /dev/null and b/writerfilter/qa/cppunittests/rtftok/data/fail/tablemanager-7.rtf differ
diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index 5bc6fa5..e0dba9c 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -830,7 +830,7 @@ void DomainMapper_Impl::CheckUnregisteredFrameConversion( )
     TextAppendContext& rAppendContext = m_aTextAppendStack.top();
     // n#779642: ignore fly frame inside table as it could lead to messy situations
     if( rAppendContext.pLastParagraphProperties.get() && rAppendContext.pLastParagraphProperties->IsFrameMode()
-        && !getTableManager().isInTable() )
+        && hasTableManager() && !getTableManager().isInTable() )
     {
         try
         {
commit 131afa8be07a5772017dc1d45603e3877ef331c9
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Sep 10 13:46:47 2016 +0100

    fftester: no table manager
    
    Change-Id: I033454670d1ee662bc80bc07578690155d97ce28
    Reviewed-on: https://gerrit.libreoffice.org/28807
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 951c8ee5a5fdf1d57570dd4c1134a88ce7c22e22)

diff --git a/writerfilter/qa/cppunittests/rtftok/data/fail/tablemanager-6.rtf b/writerfilter/qa/cppunittests/rtftok/data/fail/tablemanager-6.rtf
new file mode 100644
index 0000000..67a0ea1
Binary files /dev/null and b/writerfilter/qa/cppunittests/rtftok/data/fail/tablemanager-6.rtf differ
diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index b8e8883..5bc6fa5 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -1221,7 +1221,7 @@ void DomainMapper_Impl::appendTextPortion( const OUString& rString, PropertyMapP
     if( pPropertyMap == m_pTopContext && !deferredCharacterProperties.empty() && (GetTopContextType() == CONTEXT_CHARACTER) )
         processDeferredCharacterProperties();
     uno::Reference< text::XTextAppend >  xTextAppend = m_aTextAppendStack.top().xTextAppend;
-    if(xTextAppend.is() && ! getTableManager( ).isIgnore())
+    if (xTextAppend.is() && hasTableManager() && !getTableManager().isIgnore())
     {
         try
         {
commit e0b8bfe94b73c1c0a54fb7f68cc6283203a78067
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Sep 10 11:47:16 2016 +0100

    fftester: use of deleted RTFParserState
    
    but we only use the RTFParserState to use its m_pDocumentImpl and
    the m_pDocumentImpl is never changed for the RTFParserState lifetime,
    so take the m_pDocumentImpl at ctor time instead and use that
    directly later
    
    Reviewed-on: https://gerrit.libreoffice.org/28802
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 44d4d9d4e998de9b4dc939af4fa40e51e6300951)
    
    Change-Id: I15152e3f6d9008553b4a384a5e5da21373904cc9
    Reviewed-on: https://gerrit.libreoffice.org/28804
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 4ed7ca7bfd5aab9846a02d3397771c0724344993)

diff --git a/writerfilter/qa/cppunittests/rtftok/data/pass/parser-state-1.rtf b/writerfilter/qa/cppunittests/rtftok/data/pass/parser-state-1.rtf
new file mode 100644
index 0000000..3fe4b28
Binary files /dev/null and b/writerfilter/qa/cppunittests/rtftok/data/pass/parser-state-1.rtf differ
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
index 2f5569d..a4acf31 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
@@ -6651,7 +6651,7 @@ RTFDrawingObject::RTFDrawingObject()
 }
 
 RTFFrame::RTFFrame(RTFParserState* pParserState)
-    : m_pParserState(pParserState),
+    : m_pDocumentImpl(pParserState->m_pDocumentImpl),
       nX(0),
       nY(0),
       nW(0),
@@ -6669,10 +6669,10 @@ RTFFrame::RTFFrame(RTFParserState* pParserState)
 
 void RTFFrame::setSprm(Id nId, Id nValue)
 {
-    if (m_pParserState->m_pDocumentImpl->getFirstRun() && !m_pParserState->m_pDocumentImpl->isStyleSheetImport())
+    if (m_pDocumentImpl->getFirstRun() && !m_pDocumentImpl->isStyleSheetImport())
     {
-        m_pParserState->m_pDocumentImpl->checkFirstRun();
-        m_pParserState->m_pDocumentImpl->setNeedPar(false);
+        m_pDocumentImpl->checkFirstRun();
+        m_pDocumentImpl->setNeedPar(false);
     }
     switch (nId)
     {
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.hxx b/writerfilter/source/rtftok/rtfdocumentimpl.hxx
index 78851d1..6744bea 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.hxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.hxx
@@ -182,12 +182,13 @@ public:
 };
 
 class RTFParserState;
+class RTFDocumentImpl;
 
