[Libreoffice-commits] core.git: Branch 'distro/collabora/cp-5.1' - 132 commits - accessibility/source basctl/source basic/source connectivity/source cppcanvas/source cui/source dbaccess/qa dbaccess/source download.lst dtrans/source editeng/source external/curl filter/qa filter/source include/editeng include/oox include/sal include/sfx2 include/vcl librelogo/source officecfg/registry oox/source sal/textenc sc/inc sc/qa sc/source sd/inc sd/qa sd/source sfx2/source shell/source slideshow/Library_OGLTrans.mk slideshow/source svx/source sw/inc sw/qa sw/source toolkit/source tools/inc tools/source vcl/inc vcl/source vcl/unx wizards/com wizards/source writerfilter/source xmloff/source

Miklos Vajna vmiklos at collabora.co.uk
Wed Feb 8 12:38:22 UTC 2017


 accessibility/source/standard/vclxaccessiblebox.cxx             |    2 
 accessibility/source/standard/vclxaccessibletabcontrol.cxx      |   11 
 basctl/source/dlged/managelang.cxx                              |   19 
 basic/source/uno/dlgcont.cxx                                    |    6 
 connectivity/source/drivers/dbase/dindexnode.cxx                |    1 
 connectivity/source/drivers/jdbc/Reader.cxx                     |    2 
 connectivity/source/drivers/odbc/OTools.cxx                     |    1 
 cppcanvas/source/inc/implrenderer.hxx                           |    2 
 cui/source/factory/init.cxx                                     |    2 
 cui/source/tabpages/textattr.cxx                                |   10 
 dbaccess/qa/complex/dbaccess/RowSet.java                        |    7 
 dbaccess/source/ui/misc/TokenWriter.cxx                         |    3 
 download.lst                                                    |    8 
 dtrans/source/win32/dtobj/XTDataObject.cxx                      |   38 
 dtrans/source/win32/dtobj/XTDataObject.hxx                      |    3 
 editeng/source/editeng/editeng.cxx                              |    4 
 editeng/source/editeng/editundo.cxx                             |    2 
 editeng/source/editeng/impedit.cxx                              |    5 
 editeng/source/editeng/impedit.hxx                              |    2 
 editeng/source/editeng/impedit3.cxx                             |    6 
 editeng/source/items/frmitems.cxx                               |   12 
 editeng/source/misc/svxacorr.cxx                                |    6 
 external/curl/curl-7.26.0_win-proxy.patch                       |   16 
 external/curl/curl-msvc.patch.1                                 |    8 
 filter/qa/cppunit/data/dxf/pass/loop-1.dxf                      |17320 ++++++++++
 filter/qa/cppunit/data/dxf/pass/loop-2.dxf                      |13974 ++++++++
 filter/source/graphicfilter/idxf/dxf2mtf.cxx                    |    6 
 filter/source/graphicfilter/idxf/dxfentrd.cxx                   |   15 
 filter/source/graphicfilter/idxf/dxfentrd.hxx                   |   25 
 filter/source/graphicfilter/idxf/dxfgrprd.cxx                   |    4 
 filter/source/graphicfilter/idxf/dxfgrprd.hxx                   |    1 
 filter/source/graphicfilter/idxf/dxfreprd.cxx                   |    7 
 filter/source/graphicfilter/idxf/dxfreprd.hxx                   |    2 
 filter/source/graphicfilter/ieps/ieps.cxx                       |  168 
 filter/source/graphicfilter/ios2met/ios2met.cxx                 |    4 
 filter/source/xslt/import/spreadsheetml/spreadsheetml2ooo.xsl   |    4 
 include/editeng/boxitem.hxx                                     |    5 
 include/editeng/editeng.hxx                                     |    2 
 include/oox/ole/vbaproject.hxx                                  |    6 
 include/sal/log-areas.dox                                       |    1 
 include/sfx2/app.hxx                                            |    2 
 include/sfx2/sidebar/SidebarController.hxx                      |   10 
 include/vcl/svapp.hxx                                           |    4 
 librelogo/source/LibreLogo/LibreLogo.py                         |    8 
 officecfg/registry/schema/org/openoffice/Office/Impress.xcs     |    2 
 oox/source/ole/vbaproject.cxx                                   |    5 
 oox/source/ppt/presentationfragmenthandler.cxx                  |   21 
 sal/textenc/tcvtjp6.tab                                         |    6 
 sc/inc/dpobject.hxx                                             |    2 
 sc/inc/dpsave.hxx                                               |    2 
 sc/inc/formulacell.hxx                                          |    9 
 sc/inc/markdata.hxx                                             |   13 
 sc/qa/unit/data/ods/custom_column_width.ods                     |binary
 sc/qa/unit/data/ods/different-column-width.ods                  |binary
 sc/qa/unit/data/ods/hidden-empty-rows.ods                       |binary
 sc/qa/unit/data/ods/outline.ods                                 |binary
 sc/qa/unit/data/xlsx/different-column-width-excel2010.xlsx      |binary
 sc/qa/unit/data/xlsx/pivot-table/shared-dategroup.xlsx          |binary
 sc/qa/unit/data/xlsx/pivot-table/shared-nested-dategroup.xlsx   |binary
 sc/qa/unit/data/xlsx/pivot-table/shared-numgroup.xlsx           |binary
 sc/qa/unit/data/xlsx/pivot-table/shared_group.xlsx              |binary
 sc/qa/unit/data/xlsx/xf_default_values.xlsx                     |binary
 sc/qa/unit/helper/xpath.cxx                                     |    6 
 sc/qa/unit/helper/xpath.hxx                                     |   17 
 sc/qa/unit/subsequent_export-test.cxx                           |  421 
 sc/qa/unit/subsequent_filters-test.cxx                          |  150 
 sc/source/core/data/clipcontext.cxx                             |    7 
 sc/source/core/data/column.cxx                                  |   18 
 sc/source/core/data/documen2.cxx                                |   15 
 sc/source/core/data/dpcache.cxx                                 |    5 
 sc/source/core/data/dpobject.cxx                                |   80 
 sc/source/core/data/formulacell.cxx                             |   40 
 sc/source/core/data/markdata.cxx                                |   25 
 sc/source/core/data/table3.cxx                                  |    7 
 sc/source/core/data/table4.cxx                                  |    8 
 sc/source/core/tool/cellkeytranslator.cxx                       |    6 
 sc/source/core/tool/compare.cxx                                 |    5 
 sc/source/core/tool/compiler.cxx                                |   40 
 sc/source/core/tool/interpr1.cxx                                |    6 
 sc/source/core/tool/interpr3.cxx                                |    9 
 sc/source/core/tool/refdata.cxx                                 |    4 
 sc/source/core/tool/token.cxx                                   |   67 
 sc/source/filter/excel/xepage.cxx                               |    5 
 sc/source/filter/excel/xetable.cxx                              |   94 
 sc/source/filter/excel/xeview.cxx                               |    2 
 sc/source/filter/excel/xiescher.cxx                             |    2 
 sc/source/filter/excel/xilink.cxx                               |   12 
 sc/source/filter/inc/defnamesbuffer.hxx                         |    4 
 sc/source/filter/inc/pivotcachebuffer.hxx                       |    7 
 sc/source/filter/inc/pivottablebuffer.hxx                       |   10 
 sc/source/filter/inc/xetable.hxx                                |   11 
 sc/source/filter/inc/xltable.hxx                                |    1 
 sc/source/filter/oox/defnamesbuffer.cxx                         |   10 
 sc/source/filter/oox/pivotcachebuffer.cxx                       |    5 
 sc/source/filter/oox/pivottablebuffer.cxx                       |   77 
 sc/source/filter/oox/workbookfragment.cxx                       |    3 
 sc/source/filter/oox/worksheetfragment.cxx                      |    5 
 sc/source/filter/oox/worksheethelper.cxx                        |   22 
 sc/source/filter/xml/xmlcelli.cxx                               |   19 
 sc/source/ui/Accessibility/AccessibleDocument.cxx               |    2 
 sc/source/ui/dbgui/PivotLayoutDialog.cxx                        |   17 
 sc/source/ui/dbgui/PivotLayoutTreeListBase.cxx                  |   23 
 sc/source/ui/dbgui/PivotLayoutTreeListLabel.cxx                 |    7 
 sc/source/ui/docshell/dbdocfun.cxx                              |   54 
 sc/source/ui/docshell/externalrefmgr.cxx                        |    2 
 sc/source/ui/inc/PivotLayoutDialog.hxx                          |    5 
 sc/source/ui/inc/PivotLayoutTreeListBase.hxx                    |    3 
 sc/source/ui/unoobj/dapiuno.cxx                                 |    2 
 sc/source/ui/view/cellsh1.cxx                                   |    1 
 sc/source/ui/view/tabcont.cxx                                   |    3 
 sd/inc/glob.hrc                                                 |    6 
 sd/qa/unit/data/pptx/tdf103473.pptx                             |binary
 sd/qa/unit/import-tests.cxx                                     |   18 
 sd/qa/unit/misc-tests.cxx                                       |   22 
 sd/qa/unit/tiledrendering/data/tdf103083.fodp                   |  932 
 sd/qa/unit/tiledrendering/tiledrendering.cxx                    |   70 
 sd/source/core/glob.src                                         |    9 
 sd/source/ui/dlg/PhotoAlbumDialog.cxx                           |    2 
 sd/source/ui/func/futext.cxx                                    |    2 
 sd/source/ui/inc/DrawViewShell.hxx                              |    2 
 sd/source/ui/view/Outliner.cxx                                  |    5 
 sd/source/ui/view/sdview.cxx                                    |   43 
 sfx2/source/control/unoctitm.cxx                                |   12 
 sfx2/source/dialog/dinfdlg.cxx                                  |    6 
 sfx2/source/doc/docfile.cxx                                     |    3 
 sfx2/source/sidebar/SidebarController.cxx                       |   14 
 shell/source/unix/misc/senddoc.sh                               |   10 
 slideshow/Library_OGLTrans.mk                                   |    4 
 slideshow/source/engine/OGLTrans/generic/OGLTrans_Operation.cxx |    8 
 svx/source/sdr/contact/viewcontactofsdrpathobj.cxx              |   39 
 svx/source/sdr/properties/textproperties.cxx                    |   20 
 svx/source/sidebar/tools/Popup.cxx                              |    2 
 svx/source/svdraw/svdotext.cxx                                  |   16 
 sw/inc/ndarr.hxx                                                |    2 
 sw/qa/core/data/rtf/fail/table-3.rtf                            |binary
 sw/qa/extras/ooxmlexport/data/tdf103001.docx                    |binary
 sw/qa/extras/ooxmlexport/data/tdf103544.docx                    |binary
 sw/qa/extras/ooxmlexport/data/tdf103573.docx                    |binary
 sw/qa/extras/ooxmlexport/data/tdf103982.docx                    |binary
 sw/qa/extras/ooxmlexport/data/tdf95031.docx                     |binary
 sw/qa/extras/ooxmlexport/ooxmlexport.cxx                        |   10 
 sw/qa/extras/ooxmlexport/ooxmlexport4.cxx                       |   13 
 sw/qa/extras/ooxmlexport/ooxmlexport7.cxx                       |   40 
 sw/qa/extras/ooxmlimport/data/tdf82824.docx                     |binary
 sw/qa/extras/ooxmlimport/ooxmlimport.cxx                        |   16 
 sw/qa/extras/uiwriter/data/tdf104814.docx                       |binary
 sw/qa/extras/uiwriter/uiwriter.cxx                              |   14 
 sw/source/core/access/accfrmobj.cxx                             |   12 
 sw/source/core/doc/DocumentRedlineManager.cxx                   |    4 
 sw/source/core/doc/notxtfrm.cxx                                 |   16 
 sw/source/core/docnode/ndtbl.cxx                                |    2 
 sw/source/core/edit/autofmt.cxx                                 |    2 
 sw/source/core/layout/colfrm.cxx                                |    6 
 sw/source/core/layout/flowfrm.cxx                               |    2 
 sw/source/core/unocore/unoobj.cxx                               |    7 
 sw/source/core/unocore/unotext.cxx                              |    2 
 sw/source/filter/ww8/docxattributeoutput.cxx                    |   32 
 sw/source/filter/ww8/docxattributeoutput.hxx                    |    7 
 sw/source/filter/ww8/docxexport.cxx                             |    8 
 sw/source/filter/ww8/docxsdrexport.cxx                          |   13 
 sw/source/filter/ww8/ww8atr.cxx                                 |    2 
 sw/source/filter/ww8/ww8par6.cxx                                |    5 
 sw/source/filter/ww8/ww8scan.hxx                                |    1 
 sw/source/uibase/inc/conttree.hxx                               |    1 
 sw/source/uibase/uiview/view.cxx                                |   13 
 sw/source/uibase/uno/SwXDocumentSettings.cxx                    |   16 
 sw/source/uibase/utlui/content.cxx                              |  144 
 sw/source/uibase/utlui/navipi.cxx                               |    2 
 toolkit/source/awt/asynccallback.cxx                            |    3 
 tools/inc/poly.h                                                |    2 
 tools/source/generic/poly.cxx                                   |   13 
 vcl/inc/headless/svpgdi.hxx                                     |    1 
 vcl/source/control/edit.cxx                                     |    2 
 vcl/source/control/spinfld.cxx                                  |    4 
 vcl/source/filter/ixbm/xbmread.cxx                              |    4 
 vcl/source/filter/ixpm/xpmread.cxx                              |    4 
 vcl/source/filter/wmf/emfwr.cxx                                 |    1 
 vcl/source/filter/wmf/enhwmf.cxx                                |   17 
 vcl/source/filter/wmf/winmtf.cxx                                |    4 
 vcl/source/filter/wmf/winwmf.cxx                                |    5 
 vcl/source/gdi/cvtsvm.cxx                                       |  115 
 vcl/source/gdi/dibtools.cxx                                     |   66 
 vcl/source/gdi/mapmod.cxx                                       |    3 
 vcl/source/gdi/metaact.cxx                                      |    2 
 vcl/source/gdi/pdfwriter_impl.cxx                               |   23 
 vcl/unx/gtk/a11y/atklistener.cxx                                |    3 
 vcl/unx/gtk3/gtk3gtkframe.cxx                                   |   45 
 vcl/unx/gtk3/gtk3salnativewidgets-gtk.cxx                       |    2 
 vcl/unx/kde4/KDESalGraphics.cxx                                 |    6 
 wizards/com/sun/star/wizards/web/BackgroundsDialog.py           |   20 
 wizards/source/importwizard/DialogModul.xba                     |    2 
 wizards/source/importwizard/FilesModul.xba                      |    2 
 wizards/source/tools/ModuleControls.xba                         |    2 
 wizards/source/tools/Strings.xba                                |    2 
 writerfilter/source/dmapper/DomainMapper.cxx                    |    6 
 writerfilter/source/dmapper/DomainMapperTableManager.cxx        |    4 
 writerfilter/source/dmapper/DomainMapper_Impl.cxx               |   43 
 xmloff/source/draw/shapeexport.cxx                              |   17 
 xmloff/source/style/escphdl.cxx                                 |    2 
 xmloff/source/text/txtparae.cxx                                 |    3 
 200 files changed, 34510 insertions(+), 703 deletions(-)

