[Libreoffice-commits] core.git: Branch 'libreoffice-5-3' - sw/qa xmloff/source

[Michael Stahl]

 sw/qa/core/data/odt/fail/82fff64a-0a21-4b09-bbdc-2914a5a150f0.odt |binary
 xmloff/source/style/xmlnumfi.cxx                                  |    5 +++++
 2 files changed, 5 insertions(+)

New commits:
commit f07bb0fed885f7a13c08f2bc3203e727db7cef1c
Author: Michael Stahl <mstahl at redhat.com>
Date:   Thu Aug 24 13:56:35 2017 +0200

    tdf#111934 xmloff: ODF import: self-referential conditional style crash
    
    It's invalid input and also causes stack overflow.
    
    (cherry picked from commit 9fe857b7bd126ff4856fc4689d375881653b97a2)
    
    tdf#111934: add document for filters-tests
    Thanks to infostud91 at gmail.com for the document; unfortunately git
    tells me that i can't set the commit author to just an email address.
    (cherry picked from commit 6e090b4272b8fa12d2032ff0c0ea4bfb24c0d2d2)
    
    Change-Id: Ie0b9dcaefcfcf254326151f345f4802ed66b994d
    Reviewed-on: https://gerrit.libreoffice.org/41535
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/qa/core/data/odt/fail/82fff64a-0a21-4b09-bbdc-2914a5a150f0.odt b/sw/qa/core/data/odt/fail/82fff64a-0a21-4b09-bbdc-2914a5a150f0.odt
new file mode 100644
index 000000000000..7d823df75213
Binary files /dev/null and b/sw/qa/core/data/odt/fail/82fff64a-0a21-4b09-bbdc-2914a5a150f0.odt differ
diff --git a/xmloff/source/style/xmlnumfi.cxx b/xmloff/source/style/xmlnumfi.cxx
index ccd8158ead14..85c6cfe47289 100644
--- a/xmloff/source/style/xmlnumfi.cxx
+++ b/xmloff/source/style/xmlnumfi.cxx
@@ -1692,6 +1692,11 @@ sal_Int32 SvXMLNumFormatContext::CreateAndInsert(SvNumberFormatter* pFormatter)
     {
         SvXMLNumFormatContext* pStyle = const_cast<SvXMLNumFormatContext*>( static_cast<const SvXMLNumFormatContext *>(pStyles->FindStyleChildContext(
             XML_STYLE_FAMILY_DATA_STYLE, aMyConditions[i].sMapName)));
+        if (this == pStyle)
+        {
+            SAL_INFO("xmloff.style", "invalid style:map references containing style");
+            pStyle = nullptr;
+        }
         if (pStyle)
         {
             if ((pStyle->PrivateGetKey() > -1))     // don't reset pStyle's bRemoveAfterUse flag