 /// Stores the properties of a frame
 class RTFFrame
 {
 private:
-    RTFParserState* m_pParserState;
+    RTFDocumentImpl* m_pDocumentImpl;
     sal_Int32 nX, nY, nW, nH;
     sal_Int32 nHoriPadding, nVertPadding;
     sal_Int32 nHoriAlign, nHoriAnchor, nVertAlign, nVertAnchor;
commit 4122e7fe2eb839c25f5a0d1aa475689e8b54947c
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 6 20:19:04 2016 +0100

    rtf: don't skip backwards on skipping bin specified bytes
    
    otherwise we could end up re-parsing the block endlessly
    
    Change-Id: Ia90a9e5b513951c91e1917483f9e030dbee98ffb
    Reviewed-on: https://gerrit.libreoffice.org/28710
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 4112594d60961d2d1a6b0f90422ce1b0924bf07d)

diff --git a/writerfilter/source/rtftok/rtftokenizer.cxx b/writerfilter/source/rtftok/rtftokenizer.cxx
index cdcdb11..02206ad 100644
--- a/writerfilter/source/rtftok/rtftokenizer.cxx
+++ b/writerfilter/source/rtftok/rtftokenizer.cxx
@@ -282,7 +282,7 @@ RTFError RTFTokenizer::dispatchKeyword(OString& rKeyword, bool bParam, int nPara
     {
         // skip binary data explicitely, to not trip over rtf markup
         // control characters
-        if (rKeyword.equals("bin"))
+        if (rKeyword.equals("bin") && nParam > 0)
             Strm().SeekRel(nParam);
         return RTFError::OK;
     }
commit a36e0309e91d530ac5fd5c4dddbfef52a7eec246
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 6 20:31:06 2016 +0100

    rtf: throw early on a bad nestrow token
    
    Reviewed-on: https://gerrit.libreoffice.org/28708
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 5e9982668224345f901631d664985e823530e05a)
    
    Change-Id: I9de8d09bce18fd1e8a145617794594a99a5f996e
    Reviewed-on: https://gerrit.libreoffice.org/28713
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 10da1cf5b1e2446470b4892f0e49132217baf33d)

diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
index 1b07d9b..2f5569d 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
@@ -2308,12 +2308,12 @@ RTFError RTFDocumentImpl::dispatchSymbol(RTFKeyword nKeyword)
                           pBuffer->pRowProperties,
                           m_nNestedCells, m_nNestedCurrentCellX);
 
-        assert(m_aStates.top().pCurrentBuffer == &m_aTableBufferStack.back());
-        if (m_aTableBufferStack.size() == 1)
+        if (m_aTableBufferStack.size() == 1 || !m_aStates.top().pCurrentBuffer)
         {
             throw io::WrongFormatException(
                 "mismatch between \\itap and number of \\nestrow", nullptr);
         }
+        assert(m_aStates.top().pCurrentBuffer == &m_aTableBufferStack.back());
         // note: there may be several states pointing to table buffer!
         for (size_t i = 0; i < m_aStates.size(); ++i)
         {
commit 941430c15a1e096afacfee8d40775640c8a6d781
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 6 15:57:30 2016 +0100

    fftester: missing ValueLast
    
    Reviewed-on: https://gerrit.libreoffice.org/28693
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 30af3971d826d55426f51a7beb14c24ac3880250)
    
    Change-Id: I8e881871b1ae4dea757263d04796779e62e168dc
    Reviewed-on: https://gerrit.libreoffice.org/28712
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit f5bbdd05582a0a6fa9a3db399f97df18373215ad)