New commits:
commit 77c7a319a702f3165d34d3390ea8432071363097
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Wed Feb 1 10:52:19 2017 +0100

    tdf#105461 PDF export: handle text fill color
    
    Text portion level background in Writer text was working already, as
    Writer paints its background explicitly, and then uses no text fill
    color in the metafile (that is turned into a PDF later).
    
    However, text fill color is used for Writer shape text and also in
    Impress. The rectangle is not just the text itself, but also the ascent
    / descent region, this matches the desktop rendering result.
    
    (cherry picked from commit ee32c7d8083ae1449d6b379034be92995c142da9)
    
    Change-Id: I644007ade43a8b9e663890643b826ae12c427ea5
    Reviewed-on: https://gerrit.libreoffice.org/33795
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 264f2265884b3d50103a5315c6bd46df3be04451)

diff --git a/vcl/source/gdi/pdfwriter_impl.cxx b/vcl/source/gdi/pdfwriter_impl.cxx
index e914c06..d1c4364 100644
--- a/vcl/source/gdi/pdfwriter_impl.cxx
+++ b/vcl/source/gdi/pdfwriter_impl.cxx
@@ -9063,6 +9063,29 @@ void PDFWriterImpl::drawLayout( SalLayout& rLayout, const OUString& rText, bool
         }
     }
 
+    if (m_aCurrentPDFState.m_aFont.GetFillColor() != Color(COL_TRANSPARENT))
+    {
+        // PDF doesn't have a text fill color, so draw a rectangle before
+        // drawing the actual text.
+        push(PushFlags::FILLCOLOR | PushFlags::LINECOLOR);
+        setFillColor(m_aCurrentPDFState.m_aFont.GetFillColor());
+        // Avoid border around the rectangle for Writer shape text.
+        setLineColor(Color(COL_TRANSPARENT));
+
+        // The rectangle is the bounding box of the text, but also includes
+        // ascent / descent to match the on-screen rendering.
+        Rectangle aRectangle;
+        // This is the top left of the text without ascent / descent.
+        aRectangle.SetPos(m_pReferenceDevice->PixelToLogic(rLayout.GetDrawPosition()));
+        aRectangle.setY(aRectangle.getY() - aRefDevFontMetric.GetAscent());
+        aRectangle.SetSize(m_pReferenceDevice->PixelToLogic(Size(rLayout.GetTextWidth(), 0)));
+        // This includes ascent / descent.
+        aRectangle.setHeight(aRefDevFontMetric.GetLineHeight());
+        drawRectangle(aRectangle);
+
+        pop();
+    }
+
     Point aAlignOffset;
     if ( eAlign == ALIGN_BOTTOM )
         aAlignOffset.Y() -= aRefDevFontMetric.GetDescent();
commit e5a528017fccc01f4e250583d47063d5224600e1
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Feb 2 16:02:42 2017 +0000

    bffvalidator: animated text srpm has 1 byte payload, not 2
    
    which is why my sample document creates a .doc which triggers
    word's safe mode
    
    this has been wrong since initial impl in
    
    commit 4d5c193b2fd38c6cab049fcb97189462fff0fddb
    ...
        2003/07/17 14:13:17 mmaher 1.64.6.6: #110851# Added support for animated text effects
    