diff --git a/writerfilter/qa/cppunittests/rtftok/data/pass/valuelist-1.rtf b/writerfilter/qa/cppunittests/rtftok/data/pass/valuelist-1.rtf
new file mode 100644
index 0000000..847e165
Binary files /dev/null and b/writerfilter/qa/cppunittests/rtftok/data/pass/valuelist-1.rtf differ
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
index 9a37740..1b07d9b 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
@@ -2349,7 +2349,8 @@ RTFError RTFDocumentImpl::dispatchSymbol(RTFKeyword nKeyword)
         if ((m_nCellxMax - m_nTopLevelCurrentCellX) >= MINLAY)
         {
             auto pXValueLast = m_aStates.top().aTableRowSprms.find(NS_ooxml::LN_CT_TblGridBase_gridCol, false);
-            auto pXValue = std::make_shared<RTFValue>(pXValueLast->getInt() + m_nCellxMax - m_nTopLevelCurrentCellX);
+            const int nXValueLast = pXValueLast ? pXValueLast->getInt() : 0;
+            auto pXValue = std::make_shared<RTFValue>(nXValueLast + m_nCellxMax - m_nTopLevelCurrentCellX);
             m_aStates.top().aTableRowSprms.eraseLast(NS_ooxml::LN_CT_TblGridBase_gridCol);
             m_aStates.top().aTableRowSprms.set(NS_ooxml::LN_CT_TblGridBase_gridCol, pXValue, RTFOverwrite::NO_APPEND);
             m_nTopLevelCurrentCellX = m_nCellxMax;
commit 361d393065cdb1fb0313bb571228b3edd7ef4886
Author: rpmbuild <rpmbuild at fedoraproject.org>
Date:   Mon Aug 15 15:17:11 2016 +0100

    Resolves: tdf#91533 (rhbz#1364335) Tooltips are truncated
    
    Change-Id: Id9ec91ed9652f491e4e2a0556eeed27bf6517002
    (cherry picked from commit e527edf06f8befb45b76ee8ebabe62e6dc885e45)
    Reviewed-on: https://gerrit.libreoffice.org/28220
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 02b6a8ae5a0ad4ebb0c929ebf079e01eb76762f8)

diff --git a/vcl/inc/helpwin.hxx b/vcl/inc/helpwin.hxx
index cf35423..db7c10e 100644
--- a/vcl/inc/helpwin.hxx
+++ b/vcl/inc/helpwin.hxx
@@ -49,6 +49,7 @@ private:
     virtual void Paint(vcl::RenderContext& rRenderContext, const Rectangle&) override;
     virtual void RequestHelp( const HelpEvent& rHEvt ) override;
     virtual void ApplySettings(vcl::RenderContext& rRenderContext) override;
+    virtual void StateChanged(StateChangedType nType) override;
 
     virtual OUString GetText() const override;
     void ImplShow();
diff --git a/vcl/source/app/help.cxx b/vcl/source/app/help.cxx
index 4f9e3e7..6d16332 100644
--- a/vcl/source/app/help.cxx
+++ b/vcl/source/app/help.cxx
@@ -260,6 +260,17 @@ HelpTextWindow::HelpTextWindow( vcl::Window* pParent, const OUString& rText, sal
     maHideTimer.SetTimeout( rHelpSettings.GetTipTimeout() );
 }
 
+void HelpTextWindow::StateChanged(StateChangedType nType)
+{
+    FloatingWindow::StateChanged(nType);
+    if (nType == StateChangedType::InitShow)
+    {
+        ApplySettings(*this);
+        SetHelpText(maHelpText);
+        Invalidate();
+    }
+}
+
 void HelpTextWindow::ApplySettings(vcl::RenderContext& rRenderContext)
 {
     const StyleSettings& rStyleSettings = rRenderContext.GetSettings().GetStyleSettings();
commit aef5dcde285bfed3feb94488b98f86ed840d49c5
Author: Michael Stahl <mstahl at redhat.com>
Date:   Thu Sep 1 23:06:00 2016 +0200

    editeng: don't let wild-card auto-correct leave current word
    
    If a paragraph has e.g. multiple -> in it then auto-correct of the first
    one will create via the .*->.* rule a new auto-correct entry that has as
    long-word the word that contains the first -> until the last -> and
    everything in between.  This will be somewhat irritating when it is
    eventually applied.  Avoid it by limiting the wild-card loop to the
    current word, which is apparently the intent anyway.
    
    (regression from a07425892205ff8951027ea20459b97370d01de6)
    
    Change-Id: I294bae863c44eb460627b61b4383133131fe4b3a
    Reviewed-on: https://gerrit.libreoffice.org/28608
    Reviewed-by: László Németh <nemeth at numbertext.org>
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 9670f0d17ffed1ff07cb1deddcabc26c756e4bc1)
    Reviewed-on: https://gerrit.libreoffice.org/28634
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 0c0c421f1936417d72d6268aaeee86d119ae8841)

diff --git a/editeng/source/misc/svxacorr.cxx b/editeng/source/misc/svxacorr.cxx
index 2ee3fc4..a341851 100644
--- a/editeng/source/misc/svxacorr.cxx
+++ b/editeng/source/misc/svxacorr.cxx
@@ -2821,6 +2821,11 @@ const SvxAutocorrWord* SvxAutocorrWordList::WordMatches(const SvxAutocorrWord *p
                         nSttWdPos = rTxt.indexOf( sTmp, nFndPos);
                         if (nSttWdPos != -1)
                         {
+                            sal_Int32 nTmp(nFndPos);
+                            while (nTmp < nSttWdPos && !IsWordDelim(rTxt[nTmp]))
+                                nTmp++;
+                            if (nTmp < nSttWdPos)
+                                break; // word delimiter found
                             buf.append(rTxt.copy(nFndPos, nSttWdPos - nFndPos)).append(pFnd->GetLong());
                             nFndPos = nSttWdPos + sTmp.getLength();
                         }
commit f2175fafec4a5088c7f746574cbff9b84a8ed870
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Sep 6 14:49:31 2016 +0100

    if we throw in sw on HoriOrientation::NONE then don't pass it in from rtf
    
    Change-Id: Ie01cca9b7cc432fc1fe14bb600af5083d6ca6a0d
    Reviewed-on: https://gerrit.libreoffice.org/28690
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 0ac170beb986997d57fd14c7dcdfff8f46820699)

diff --git a/sw/source/core/unocore/unosett.cxx b/sw/source/core/unocore/unosett.cxx
index b3a5571..da269dc 100644
--- a/sw/source/core/unocore/unosett.cxx
+++ b/sw/source/core/unocore/unosett.cxx
@@ -1678,7 +1678,7 @@ void SwXNumberingRules::SetPropertiesToNumFormat(
             {
                 case 0: //"Adjust"
                 {
-                    sal_Int16 nValue = 0;
+                    sal_Int16 nValue = text::HoriOrientation::NONE;
                     pProp->Value >>= nValue;
                     if(nValue > 0 &&
                         nValue <= text::HoriOrientation::LEFT &&
diff --git a/writerfilter/source/dmapper/NumberingManager.cxx b/writerfilter/source/dmapper/NumberingManager.cxx
index 1ee372b..363a31d 100644
--- a/writerfilter/source/dmapper/NumberingManager.cxx
+++ b/writerfilter/source/dmapper/NumberingManager.cxx
@@ -987,7 +987,7 @@ void ListsManager::lcl_sprm( Sprm& rSprm )
             break;
             case NS_ooxml::LN_CT_Lvl_lvlJc:
             {
-                sal_Int16 nValue = 0;
+                sal_Int16 nValue = text::HoriOrientation::NONE;
                 switch (nIntValue)
                 {
                 case NS_ooxml::LN_Value_ST_Jc_left:
@@ -1002,9 +1002,12 @@ void ListsManager::lcl_sprm( Sprm& rSprm )
                     nValue = text::HoriOrientation::RIGHT;
                     break;
                 }
-                m_pCurrentDefinition->GetCurrentLevel( )->Insert(
-                    PROP_ADJUST, uno::makeAny( nValue ) );
-                    writerfilter::Reference<Properties>::Pointer_t pProperties = rSprm.getProps();
+                if (nValue != text::HoriOrientation::NONE)
+                {
+                    m_pCurrentDefinition->GetCurrentLevel( )->Insert(
+                        PROP_ADJUST, uno::makeAny( nValue ) );
+                        writerfilter::Reference<Properties>::Pointer_t pProperties = rSprm.getProps();
+                }
             }
             break;
             case NS_ooxml::LN_CT_Lvl_pPr:
commit fde89d2fe6d0f6b08d7e8bdd75f858a1c0b43fa7
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Aug 15 21:13:01 2016 +0100

    Resolves: tdf#96451 do magic to enable embedded chart sidebar only for chart
    
    objects, and do the normal thing for other objects, e.g. math
    
    Change-Id: Ifb786a841b843b0317713769cb214a44dceaf546
    (cherry picked from commit c5977a89c28b285dfface71ca71e07bb0463ed19)
    Reviewed-on: https://gerrit.libreoffice.org/28153
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 3c51f207747150933c6725fa22af1682cf066d8c)

diff --git a/embeddedobj/source/general/docholder.cxx b/embeddedobj/source/general/docholder.cxx
index 843106a..2dbc764 100644
--- a/embeddedobj/source/general/docholder.cxx
+++ b/embeddedobj/source/general/docholder.cxx
@@ -709,10 +709,17 @@ bool DocumentHolder::ShowUI( const uno::Reference< css::frame::XLayoutManager >&
                     // this must be done after merging menus as we won't get the container menu otherwise
                     xContainerLM->setDockingAreaAcceptor( uno::Reference < ui::XDockingAreaAcceptor >() );
 