    a mere 13+ years ago
    
    Change-Id: I8c4d95dac8e03f6523a2a036f0100f425f787a13
    (cherry picked from commit 6263d03d538f014af2e17a4ecf3d218387ba5219)
    Reviewed-on: https://gerrit.libreoffice.org/33838
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 398fd59c9047c49f0fe39fdd877eef610d095eaf)

diff --git a/sw/source/filter/ww8/ww8atr.cxx b/sw/source/filter/ww8/ww8atr.cxx
index 47b4e4d..9f934f1 100644
--- a/sw/source/filter/ww8/ww8atr.cxx
+++ b/sw/source/filter/ww8/ww8atr.cxx
@@ -1125,7 +1125,7 @@ void WW8AttributeOutput::CharAnimatedText( const SvxBlinkItem& rBlink )
 {
     m_rWW8Export.InsUInt16( NS_sprm::LN_CSfxText );
     // At the moment the only animated text effect we support is blinking
-    m_rWW8Export.InsUInt16( rBlink.GetValue() ? 2 : 0 );
+    m_rWW8Export.pO->push_back( rBlink.GetValue() ? 2 : 0 );
 }
 
 void WW8AttributeOutput::CharCrossedOut( const SvxCrossedOutItem& rCrossed )
commit 74fb2d0883960600bd27de65fdfc192b64cdb265
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Jan 29 20:54:56 2017 +0000

    Resolves: ofz#488 check remaining size while parsing
    
    Change-Id: Ibb2b6c59a159f9fafa6a065be438b59a6d2d3f21
    Reviewed-on: https://gerrit.libreoffice.org/33666
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 9176d089b6a65649f136e20ec260311535d26948)

diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx
index 3feb823..cd6ead6 100644
--- a/filter/source/graphicfilter/ieps/ieps.cxx
+++ b/filter/source/graphicfilter/ieps/ieps.cxx
@@ -37,6 +37,7 @@
 #include <osl/file.hxx>
 #include <osl/thread.h>
 #include <memory>
+#include <algorithm>
 
 class FilterConfigItem;
 
@@ -460,7 +461,6 @@ void MakePreview(sal_uInt8* pBuf, sal_uInt32 nBytesRead,
     pVDev->SetFillColor();
 
     aFont.SetColor( COL_LIGHTRED );
-//  aFont.SetSize( Size( 0, 32 ) );
 
     pVDev->Push( PushFlags::FONT );
     pVDev->SetFont( aFont );
@@ -471,51 +471,77 @@ void MakePreview(sal_uInt8* pBuf, sal_uInt32 nBytesRead,
     OUString aString;
     int nLen;
     sal_uInt8* pDest = ImplSearchEntry( pBuf, reinterpret_cast<sal_uInt8 const *>("%%Title:"), nBytesRead - 32, 8 );
-    if ( pDest )
+    sal_uInt32 nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf)) : 0;
+    if (nRemainingBytes >= 8)
     {
         pDest += 8;
-        if ( *pDest == ' ' )
-            pDest++;
-        nLen = ImplGetLen( pDest, 32 );
-        sal_uInt8 aOldValue(pDest[ nLen ]); pDest[ nLen ] = 0;
-        if ( strcmp( reinterpret_cast<char*>(pDest), "none" ) != 0 )
+        nRemainingBytes -= 8;
+        if (nRemainingBytes && *pDest == ' ')
         {
-            aString += " Title:" + OUString::createFromAscii( reinterpret_cast<char*>(pDest) ) + "\n";
+            ++pDest;
+            --nRemainingBytes;
+        }
+        nLen = ImplGetLen(pDest, std::min<sal_uInt32>(nRemainingBytes, 32));
+        if (static_cast<sal_uInt32>(nLen) < nRemainingBytes)
+        {
+            sal_uInt8 aOldValue(pDest[ nLen ]); pDest[ nLen ] = 0;
+            if ( strcmp( reinterpret_cast<char*>(pDest), "none" ) != 0 )
+            {
+                aString += " Title:" + OUString::createFromAscii( reinterpret_cast<char*>(pDest) ) + "\n";
+            }
+            pDest[ nLen ] = aOldValue;
         }
-        pDest[ nLen ] = aOldValue;
     }
     pDest = ImplSearchEntry( pBuf, reinterpret_cast<sal_uInt8 const *>("%%Creator:"), nBytesRead - 32, 10 );
-    if ( pDest )
+    nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf)) : 0;
+    if (nRemainingBytes >= 10)
     {
         pDest += 10;
-        if ( *pDest == ' ' )
-            pDest++;
-        nLen = ImplGetLen( pDest, 32 );
-        sal_uInt8 aOldValue(pDest[ nLen ]); pDest[ nLen ] = 0;
-        aString += " Creator:" + OUString::createFromAscii( reinterpret_cast<char*>(pDest) ) + "\n";
-        pDest[ nLen ] = aOldValue;
+        nRemainingBytes -= 10;
+        if (nRemainingBytes && *pDest == ' ')
+        {
+            ++pDest;
+            --nRemainingBytes;
+        }
+        nLen = ImplGetLen(pDest, std::min<sal_uInt32>(nRemainingBytes, 32));
+        if (static_cast<sal_uInt32>(nLen) < nRemainingBytes)
+        {
+            sal_uInt8 aOldValue(pDest[nLen]); pDest[nLen] = 0;
+            aString += " Creator:" + OUString::createFromAscii( reinterpret_cast<char*>(pDest) ) + "\n";
+            pDest[nLen] = aOldValue;
+        }
     }
     pDest = ImplSearchEntry( pBuf, reinterpret_cast<sal_uInt8 const *>("%%CreationDate:"), nBytesRead - 32, 15 );
-    if ( pDest )
+    nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf)) : 0;
+    if (nRemainingBytes >= 15)
     {
         pDest += 15;
-        if ( *pDest == ' ' )
-            pDest++;
-        nLen = ImplGetLen( pDest, 32 );
-        sal_uInt8 aOldValue(pDest[ nLen ]); pDest[ nLen ] = 0;
-        if ( strcmp( reinterpret_cast<char*>(pDest), "none" ) != 0 )
+        nRemainingBytes -= 15;
+        if (nRemainingBytes && *pDest == ' ')
+        {
+            ++pDest;
+            --nRemainingBytes;
+        }
+        nLen = ImplGetLen(pDest, std::min<sal_uInt32>(nRemainingBytes, 32));
+        if (static_cast<sal_uInt32>(nLen) < nRemainingBytes)
         {
-            aString += " CreationDate:" + OUString::createFromAscii( reinterpret_cast<char*>(pDest) ) + "\n";
+            sal_uInt8 aOldValue(pDest[ nLen ]); pDest[ nLen ] = 0;
+            if ( strcmp( reinterpret_cast<char*>(pDest), "none" ) != 0 )
+            {
+                aString += " CreationDate:" + OUString::createFromAscii( reinterpret_cast<char*>(pDest) ) + "\n";
+            }
+            pDest[ nLen ] = aOldValue;
         }
-        pDest[ nLen ] = aOldValue;
     }
     pDest = ImplSearchEntry( pBuf, reinterpret_cast<sal_uInt8 const *>("%%LanguageLevel:"), nBytesRead - 4, 16 );
-    if ( pDest )
+    nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf)) : 0;
+    if (nRemainingBytes >= 16)
     {
         pDest += 16;
-        sal_uInt32 nCount = 4;
-        long nNumber = ImplGetNumber(pDest, nCount);
-        if ( nCount && ( (sal_uInt32)nNumber < 10 ) )
+        nRemainingBytes -= 16;
+        sal_uInt32 nCount = std::min<sal_uInt32>(nRemainingBytes, 4U);
+        sal_uInt32 nNumber = ImplGetNumber(pDest, nCount);
+        if (nCount && nNumber < 10)
         {
             aString += " LanguageLevel:" + OUString::number( nNumber );
         }
commit 4c2efeca6910f725335b40702f019fcb00c67463
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Jan 31 14:29:18 2017 +0000

    Resolves: tdf#104884 print preview replaces the frame controller
    
    so the sidebar is listening to the old controller which has been disposed[1] so
    when print preview exits and yet another controller replaces the print preview
    one then the sidebar still doesn't listen to the current one.
    
    framework broadcasts COMPONENT_DETACHING/COMPONENT_REATTACHED around these
    changes, so if we listen to them we can keep attached to whatever is the
    current component
    
    [1] note that ContextChangeEventMultipler doesn't inform clients that the
    controller has been disposed, this remains unchanged here
    
    Reviewed-on: https://gerrit.libreoffice.org/33758
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 3e27ba70ce212642026874ba73021930a06cdbbd)
    
    Change-Id: I141509d4a262307afd7dcfc3d77de6cdd6dbfa5f
    Reviewed-on: https://gerrit.libreoffice.org/33767
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit fe85d526323ef562504289c2a0d76a1af94e7a82)

diff --git a/include/sfx2/sidebar/SidebarController.hxx b/include/sfx2/sidebar/SidebarController.hxx
index 7e4096f..fca5ea8 100644
--- a/include/sfx2/sidebar/SidebarController.hxx
+++ b/include/sfx2/sidebar/SidebarController.hxx
@@ -39,16 +39,18 @@
 
 #include <boost/optional.hpp>
 #include <cppuhelper/compbase4.hxx>
+#include <cppuhelper/compbase5.hxx>
 #include <cppuhelper/basemutex.hxx>
 
 
 namespace
 {
-    typedef ::cppu::WeakComponentImplHelper4 <
+    typedef ::cppu::WeakComponentImplHelper5 <
         css::ui::XContextChangeEventListener,
         css::beans::XPropertyChangeListener,
         css::ui::XSidebar,
-        css::frame::XStatusListener
+        css::frame::XStatusListener,
+        css::frame::XFrameActionListener
         > SidebarControllerInterfaceBase;
 }
 
@@ -105,6 +107,10 @@ public:
     virtual void SAL_CALL statusChanged (const css::frame::FeatureStateEvent& rEvent)
         throw(css::uno::RuntimeException, std::exception) override;
 
+    // frame::XFrameActionListener
+    virtual void SAL_CALL frameAction (const css::frame::FrameActionEvent& rEvent)
+        throw (com::sun::star::uno::RuntimeException, std::exception) override;
+
     // ui::XSidebar
     virtual void SAL_CALL requestLayout()
         throw(css::uno::RuntimeException, std::exception) override;
diff --git a/sfx2/source/sidebar/SidebarController.cxx b/sfx2/source/sidebar/SidebarController.cxx
index fe73d2c..009a3cb 100644
--- a/sfx2/source/sidebar/SidebarController.cxx
+++ b/sfx2/source/sidebar/SidebarController.cxx
@@ -120,6 +120,7 @@ SidebarController::SidebarController (
     mpResourceManager = std::unique_ptr<ResourceManager>(new ResourceManager());
 
     registerSidebarForFrame(this, mxFrame->getController());
+    rxFrame->addFrameActionListener(this);
     // Listen for window events.
     mpParentWindow->AddEventListener(LINK(this, SidebarController, WindowEventHandler));
 
@@ -186,6 +187,7 @@ void SidebarController::unregisterSidebarForFrame(SidebarController* pController
 
 void SidebarController::disposeDecks()
 {
+    SolarMutexGuard aSolarMutexGuard;
     mpCurrentDeck.clear();
     maFocusManager.Clear();
     mpResourceManager->disposeDecks();
@@ -230,6 +232,7 @@ void SAL_CALL SidebarController::disposing()
     if (!xController.is())
         xController = mxCurrentController;
 
+    mxFrame->removeFrameActionListener(this);
     unregisterSidebarForFrame(this, xController);
 
     if (mxReadOnlyModeDispatch.is())
@@ -1304,6 +1307,17 @@ void SidebarController::updateModel(css::uno::Reference<css::frame::XModel> xMod
     mpResourceManager->UpdateModel(xModel);
 }
 
+void SidebarController::frameAction(const css::frame::FrameActionEvent& rEvent)
+     throw (com::sun::star::uno::RuntimeException, std::exception)
+{
+    if (rEvent.Frame == mxFrame)
+    {
+        if (rEvent.Action == css::frame::FrameAction_COMPONENT_DETACHING)
+            unregisterSidebarForFrame(this, mxFrame->getController());
+        else if (rEvent.Action == css::frame::FrameAction_COMPONENT_REATTACHED)
+            registerSidebarForFrame(this, mxFrame->getController());
+    }
+}
 
 } } // end of namespace sfx2::sidebar
 
commit a9a7ffc68eed6e8ce39e209f4196b4e98f238446
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 1 10:06:53 2017 +0000

    with navigator in sidebar, press space, crash
    
    because root entries have UserData of type SwContentType while children have
    UserData of type SwContent (both inherit from SwTypeNumber)
    
    (cherry picked from commit dfdd01d12226cfbd9b9d2618bd9da71191bfc4b9)
    
    turn switch with one case into if
    
    Change-Id: I413f195bb5571eb536e948a7e9ffb982b3619e65
    (cherry picked from commit 567cd9043c09e42d8521a6b81545994ae4539beb)
    
    Change-Id: Iab7a4caaca5dfdae16aa4f6ede565e26aa4c73c9
    Reviewed-on: https://gerrit.libreoffice.org/33784
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 70784f06ebd592070c85ffb93dfdbaa4322a55d4)

diff --git a/sw/source/uibase/utlui/content.cxx b/sw/source/uibase/utlui/content.cxx
index 17f2a19..e5b00f1 100644
--- a/sw/source/uibase/utlui/content.cxx
+++ b/sw/source/uibase/utlui/content.cxx
@@ -2631,86 +2631,81 @@ void SwContentTree::KeyInput(const KeyEvent& rEvent)
                     m_pActiveShell->GetView().GetViewFrame()->GetWindow().ToTop();
                 }
 
-                SwContent* pCnt = static_cast<SwContent*>(pEntry->GetUserData());
+                SwContent* pCnt = dynamic_cast<SwContent*>(static_cast<SwTypeNumber*>(pEntry->GetUserData()));
 
-                switch(pCnt->GetParent()->GetType())
+                if (pCnt && pCnt->GetParent()->GetType() == ContentTypeId::DRAWOBJECT)
                 {
-                    case ContentTypeId::DRAWOBJECT:
+                    SdrView* pDrawView = m_pActiveShell->GetDrawView();
+                    if (pDrawView)
                     {
-                        SdrView* pDrawView = m_pActiveShell->GetDrawView();
-                        if (pDrawView)
-                        {
-                            pDrawView->SdrEndTextEdit();//Change from "EndTextEdit" to "SdrEndTextEdit" for acc migration
+                        pDrawView->SdrEndTextEdit();//Change from "EndTextEdit" to "SdrEndTextEdit" for acc migration
 
-                            SwDrawModel* pDrawModel = m_pActiveShell->GetDoc()->getIDocumentDrawModelAccess().GetDrawModel();
-                            SdrPage* pPage = pDrawModel->GetPage(0);
-                            const size_t nCount = pPage->GetObjCount();
-                            bool hasObjectMarked = false;
+                        SwDrawModel* pDrawModel = m_pActiveShell->GetDoc()->getIDocumentDrawModelAccess().GetDrawModel();
+                        SdrPage* pPage = pDrawModel->GetPage(0);
+                        const size_t nCount = pPage->GetObjCount();
+                        bool hasObjectMarked = false;
 
-                            SdrObject* pObject = nullptr;
-                            pObject = GetDrawingObjectsByContent( pCnt );
-                            if( pObject )
+                        SdrObject* pObject = nullptr;
+                        pObject = GetDrawingObjectsByContent( pCnt );
+                        if( pObject )
+                        {
+                            SdrPageView* pPV = pDrawView->GetSdrPageView/*GetPageViewPvNum*/(/*0*/);
+                            if( pPV )
                             {
-                                SdrPageView* pPV = pDrawView->GetSdrPageView/*GetPageViewPvNum*/(/*0*/);
-                                if( pPV )
-                                {
-                                    bool bUnMark = pDrawView->IsObjMarked(pObject);
-                                    pDrawView->MarkObj( pObject, pPV, bUnMark);
+                                bool bUnMark = pDrawView->IsObjMarked(pObject);
+                                pDrawView->MarkObj( pObject, pPV, bUnMark);
 
-                                }
                             }
-                            for( size_t i=0; i<nCount; ++i )
+                        }
+                        for( size_t i=0; i<nCount; ++i )
+                        {
+                            SdrObject* pTemp = pPage->GetObj(i);
+                            bool bMark = pDrawView->IsObjMarked(pTemp);
+                            switch( pTemp->GetObjIdentifier() )
                             {
-                                SdrObject* pTemp = pPage->GetObj(i);
-                                bool bMark = pDrawView->IsObjMarked(pTemp);
-                                switch( pTemp->GetObjIdentifier() )
-                                {
-                                    case OBJ_GRUP:
-                                    case OBJ_TEXT:
-                                    case OBJ_TEXTEXT:
-                                    case OBJ_wegFITTEXT:
-                                    case OBJ_LINE:
-                                    case OBJ_RECT:
-                                    case OBJ_CIRC:
-                                    case OBJ_SECT:
-                                    case OBJ_CARC:
-                                    case OBJ_CCUT:
-                                    case OBJ_POLY:
-                                    case OBJ_PLIN:
-                                    case OBJ_PATHLINE:
-                                    case OBJ_PATHFILL:
-                                    case OBJ_FREELINE:
-                                    case OBJ_FREEFILL:
-                                    case OBJ_PATHPOLY:
-                                    case OBJ_PATHPLIN:
-                                    case OBJ_CAPTION:
-                                    case OBJ_CUSTOMSHAPE:
-                                        if( bMark )
-                                            hasObjectMarked = true;
-                                        break;
-                                    default:
-                                        if ( bMark )
+                                case OBJ_GRUP:
+                                case OBJ_TEXT:
+                                case OBJ_TEXTEXT:
+                                case OBJ_wegFITTEXT:
+                                case OBJ_LINE:
+                                case OBJ_RECT:
+                                case OBJ_CIRC:
+                                case OBJ_SECT:
+                                case OBJ_CARC:
+                                case OBJ_CCUT:
+                                case OBJ_POLY:
+                                case OBJ_PLIN:
+                                case OBJ_PATHLINE:
+                                case OBJ_PATHFILL:
+                                case OBJ_FREELINE:
+                                case OBJ_FREEFILL:
+                                case OBJ_PATHPOLY:
+                                case OBJ_PATHPLIN:
+                                case OBJ_CAPTION:
+                                case OBJ_CUSTOMSHAPE:
+                                    if( bMark )
+                                        hasObjectMarked = true;
+                                    break;
+                                default:
+                                    if ( bMark )
+                                    {
+                                        SdrPageView* pPV = pDrawView->GetSdrPageView/*GetPageViewPvNum*/(/*0*/);
+                                        if (pPV)
                                         {
-                                            SdrPageView* pPV = pDrawView->GetSdrPageView/*GetPageViewPvNum*/(/*0*/);
-                                            if (pPV)
-                                            {
-                                                pDrawView->MarkObj(pTemp, pPV, true);
-                                            }
+                                            pDrawView->MarkObj(pTemp, pPV, true);
                                         }
-                                }
-                                //mod end
-                            }
-                            if ( !hasObjectMarked )
-                            {
-                                SwEditWin& rEditWindow = m_pActiveShell->GetView().GetEditWin();
-                                vcl::KeyCode tempKeycode( KEY_ESCAPE );
-                                KeyEvent rKEvt( 0 , tempKeycode );
-                                static_cast<vcl::Window*>(&rEditWindow)->KeyInput( rKEvt );
+                                    }
                             }
+                            //mod end
+                        }
+                        if ( !hasObjectMarked )
+                        {
+                            SwEditWin& rEditWindow = m_pActiveShell->GetView().GetEditWin();
+                            vcl::KeyCode tempKeycode( KEY_ESCAPE );
+                            KeyEvent rKEvt( 0 , tempKeycode );
+                            static_cast<vcl::Window*>(&rEditWindow)->KeyInput( rKEvt );
                         }
                     }
-                    break;
-                    default: break;
                 }
 