+                    bool bIsChart = false;
+                    uno::Reference< lang::XServiceInfo> xServiceInfo(m_xComponent, uno::UNO_QUERY);
+                    if (xServiceInfo.is() && xServiceInfo->supportsService("com.sun.star.chart2.ChartDocument"))
+                        bIsChart = true;
                     // prevent further changes at this LM
                     // TODO: moggi: why is this necessary?
-                    // xContainerLM->setVisible( sal_False );
-                    // xContainerLM->lock();
+                    if (!bIsChart)
+                    {
+                        xContainerLM->setVisible( false );
+                        xContainerLM->lock();
+                    }
                     bUnlock = true;
 
                     // by unlocking the LM each layout change will now resize the containers window; pending layouts will be processed now
commit 1769f7f3ef3e36057d788956fd0751618c0a8669
Author: Yousuf Philips <philipz85 at hotmail.com>
Date:   Sun Sep 4 04:59:11 2016 +0400

    Make character dialog's hyperlink tab accessible
    
    Change-Id: I6b2351b5a46562236dc93c6de3daa185e2a72fb2
    Reviewed-on: https://gerrit.libreoffice.org/28653
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 62fdfdded30e3e7507590a07791cc78e6b2b1d80)
    Reviewed-on: https://gerrit.libreoffice.org/28704
    (cherry picked from commit 99d2232e4fb701273d26457817a590f39bbace96)

diff --git a/sw/uiconfig/swriter/ui/charurlpage.ui b/sw/uiconfig/swriter/ui/charurlpage.ui
index ba39e55..c69e10c 100644
--- a/sw/uiconfig/swriter/ui/charurlpage.ui
+++ b/sw/uiconfig/swriter/ui/charurlpage.ui
@@ -33,6 +33,8 @@
                     <property name="can_focus">False</property>
                     <property name="xalign">1</property>
                     <property name="label" translatable="yes">URL:</property>
+                    <property name="use_underline">True</property>
+                    <property name="mnemonic_widget">urled</property>
                   </object>
                   <packing>
                     <property name="left_attach">0</property>
@@ -45,6 +47,8 @@
                     <property name="can_focus">False</property>
                     <property name="xalign">1</property>
                     <property name="label" translatable="yes">Name:</property>
+                    <property name="use_underline">True</property>
+                    <property name="mnemonic_widget">nameed</property>
                   </object>
                   <packing>
                     <property name="left_attach">0</property>
@@ -57,6 +61,8 @@
                     <property name="can_focus">False</property>
                     <property name="xalign">1</property>
                     <property name="label" translatable="yes">Text:</property>
+                    <property name="use_underline">True</property>
+                    <property name="mnemonic_widget">texted</property>
                   </object>
                   <packing>
                     <property name="left_attach">0</property>
@@ -69,6 +75,8 @@
                     <property name="can_focus">False</property>
                     <property name="xalign">1</property>
                     <property name="label" translatable="yes">Target frame:</property>
+                    <property name="use_underline">True</property>
+                    <property name="mnemonic_widget">targetfrmlb</property>
                   </object>
                   <packing>
                     <property name="left_attach">0</property>
@@ -214,6 +222,8 @@
                     <property name="can_focus">False</property>
                     <property name="xalign">1</property>
                     <property name="label" translatable="yes">Visited links:</property>
+                    <property name="use_underline">True</property>
+                    <property name="mnemonic_widget">visitedlb</property>
                   </object>
                   <packing>
                     <property name="left_attach">0</property>
@@ -226,6 +236,8 @@
                     <property name="can_focus">False</property>
                     <property name="xalign">1</property>
                     <property name="label" translatable="yes">Unvisited links:</property>
+                    <property name="use_underline">True</property>
+                    <property name="mnemonic_widget">unvisitedlb</property>
                   </object>
                   <packing>
                     <property name="left_attach">0</property>
commit c27adb0c52da32421d8f2ee5c00e6d56fc2146a4
Author: Yousuf Philips <philipz85 at hotmail.com>
Date:   Sun Sep 4 08:34:52 2016 +0400

    a11y: fix missing labels in sw paragraph dialog textflow tab
    
    Change-Id: I3173cf240131788013345aa864156286affa476d
    Reviewed-on: https://gerrit.libreoffice.org/28657
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 9ea5483d9bd44b136c89e45ef96bbf3df0a7cdef)
    Reviewed-on: https://gerrit.libreoffice.org/28705
    (cherry picked from commit 27125fe629135e726bb4dd07f2a1b2d74e57548a)