                 m_bViewHasChanged = true;
commit 5740c02c3adef317f476740916dce386ea7158bf
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jan 30 14:46:21 2017 +0000

    crash on exit from undisposed insert special character dialog
    
    right click on style combobox in writer toolbar, insert character, esc,
    ctrl+f4 and crash
    
    Change-Id: I83c88584c6d772bf629121a2bcdc16076bee8003
    (cherry picked from commit cfdfe1be91101654456bdf1f16d92461e1e5dbfa)
    Reviewed-on: https://gerrit.libreoffice.org/33701
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit c98f16943a95f498cecbfc9345b592b5a2144fd7)

diff --git a/cui/source/factory/init.cxx b/cui/source/factory/init.cxx
index 5f53852..fd7cbc6 100644
--- a/cui/source/factory/init.cxx
+++ b/cui/source/factory/init.cxx
@@ -27,7 +27,7 @@ extern "C"
 SAL_DLLPUBLIC_EXPORT bool GetSpecialCharsForEdit(vcl::Window* i_pParent, const vcl::Font& i_rFont, OUString& o_rResult)
 {
     bool bRet = false;
-    VclPtrInstance< SvxCharacterMap > aDlg( i_pParent );
+    ScopedVclPtrInstance<SvxCharacterMap> aDlg(i_pParent);
     aDlg->DisableFontSelection();
     aDlg->SetCharFont(i_rFont);
     if ( aDlg->Execute() == RET_OK )
commit 63ef07111568a2f2f95d6f1ab45a70a2b5ae2ccd
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jan 26 16:01:57 2017 +0000

    ofz: tidy up eps preview import
    
    a) check that the remaining stream length is >= the 14 bytes that are
    unconditionally skipped
    b) make the initial security count the min of the arbitrary 100 and the
    remaining stream len less that 14 bytes
    c) tweak ImplGetNumber not to reduce nSecurityCount if its already 0
    
    (cherry picked from commit 94ffb720b889c51665ebb789d84aee3b3bacb456)
    
    ofz: check eps seeks are sane and succeeded
    
    (cherry picked from commit f85fb724d52a0fff9c64365cd202ae8975492c05)
    
    ofz: check if the stream is able to meet the eps len claim before reading
    
    (cherry picked from commit e17a34e957c21a8cd2977b1b0e1c9a427c244aed)
    
    ofz: check if the stream is able to meet the eps len claim before reading
    
    (cherry picked from commit d1f31681623696e99b0bd9e98570cb1ebac518cc)
    
    make this a little more readable
    
    (cherry picked from commit cf06348d9d4be8b8460d202cebf0d995fd4f6abf)
    
    move deref inside (laughable) nSecurityCount check
    
    (cherry picked from commit 521723b1180a32c02a88ed47137d4242c06eaca7)
    
    Change-Id: Ifffa6d02d492affd578fb48007704457ad635b39
    0eb45e1c1ffd91682ed0ce6a6a74eab54666d715
    65407bffb67449e203b8ead23554a4e88387d214
    440c7f38d6588c570a411f2a97c0164e5d7d646f
    83b6b0bd636b639ce0892f22f216410ce79dee03
    df9a83ffa80137967d8c77d7a9b5133529fc2858
    Reviewed-on: https://gerrit.libreoffice.org/33635
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    
    (cherry picked from commit 390c730b460054ec41e0ab1b807ea0c2bba4ecbd)

diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx
index 6e60107..3feb823 100644
--- a/filter/source/graphicfilter/ieps/ieps.cxx
+++ b/filter/source/graphicfilter/ieps/ieps.cxx
@@ -70,17 +70,19 @@ static sal_uInt8* ImplSearchEntry( sal_uInt8* pSource, sal_uInt8 const * pDest,
 
 
 // SecurityCount is the buffersize of the buffer in which we will parse for a number
-static long ImplGetNumber( sal_uInt8 **pBuf, sal_uInt32& nSecurityCount )
+static long ImplGetNumber(sal_uInt8* &rBuf, sal_uInt32& nSecurityCount)
 {
     bool    bValid = true;
     bool    bNegative = false;
     long    nRetValue = 0;
-    while ( ( --nSecurityCount ) && ( ( **pBuf == ' ' ) || ( **pBuf == 0x9 ) ) )
-        (*pBuf)++;
-    sal_uInt8 nByte = **pBuf;
-    while ( nSecurityCount && ( nByte != ' ' ) && ( nByte != 0x9 ) && ( nByte != 0xd ) && ( nByte != 0xa ) )
+    while (nSecurityCount && (*rBuf == ' ' || *rBuf == 0x9))
     {
-        switch ( nByte )
+        ++rBuf;
+        --nSecurityCount;
+    }
+    while ( nSecurityCount && ( *rBuf != ' ' ) && ( *rBuf != 0x9 ) && ( *rBuf != 0xd ) && ( *rBuf != 0xa ) )
+    {
+        switch ( *rBuf )
         {
             case '.' :
                 // we'll only use the integer format
@@ -90,17 +92,17 @@ static long ImplGetNumber( sal_uInt8 **pBuf, sal_uInt32& nSecurityCount )
                 bNegative = true;
                 break;
             default :
-                if ( ( nByte < '0' ) || ( nByte > '9' ) )
+                if ( ( *rBuf < '0' ) || ( *rBuf > '9' ) )
                     nSecurityCount = 1;         // error parsing the bounding box values
                 else if ( bValid )
                 {
                     nRetValue *= 10;
-                    nRetValue += nByte - '0';
+                    nRetValue += *rBuf - '0';
                 }
                 break;
         }
         nSecurityCount--;
-        nByte = *(++(*pBuf));
+        ++rBuf;
     }
     if ( bNegative )
         nRetValue = -nRetValue;
@@ -400,6 +402,15 @@ static bool RenderAsBMP(const sal_uInt8* pBuf, sal_uInt32 nBytesRead, Graphic &r
         return RenderAsBMPThroughConvert(pBuf, nBytesRead, rGraphic);
 }
 
+namespace
+{
+    bool checkSeek(SvStream &rSt, sal_uInt32 nOffset)
+    {
+        const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize());
+        return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset);
+    }
+}
+
 // this method adds a replacement action containing the original wmf or tiff replacement,
 // so the original eps can be written when storing to ODF.
 void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32 nOrigPos, sal_uInt32 nPSSize,
@@ -417,19 +428,17 @@ void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, sal_uInt32
         aReplacement.WriteUInt32( nMagic ).WriteUInt32( nPPos ).WriteUInt32( nPSSize )
                     .WriteUInt32( nWPos ).WriteUInt32( nSizeWMF )
                     .WriteUInt32( nTPos ).WriteUInt32( nSizeTIFF );
-        if ( nSizeWMF )
+        if (nSizeWMF && checkSeek(rStrm, nOrigPos + nPosWMF) && rStrm.remainingSize() >= nSizeWMF)
         {
             std::unique_ptr<sal_uInt8[]> pBuf(new sal_uInt8[ nSizeWMF ]);
-            rStrm.Seek( nOrigPos + nPosWMF );
-            rStrm.Read( pBuf.get(), nSizeWMF );
-            aReplacement.Write( pBuf.get(), nSizeWMF );
+            rStrm.Read(pBuf.get(), nSizeWMF);
+            aReplacement.Write(pBuf.get(), nSizeWMF);
         }
-        if ( nSizeTIFF )
+        if (nSizeTIFF && checkSeek(rStrm, nOrigPos + nPosTIFF) && rStrm.remainingSize() >= nSizeTIFF)
         {
             std::unique_ptr<sal_uInt8[]> pBuf(new sal_uInt8[ nSizeTIFF ]);
-            rStrm.Seek( nOrigPos + nPosTIFF );
-            rStrm.Read( pBuf.get(), nSizeTIFF );
-            aReplacement.Write( pBuf.get(), nSizeTIFF );
+            rStrm.Read(pBuf.get(), nSizeTIFF);
+            aReplacement.Write(pBuf.get(), nSizeTIFF);
         }
         rMtf.AddAction( static_cast<MetaAction*>( new MetaCommentAction( aComment, 0, static_cast<const sal_uInt8*>(aReplacement.GetData()), aReplacement.Tell() ) ) );
     }
@@ -505,7 +514,7 @@ void MakePreview(sal_uInt8* pBuf, sal_uInt32 nBytesRead,
     {
         pDest += 16;
         sal_uInt32 nCount = 4;
-        long nNumber = ImplGetNumber( &pDest, nCount );
+        long nNumber = ImplGetNumber(pDest, nCount);
         if ( nCount && ( (sal_uInt32)nNumber < 10 ) )
         {
             aString += " LanguageLevel:" + OUString::number( nNumber );
@@ -520,7 +529,6 @@ void MakePreview(sal_uInt8* pBuf, sal_uInt32 nBytesRead,
     rGraphic = aMtf;
 }
 
-
 //================== GraphicImport - the exported function ================
 
 
@@ -533,7 +541,7 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* )
     Graphic     aGraphic;
     bool    bRetValue = false;
     bool    bHasPreview = false;
-    sal_uInt32  nSignature, nPSStreamPos, nPSSize;
+    sal_uInt32  nSignature = 0, nPSStreamPos, nPSSize = 0;
     sal_uInt32  nSizeWMF = 0;
     sal_uInt32  nPosWMF = 0;
     sal_uInt32  nSizeTIFF = 0;
@@ -550,10 +558,9 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* )
 
         if ( nSizeWMF )
         {
-            if ( nPosWMF != 0 )
+            if (nPosWMF && checkSeek(rStream, nOrigPos + nPosWMF))
             {
-                rStream.Seek( nOrigPos + nPosWMF );
-                if ( GraphicConverter::Import( rStream, aGraphic, ConvertDataFormat::WMF ) == ERRCODE_NONE )
+                if (GraphicConverter::Import(rStream, aGraphic, ConvertDataFormat::WMF) == ERRCODE_NONE)
                     bHasPreview = bRetValue = true;
             }
         }
@@ -563,9 +570,8 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* )
 
             // else we have to get the tiff grafix
 
-            if ( nPosTIFF && nSizeTIFF )
+            if (nPosTIFF && nSizeTIFF && checkSeek(rStream, nOrigPos + nPosTIFF))
             {
-                rStream.Seek( nOrigPos + nPosTIFF );
                 if ( GraphicConverter::Import( rStream, aGraphic, ConvertDataFormat::TIF ) == ERRCODE_NONE )
                 {
                     MakeAsMeta(aGraphic);
@@ -580,13 +586,20 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* )
         nPSStreamPos = nOrigPos;            // no preview available _>so we must get the size manually
         nPSSize = rStream.Seek( STREAM_SEEK_TO_END ) - nOrigPos;
     }
+
     std::unique_ptr<sal_uInt8[]> pHeader( new sal_uInt8[ 22 ] );
     rStream.Seek( nPSStreamPos );
-    rStream.Read( pHeader.get(), 22 );    // check PostScript header
-    if ( ImplSearchEntry( pHeader.get(), reinterpret_cast<sal_uInt8 const *>("%!PS-Adobe"), 10, 10 ) &&
-        ImplSearchEntry( &pHeader[ 15 ], reinterpret_cast<sal_uInt8 const *>("EPS"), 3, 3 ) )
+    rStream.Read(pHeader.get(), 22); // check PostScript header
+    bool bOk = ImplSearchEntry(pHeader.get(), reinterpret_cast<sal_uInt8 const *>("%!PS-Adobe"), 10, 10) &&
+               ImplSearchEntry(&pHeader[ 15 ], reinterpret_cast<sal_uInt8 const *>("EPS"), 3, 3);
+    if (bOk)
+    {
+        rStream.Seek(nPSStreamPos);
+        bOk = rStream.remainingSize() >= nPSSize;
+        SAL_WARN_IF(!bOk, "filter.eps", "eps claims to be: " << nPSSize << " in size, but only " << rStream.remainingSize() << " remains");
+    }
+    if (bOk)
     {
-        rStream.Seek( nPSStreamPos );
         std::unique_ptr<sal_uInt8[]> pBuf( new sal_uInt8[ nPSSize ] );
 
         sal_uInt32 nBufStartPos = rStream.Tell();
@@ -602,10 +615,10 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* )
                 if ( pDest  )
                 {
                     pDest += 15;
-                    long nWidth = ImplGetNumber( &pDest, nSecurityCount );
-                    long nHeight = ImplGetNumber( &pDest, nSecurityCount );
-                    long nBitDepth = ImplGetNumber( &pDest, nSecurityCount );
-                    long nScanLines = ImplGetNumber( &pDest, nSecurityCount );
+                    long nWidth = ImplGetNumber(pDest, nSecurityCount);
+                    long nHeight = ImplGetNumber(pDest, nSecurityCount);
+                    long nBitDepth = ImplGetNumber(pDest, nSecurityCount);
+                    long nScanLines = ImplGetNumber(pDest, nSecurityCount);
                     pDest = ImplSearchEntry( pDest, reinterpret_cast<sal_uInt8 const *>("%"), 16, 1 );       // go to the first Scanline
                     if ( nSecurityCount && pDest && nWidth && nHeight && ( ( nBitDepth == 1 ) || ( nBitDepth == 8 ) ) && nScanLines )
                     {
@@ -698,15 +711,16 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* )
             }
 
             sal_uInt8* pDest = ImplSearchEntry( pBuf.get(), reinterpret_cast<sal_uInt8 const *>("%%BoundingBox:"), nBytesRead, 14 );
-            if ( pDest )
+            sal_uInt32 nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf.get())) : 0;
+            if (nRemainingBytes >= 14)
             {
-                nSecurityCount = 100;
+                pDest += 14;
+                nSecurityCount = std::min<sal_uInt32>(nRemainingBytes - 14, 100);
                 long nNumb[4];
                 nNumb[0] = nNumb[1] = nNumb[2] = nNumb[3] = 0;
-                pDest += 14;
                 for ( int i = 0; ( i < 4 ) && nSecurityCount; i++ )
                 {
-                    nNumb[ i ] = ImplGetNumber( &pDest, nSecurityCount );
+                    nNumb[ i ] = ImplGetNumber(pDest, nSecurityCount);
                 }
                 if ( nSecurityCount)
                 {
diff --git a/include/sal/log-areas.dox b/include/sal/log-areas.dox
index 04ad05a..97bdb88 100644
--- a/include/sal/log-areas.dox
+++ b/include/sal/log-areas.dox
@@ -189,6 +189,7 @@ certain functionality.
 @section Filter
 
 @li @c filter.config
+ at li @c filter.eps
 @li @c filter.ms - escher import/export
 @li @c filter.odfflatxml
 @li @c filter.os2met
commit 6efd5c1e497360147da639d615ac9dba1de6014a
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 8 11:52:14 2017 +0100

    ofz#502 negative index
    
    Change-Id: I4dd7bbc0b40e7ec648a5b5f4c45e13e8d8b330a5

diff --git a/vcl/source/gdi/cvtsvm.cxx b/vcl/source/gdi/cvtsvm.cxx
index 75e63c7..0119def 100644
--- a/vcl/source/gdi/cvtsvm.cxx
+++ b/vcl/source/gdi/cvtsvm.cxx
@@ -939,7 +939,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                                 // #106172# Add last DX array elem, if missing
                                 if( nAryLen != nStrLen )
                                 {
-                                    if( nAryLen+1 == nStrLen )
+                                    if( nAryLen+1 == nStrLen && nIndex >= 0)
                                     {
                                         std::unique_ptr<long[]> pTmpAry(new long[nStrLen]);
 
commit 9d277f1a4a988aca2c7a062938e2396e0f214111
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jan 30 09:13:21 2017 +0000

    Resolves: rhbz#1417480 stray bare XWarpPointer call in gtk3 code
    
    which blows up under wayland naturally
    
    can get here from tools->options->mouse positioning->"dialog center"
    table->insert table
    
    Change-Id: Id81b06a63cc3a2a1073d236e2f36dc65e533e598
    (cherry picked from commit b4b989b59cc5841fdf4635b19b975cae3a88430f)
    Reviewed-on: https://gerrit.libreoffice.org/33689
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 909ad0d7ae0de04eb562446384ad4d2449c29868)

diff --git a/vcl/unx/gtk3/gtk3gtkframe.cxx b/vcl/unx/gtk3/gtk3gtkframe.cxx
index aff32c8..0f57e12 100644
--- a/vcl/unx/gtk3/gtk3gtkframe.cxx
+++ b/vcl/unx/gtk3/gtk3gtkframe.cxx
@@ -2143,9 +2143,9 @@ void GtkSalFrame::SetPointerPos( long nX, long nY )
     unsigned int nWindowLeft = maGeometry.nX + nX;
     unsigned int nWindowTop  = maGeometry.nY + nY;
 