diff --git a/cui/uiconfig/ui/textflowpage.ui b/cui/uiconfig/ui/textflowpage.ui
index c11f30d..0674dbc 100644
--- a/cui/uiconfig/ui/textflowpage.ui
+++ b/cui/uiconfig/ui/textflowpage.ui
@@ -116,6 +116,7 @@
                     <property name="halign">start</property>
                     <property name="label" translatable="yes">C_haracters at line end</property>
                     <property name="use_underline">True</property>
+                    <property name="mnemonic_widget">spinLineEnd</property>
                   </object>
                   <packing>
                     <property name="left_attach">1</property>
@@ -129,6 +130,7 @@
                     <property name="halign">start</property>
                     <property name="label" translatable="yes">Cha_racters at line begin</property>
                     <property name="use_underline">True</property>
+                    <property name="mnemonic_widget">spinLineBegin</property>
                   </object>
                   <packing>
                     <property name="left_attach">1</property>
@@ -142,6 +144,7 @@
                     <property name="halign">start</property>
                     <property name="label" translatable="yes">_Maximum number of consecutive hyphens</property>
                     <property name="use_underline">True</property>
+                    <property name="mnemonic_widget">spinMaxNum</property>
                   </object>
                   <packing>
                     <property name="left_attach">1</property>
@@ -209,7 +212,7 @@
                     <property name="visible">True</property>
                     <property name="can_focus">True</property>
                     <property name="receives_default">False</property>
-                    <property name="margin_left">25</property>
+                    <property name="margin_left">22</property>
                     <property name="use_underline">True</property>
                     <property name="xalign">0</property>
                     <property name="inconsistent">True</property>
commit 165394dacf610771ec24da12de0f04f2a53c84fe
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Sep 2 21:12:43 2016 +0100

    fftester: apparent wrong property tested for existence
    
    Change-Id: I5d208bb2a85d7aa4eea9b1c950eeb6f35493f759
    (cherry picked from commit a42f4aaba352a4d33ce77898e7b7b7bc0c10f1f8)
    Reviewed-on: https://gerrit.libreoffice.org/28631
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit ea8be52737f74edb89eb459bcef6d2d697ea48e4)

diff --git a/writerfilter/qa/cppunittests/rtftok/data/fail/propheight-1.rtf b/writerfilter/qa/cppunittests/rtftok/data/fail/propheight-1.rtf
new file mode 100644
index 0000000..130ff3f
Binary files /dev/null and b/writerfilter/qa/cppunittests/rtftok/data/fail/propheight-1.rtf differ
diff --git a/writerfilter/source/dmapper/PropertyMap.cxx b/writerfilter/source/dmapper/PropertyMap.cxx
index 09e6d8f..5833b9c 100644
--- a/writerfilter/source/dmapper/PropertyMap.cxx
+++ b/writerfilter/source/dmapper/PropertyMap.cxx
@@ -1307,7 +1307,7 @@ void SectionPropertyMap::CloseSectionGroup( DomainMapper_Impl& rDM_Impl )
         if( pEntry.get( ) )
         {
             boost::optional<PropertyMap::Property> pPropHeight = pEntry->pProperties->getProperty(PROP_CHAR_HEIGHT_ASIAN);
-            if(pProp)
+            if (pPropHeight)
             {
                 double fHeight = 0;
                 if( pPropHeight->second >>= fHeight )
commit 4b27f7eb13002607d9238b3893c0cf7ba6c2c85c
Author: Tor Lillqvist <tml at collabora.com>
Date:   Fri Sep 2 20:44:27 2016 +0300

    tdf#101866: Get rid of two more erroneous upper-casings of strings
    
    Follow-up to f948dce856d51704e1962553198015dbebb6e527.
    
    Change-Id: I46c5a96a076fa6eec952e31201bb3563464cf602
    Reviewed-on: https://gerrit.libreoffice.org/28626
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Tor Lillqvist <tml at collabora.com>
    (cherry picked from commit 326da3886e6f700ad1fb269df201fae9fa01d5df)
    Reviewed-on: https://gerrit.libreoffice.org/28629
    Tested-by: Jenkins <ci at libreoffice.org>
    Tested-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit f87b678a40ab73402366f409078f20425f258953)

diff --git a/sc/source/core/data/column2.cxx b/sc/source/core/data/column2.cxx
index cae5b7c..1f22912 100644
--- a/sc/source/core/data/column2.cxx
+++ b/sc/source/core/data/column2.cxx
@@ -2378,7 +2378,7 @@ bool appendToBlock(
                     if (aRes.meType == sc::FormulaResultValue::String)
                     {
                         rCxt.ensureStrArray(rColArray, nArrayLen);
-                        (*rColArray.mpStrArray)[nPos] = aRes.maString.getDataIgnoreCase();
+                        (*rColArray.mpStrArray)[nPos] = aRes.maString.getData();
                     }
                     else
                     {
@@ -2516,7 +2516,7 @@ copyFirstFormulaBlock(
                 pStrArray = rCxt.m_StrArrays.back().get();
             }
 
-            (*pStrArray)[nPos] = aRes.maString.getDataIgnoreCase();
+            (*pStrArray)[nPos] = aRes.maString.getData();
         }
     }
 
commit 4a94eb10b5d2a44de6db50e053782e9656c08f93
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Thu Sep 1 13:50:06 2016 +0200

    pTemplate can probably be null here
    
    Observed with "make clean && make CppunitTest_sw_filters_test" (which misses a
    dependency, a bug to be fixed next, so happens to not set up m_pTemplate in
    SwHTMLWriter::WriteStream, so dereferences a null pTemplate here.  Don't know
    whether there's also legitimate scenarios that can lead to a null pTemplate
    here, but at least the code in SwHTMLWriter::WriteStream setting up m_pTemplate
    takes into account that it can be set up as null, and the code in the called
    SwHTMLWriter::GetTemplateFormat takes into account that the passed in pTemplate
    (which used to be the same object as the outer pTemplate/pDoc, before breaking
    IDocumentStylePoolAccess out of SwDoc, see below) can be null.
    
    Regression introduced with 535971f3a166da6c0e44a6b7211c7f8c298f388f "Refactored
    IDocumentStylePoolAccess out of SwDoc."
    
    Change-Id: Iabb4ae2ca018ce3a19756d62b9002b245cb409cd
    (cherry picked from commit bf3c6237bb110d3eb84970e44593a7880e2e8536)
    Reviewed-on: https://gerrit.libreoffice.org/28591
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 94a3b4db75ca042ae0e134c8d497d1759f36270b)

diff --git a/sw/source/filter/html/css1atr.cxx b/sw/source/filter/html/css1atr.cxx
index 80d9e68..b6cd94a 100644
--- a/sw/source/filter/html/css1atr.cxx
+++ b/sw/source/filter/html/css1atr.cxx
@@ -1562,16 +1562,16 @@ static Writer& OutCSS1_SwFormat( Writer& rWrt, const SwFormat& rFormat,
     switch( nDeep )
     {
     case CSS1_FMT_ISTAG:
-        pRefFormat = SwHTMLWriter::GetTemplateFormat( nRefPoolId, &pTemplate->getIDocumentStylePoolAccess() );
+        pRefFormat = SwHTMLWriter::GetTemplateFormat( nRefPoolId, pTemplate == nullptr ? nullptr : &pTemplate->getIDocumentStylePoolAccess() );
         break;
     case CSS1_FMT_CMPREF:
         pRefFormat = SwHTMLWriter::GetTemplateFormat( nRefPoolId, pDoc );
-        pRefFormatScript = SwHTMLWriter::GetTemplateFormat( nRefPoolId, &pTemplate->getIDocumentStylePoolAccess() );
+        pRefFormatScript = SwHTMLWriter::GetTemplateFormat( nRefPoolId, pTemplate == nullptr ? nullptr : &pTemplate->getIDocumentStylePoolAccess() );
         bClearSame = false;
         break;
     default:
         pRefFormat = SwHTMLWriter::GetParentFormat( rFormat, nDeep );
-        pRefFormatScript = SwHTMLWriter::GetTemplateFormat( nRefPoolId, &pTemplate->getIDocumentStylePoolAccess() );
+        pRefFormatScript = SwHTMLWriter::GetTemplateFormat( nRefPoolId, pTemplate == nullptr ? nullptr : &pTemplate->getIDocumentStylePoolAccess() );
         bSetDefaults = false;
         break;
     }
commit a1723eb7275c89025ab68190942f89877ba02c44
Author: Michael Stahl <mstahl at redhat.com>
Date:   Wed Aug 24 14:46:44 2016 +0200

    libpng: upgrade to release 1.6.24
    
    Reviewed-on: https://gerrit.libreoffice.org/28364
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 1efbdfcffff97ec0834274d13abe0f0d318b5f3c)
    Reviewed-on: https://gerrit.libreoffice.org/28367
    Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
    (cherry picked from commit f90be96ed400a5471d6c3a5cfa5087957803a9fe)
    