-    XWarpPointer( GDK_DISPLAY_XDISPLAY (pDisplay), None,
-                  GDK_WINDOW_XID (gdk_screen_get_root_window( pScreen ) ),
-                  0, 0, 0, 0, nWindowLeft, nWindowTop);
+    GdkDeviceManager* pManager = gdk_display_get_device_manager(pDisplay);
+    gdk_device_warp(gdk_device_manager_get_client_pointer(pManager), pScreen, nWindowLeft, nWindowTop);
+
     // #i38648# ask for the next motion hint
     gint x, y;
     GdkModifierType mask;
commit dfa5b0b63a4cba88ffe6f5417561ceaca883a5cc
Author: Thorsten Behrens <Thorsten.Behrens at CIB.de>
Date:   Mon Jan 23 15:32:36 2017 +0100

    curl: upgrade to version 7.52.1
    
    - fixes some four CVEs
    - and a ton of other fixes & improvements
    
    Reviewed-on: https://gerrit.libreoffice.org/33471
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Thorsten Behrens <Thorsten.Behrens at CIB.de>
    (cherry picked from commit 6d9e4803806d1474039e25092a3c1ee268b0b9f8
     and 2be42d9480fc831144e4d5b216b0a01ffbdb5c8f)
    
    Reviewed-on: https://gerrit.libreoffice.org/33485
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit dbe10362c0eed58b8de425f007b4a2df981bb755)
    
    Change-Id: I2312f30f72c914c7e930c59ddbe44fb8a282c0a5

diff --git a/download.lst b/download.lst
index 024316f..2f1b4de 100755
--- a/download.lst
+++ b/download.lst
@@ -21,8 +21,8 @@ export COLLADA2GLTF_TARBALL := 4b87018f7fff1d054939d19920b751a0-collada2gltf-mas
 export CPPUNIT_MD5SUM := d1c6bdd5a76c66d2c38331e2d287bc01
 export CPPUNIT_TARBALL := cppunit-1.13.2.tar.gz
 export CT2N_TARBALL := 1f467e5bb703f12cbbb09d5cf67ecf4a-converttexttonumber-1-5-0.oxt
-export CURL_MD5SUM := 490e19a8ccd1f4a244b50338a0eb9456
-export CURL_TARBALL := curl-7.51.0.tar.gz
+export CURL_MD5SUM := 4e1ef056e117b4d25f4ec42ac609c0d4
+export CURL_TARBALL := curl-7.52.1.tar.gz
 export DBGHELP_DLL := 13fbc2e8b37ddf28181dd6d8081c2b8e-dbghelp.dll
 export EBOOK_MD5SUM := 6b48eda57914e6343efebc9381027b78
 export EBOOK_TARBALL := libe-book-0.1.2.tar.bz2
diff --git a/external/curl/curl-7.26.0_win-proxy.patch b/external/curl/curl-7.26.0_win-proxy.patch
index 7aea9c0..52c87ee 100644
--- a/external/curl/curl-7.26.0_win-proxy.patch
+++ b/external/curl/curl-7.26.0_win-proxy.patch
@@ -26,15 +26,15 @@
    return FALSE;
  }
  
-+#ifdef WIN32
-+static char* wstrToCstr(LPWSTR wStr)
++#ifdef _WIN32
++static char *wstrToCstr(LPWSTR wStr)
 +{
 +  int bufSize;
-+  char* out = NULL;
++  char *out = NULL;
 +  if(wStr != NULL) {
 +    bufSize = WideCharToMultiByte(
 +      CP_ACP,  0, wStr, -1, NULL, 0, NULL, NULL);
-+    out = (char*)malloc(bufSize * sizeof(char));
++    out = (char *)malloc(bufSize * sizeof(char));
 +    WideCharToMultiByte(CP_ACP, 0, wStr, -1, out, bufSize, NULL, NULL);
 +  }
 +  return out;
@@ -57,15 +57,15 @@
     * checked if the lowercase versions don't exist.
     */
 -  char *no_proxy=NULL;
-+#ifdef WIN32
++#ifdef _WIN32
 +  WINHTTP_CURRENT_USER_IE_PROXY_CONFIG *ieProxyConfig;
-+  ieProxyConfig = (WINHTTP_CURRENT_USER_IE_PROXY_CONFIG*)
++  ieProxyConfig = (WINHTTP_CURRENT_USER_IE_PROXY_CONFIG *)
 +    malloc(sizeof(WINHTTP_CURRENT_USER_IE_PROXY_CONFIG));
 +  if(WinHttpGetIEProxyConfigForCurrentUser(ieProxyConfig)) {
 +    if(!ieProxyConfig->fAutoDetect) {
 +      char *ieProxy;
 +      char *ieNoProxy;
-+      char* pos;
++      char *pos;
 +
 +      ieProxy = wstrToCstr(ieProxyConfig->lpszProxy);
 +      ieNoProxy = wstrToCstr(ieProxyConfig->lpszProxyBypass);
@@ -82,7 +82,7 @@
 +
 +      if(!check_noproxy(conn->host.name, no_proxy)) {
 +        /* Look for the http proxy setting */
-+        char* tok;
++        char *tok;
 +        char *saveptr;
 +
 +        if(NULL != ieProxy) {
diff --git a/external/curl/curl-msvc.patch.1 b/external/curl/curl-msvc.patch.1
index 88ced0a..57a292b 100644
--- a/external/curl/curl-msvc.patch.1
+++ b/external/curl/curl-msvc.patch.1
@@ -11,14 +11,6 @@ MSVC: using SOLARINC and EXCFLAGS
  
  CFGSET       = FALSE
  
-@@ -632,7 +632,6 @@
- 	$(DIROBJ)\vtls.obj \
- 	$(DIROBJ)\openssl.obj \
- 	$(DIROBJ)\strdup.obj \
--	$(DIROBJ)\strequal.obj \
- 	$(DIROBJ)\strerror.obj \
- 	$(DIROBJ)\strtok.obj \
- 	$(DIROBJ)\strtoofft.obj \
 @@ -620,11 +620,11 @@
  debug-dll-ssl-dll\libcurl.res \
  debug-dll-zlib-dll\libcurl.res \
commit eb77405bb081fb2c48a444e118c6b9dc9f81185a
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jan 26 09:12:24 2017 +0000

    Resolves: tdf#104153 crash on drag and drop pivot table field
    
    This is a combination of 2 commits.
    
    Resolves: tdf#104153 crash on drag and drop pivot table field
    
    now though sometimes it doesn't get removed at all, so a band aid
    for the moment
    
    (cherry picked from commit 068edb65b1dce375223d8642a01b07db3948ac03)
    
    Resolves: tdf#104153 lookup what listbox an entry is dragged from
    
    so we can find where its been dragged from in order to remove it from that
    source, rather than relying that it comes from the previously focused listbox
    
    Reviewed-on: https://gerrit.libreoffice.org/33575
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit 011bae55cdd24a1d3e42f0aa2fcfd98d3ddc9b14)
    
    e6aa1a311b46e5e9ee96cab05e0705b794b5eb0b
    
    Change-Id: I6ccbbe51fe9250af0f85c30a9d253269a18df457
    Reviewed-on: https://gerrit.libreoffice.org/33633
    Reviewed-by: Eike Rathke <erack at redhat.com>
    Tested-by: Jenkins <ci at libreoffice.org>
    (cherry picked from commit a9b7c569652ba27ecda572a0cc8ad7a12143e903)

diff --git a/sc/source/ui/dbgui/PivotLayoutDialog.cxx b/sc/source/ui/dbgui/PivotLayoutDialog.cxx
index c40faae..91fdc42 100644
--- a/sc/source/ui/dbgui/PivotLayoutDialog.cxx
+++ b/sc/source/ui/dbgui/PivotLayoutDialog.cxx
@@ -69,8 +69,6 @@ ScPivotLayoutDialog::ScPivotLayoutDialog(
                             ScViewData* pViewData, const ScDPObject* pPivotTableObject, bool bNewPivotTable) :
     ScAnyRefDlg           (pSfxBindings, pChildWindow, pParent, "PivotTableLayout", "modules/scalc/ui/pivottablelayoutdialog.ui"),
     maPivotTableObject    (*pPivotTableObject),
-    mpPreviouslyFocusedListBox(nullptr),
-    mpCurrentlyFocusedListBox(nullptr),
     mpViewData            (pViewData),
     mpDocument            (pViewData->GetDocument()),
     mbNewPivotTable       (bNewPivotTable),
@@ -188,8 +186,6 @@ ScPivotLayoutDialog::~ScPivotLayoutDialog()
 
 void ScPivotLayoutDialog::dispose()
 {
-    mpPreviouslyFocusedListBox.clear();
-    mpCurrentlyFocusedListBox.clear();
     mpListBoxField.clear();
     mpListBoxPage.clear();
     mpListBoxColumn.clear();
@@ -717,4 +713,17 @@ void ScPivotLayoutDialog::ToggleDestination()
     mpDestinationEdit->Enable(bSelection);
 }
 