    Change-Id: I5528522d866262655eadcfcf09c038e0c6097bb9
    Reviewed-on: https://gerrit.libreoffice.org/28553
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit c663ffa4a1a5d2ad15a5b114c15ea5484b1dbb9c)

diff --git a/download.lst b/download.lst
index 78a6565..bd68989 100755
--- a/download.lst
+++ b/download.lst
@@ -121,8 +121,8 @@ export OWNCLOUD_ANDROID_LIB_TARBALL := owncloud-android-library-0.9.4-no-binary-
 export PAGEMAKER_MD5SUM := 795cc7a59ace4db2b12586971d668671
 export PAGEMAKER_TARBALL := libpagemaker-0.0.2.tar.bz2
 export PIXMAN_TARBALL := c63f411b3ad147db2bcce1bf262a0e02-pixman-0.24.4.tar.bz2
-export PNG_MD5SUM := 3121bdc77c365a87e054b9f859f421fe
-export PNG_TARBALL := libpng-1.6.19.tar.gz
+export PNG_MD5SUM := 65213080dd30a9b16193d9b83adc1ee9
+export PNG_TARBALL := libpng-1.6.24.tar.gz
 export POPPLER_MD5SUM := 35c0660065d023365e9854c13e289d12
 export POPPLER_TARBALL := poppler-0.26.4.tar.gz
 export POSTGRESQL_TARBALL := c0b4799ea9850eae3ead14f0a60e9418-postgresql-9.2.1.tar.bz2
commit 592fb5e339075eceed4d223e3e540ba316de6e1a
Author: Michael Stahl <mstahl at redhat.com>
Date:   Mon Aug 29 13:07:03 2016 +0200

    lcms2: Out-of-bounds read in Type_MLU_Read() (rhbz#1367357)
    
    Change-Id: I9c5a442125476412435ebefea29ad1b166faab8a
    (cherry picked from commit da7d3f708d0619fdb17128ffbaa430becb79121f)
    Reviewed-on: https://gerrit.libreoffice.org/28552
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 94497dcf3006a22111f32c7335771b7e97cc9a33)

diff --git a/external/lcms2/0001-Added-an-extra-check-to-MLU-bounds.patch.1 b/external/lcms2/0001-Added-an-extra-check-to-MLU-bounds.patch.1
new file mode 100644
index 0000000..913f828
--- /dev/null
+++ b/external/lcms2/0001-Added-an-extra-check-to-MLU-bounds.patch.1
@@ -0,0 +1,25 @@
+From 5ca71a7bc18b6897ab21d815d15e218e204581e2 Mon Sep 17 00:00:00 2001
+From: Marti <marti.maria at tktbrainpower.com>
+Date: Mon, 15 Aug 2016 23:31:39 +0200
+Subject: [PATCH] Added an extra check to MLU bounds
+
+Thanks to Ibrahim el-sayed for spotting the bug
+---
+ src/cmstypes.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/cmstypes.c b/src/cmstypes.c
+index cb61860..c7328b9 100644
+--- a/src/cmstypes.c
++++ b/src/cmstypes.c
+@@ -1460,6 +1460,7 @@ void *Type_MLU_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, cmsU
+ 
+         // Check for overflow
+         if (Offset < (SizeOfHeader + 8)) goto Error;
++        if ((Offset + Len) > SizeOfTag + 8) goto Error;
+ 
+         // True begin of the string
+         BeginOfThisString = Offset - SizeOfHeader - 8;
+-- 
+2.7.4
+
diff --git a/external/lcms2/UnpackedTarball_lcms2.mk b/external/lcms2/UnpackedTarball_lcms2.mk
index 6490110..db22934 100644
--- a/external/lcms2/UnpackedTarball_lcms2.mk
+++ b/external/lcms2/UnpackedTarball_lcms2.mk
@@ -19,6 +19,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,lcms2,\
 	external/lcms2/lcms2-vc2013-project.patch \
 	external/lcms2/lcms2-config-guess.patch.0 \
 	external/lcms2/ubsan.patch.0 \
+	external/lcms2/0001-Added-an-extra-check-to-MLU-bounds.patch.1 \
 ))
 
 # vim: set noet sw=4 ts=4:


More information about the Libreoffice-commits mailing list