+ScPivotLayoutTreeListBase* ScPivotLayoutDialog::FindListBoxFor(SvTreeListEntry *pEntry)
+{
+    if (mpListBoxPage->HasEntry(pEntry))
+        return mpListBoxPage.get();
+    if (mpListBoxColumn->HasEntry(pEntry))
+        return mpListBoxColumn.get();
+    if (mpListBoxRow->HasEntry(pEntry))
+        return mpListBoxRow.get();
+    if (mpListBoxData->HasEntry(pEntry))
+        return mpListBoxData.get();
+    return nullptr;
+}
+
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sc/source/ui/dbgui/PivotLayoutTreeListBase.cxx b/sc/source/ui/dbgui/PivotLayoutTreeListBase.cxx
index 407a3b4..0061305 100644
--- a/sc/source/ui/dbgui/PivotLayoutTreeListBase.cxx
+++ b/sc/source/ui/dbgui/PivotLayoutTreeListBase.cxx
@@ -124,27 +124,4 @@ void ScPivotLayoutTreeListBase::RemoveEntryForItem(ScItemValue* pItemValue)
     }
 }
 
-void ScPivotLayoutTreeListBase::GetFocus()
-{
-    SvTreeListBox::GetFocus();
-
-    if( GetGetFocusFlags() & GetFocusFlags::Mnemonic )
-    {
-        SvTreeListEntry* pEntry = mpParent->mpPreviouslyFocusedListBox->GetCurEntry();
-        if (pEntry)
-            InsertEntryForSourceTarget(pEntry, nullptr);
-
-        if (mpParent->mpPreviouslyFocusedListBox != nullptr)
-            mpParent->mpPreviouslyFocusedListBox->GrabFocus();
-    }
-
-    mpParent->mpCurrentlyFocusedListBox = this;
-}
-
-void ScPivotLayoutTreeListBase::LoseFocus()
-{
-    SvTreeListBox::LoseFocus();
-    if (mpParent)
-        mpParent->mpPreviouslyFocusedListBox = this;
-}
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sc/source/ui/dbgui/PivotLayoutTreeListLabel.cxx b/sc/source/ui/dbgui/PivotLayoutTreeListLabel.cxx
index 3795601..9073faa 100644
--- a/sc/source/ui/dbgui/PivotLayoutTreeListLabel.cxx
+++ b/sc/source/ui/dbgui/PivotLayoutTreeListLabel.cxx
@@ -57,10 +57,11 @@ void ScPivotLayoutTreeListLabel::FillLabelFields(ScDPLabelDataVector& rLabelVect
     }
 }
 
-void ScPivotLayoutTreeListLabel::InsertEntryForSourceTarget(SvTreeListEntry* /*pSource*/, SvTreeListEntry* /*pTarget*/)
+void ScPivotLayoutTreeListLabel::InsertEntryForSourceTarget(SvTreeListEntry* pSource, SvTreeListEntry* /*pTarget*/)
 {
-    if(mpParent->mpPreviouslyFocusedListBox.get() != this)
-        mpParent->mpPreviouslyFocusedListBox->RemoveSelection();
+    ScPivotLayoutTreeListBase *pSourceTree = mpParent->FindListBoxFor(pSource);
+    if (pSourceTree)
+        pSourceTree->RemoveSelection();
 }
 
 bool ScPivotLayoutTreeListLabel::IsDataElement(SCCOL nColumn)
diff --git a/sc/source/ui/inc/PivotLayoutDialog.hxx b/sc/source/ui/inc/PivotLayoutDialog.hxx
index df4e901..1cb1162 100644
--- a/sc/source/ui/inc/PivotLayoutDialog.hxx
+++ b/sc/source/ui/inc/PivotLayoutDialog.hxx
@@ -42,9 +42,6 @@ class ScPivotLayoutDialog : public ScAnyRefDlg
 public:
     ScDPObject maPivotTableObject;
 
-    VclPtr<ScPivotLayoutTreeListBase> mpPreviouslyFocusedListBox;
-    VclPtr<ScPivotLayoutTreeListBase> mpCurrentlyFocusedListBox;
-
 private:
     ScViewData* mpViewData;
     ScDocument* mpDocument;
@@ -132,6 +129,8 @@ public:
     ScDPLabelData& GetLabelData(SCCOL nColumn);
     ScDPLabelDataVector& GetLabelDataVector() { return maPivotParameters.maLabelArray;}
     void PushDataFieldNames(std::vector<ScDPName>& rDataFieldNames);
+
+    ScPivotLayoutTreeListBase* FindListBoxFor(SvTreeListEntry *pEntry);
 };
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sc/source/ui/inc/PivotLayoutTreeListBase.hxx b/sc/source/ui/inc/PivotLayoutTreeListBase.hxx
index 7505a4a..81521f8 100644
--- a/sc/source/ui/inc/PivotLayoutTreeListBase.hxx
+++ b/sc/source/ui/inc/PivotLayoutTreeListBase.hxx
@@ -54,9 +54,6 @@ public:
                                          SvTreeListEntry* pEntry) override;
     virtual void DragFinished(sal_Int8 nDropAction) override;
 
-    virtual void GetFocus() override;
-    virtual void LoseFocus() override;
-
     void PushEntriesToPivotFieldVector(ScPivotFieldVector& rVector);
 
     void RemoveEntryForItem(ScItemValue* pItemValue);
commit 65fbeda7e78f8c0ccb832cc2307c8b23fcd60fa0
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jan 19 15:56:12 2017 +0000

    fix the web wizard to work again
    
    (cherry picked from commit 6ec8387bea9015c4487f76cebd045a1a6e291bc4)
    
    Change-Id: Ia957080165a060164317a5f7c9a46d065169314a
    Reviewed-on: https://gerrit.libreoffice.org/33315
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 4b11e2912c6e997a616823f4e7ed35d71d3cb9a1)

diff --git a/wizards/com/sun/star/wizards/web/BackgroundsDialog.py b/wizards/com/sun/star/wizards/web/BackgroundsDialog.py
index 19f377e..87d00b7 100644
--- a/wizards/com/sun/star/wizards/web/BackgroundsDialog.py
+++ b/wizards/com/sun/star/wizards/web/BackgroundsDialog.py
@@ -64,12 +64,12 @@ class BackgroundsDialog(ImageListDialog):
     def other(self):
         filename = self.sd.callOpenDialog(
             False, self.settings.cp_DefaultSession.cp_InDirectory)
-        if filename is not None and filename.length > 0 and filename[0] is not None:
+        if filename is not None and len(filename) > 0 and filename[0] is not None:
             self.settings.cp_DefaultSession.cp_InDirectory = \
                 FileAccess.getParentDir(filename[0])
             i = self.add(filename[0])
-            il.setSelected(i)
-            il.display(i)
+            self.il.setSelected(i)
+            self.il.display(i)
 
     '''
     adds the given image to the image list (to the model)
@@ -81,24 +81,24 @@ class BackgroundsDialog(ImageListDialog):
     def add(self, s):
         #first i check the item does not already exists in the list...
         i = 0
-        while i < il.getListModel().getSize():
-            if il.getListModel().getElementAt(i) == s:
+        while i < self.il.listModel.getSize():
+            if self.il.listModel.getElementAt(i) == s:
                 return i
-
             i += 1
-        il.getListModel().addElement(s)
+
+        self.il.listModel.add1(s)
         try:
             configView = Configuration.getConfigurationRoot(
                 self.xMSF, FileAccess.connectURLs(
                     CONFIG_PATH, "BackgroundImages"), True)
-            i = Configuration.getChildrenNames(configView).length + 1
-            o = Configuration.addConfigNode(configView, "" + i)
+            i = len(Configuration.getChildrenNames(configView)) + 1
+            o = Configuration.addConfigNode(configView, "" + str(i))
             Configuration.set(s, "Href", o)
             Configuration.commit(configView)
         except Exception:
             traceback.print_exc()
 
-        return il.getListModel().getSize() - 1
+        return self.il.listModel.getSize() - 1
 
     '''
     an ImageList Imagerenderer implemtation.
commit 1b534aa6ab9267701af3c8c7d5c523cd6fd3ccc3
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jan 19 16:56:34 2017 +0000

    Resolves: ofz#424 guard against broken dxary length
    
    ofz#424 vcl: reset nLen too
    (cherry picked from commit 7f5a10a3aaf8b48156aeab168afb7648dae1e020)
    
    Change-Id: Ia2569e963edd75cd6c27399d33e73bafe8b3f073
    Reviewed-on: https://gerrit.libreoffice.org/33321
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Jenkins <ci at libreoffice.org>

diff --git a/vcl/source/gdi/cvtsvm.cxx b/vcl/source/gdi/cvtsvm.cxx
index 1b1e57f..75e63c7 100644
--- a/vcl/source/gdi/cvtsvm.cxx
+++ b/vcl/source/gdi/cvtsvm.cxx
@@ -905,6 +905,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                         OUString aStr(OStringToOUString(aByteStr, eActualCharSet));
 
                         std::unique_ptr<long[]> pDXAry;
+                        sal_Int32 nDXAryLen = 0;
                         if (nAryLen > 0)
                         {
                             const size_t nMinRecordSize = sizeof(sal_Int32);
@@ -918,36 +919,49 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
                             sal_Int32 nStrLen( aStr.getLength() );
 
-                            pDXAry.reset(new long[ std::max( nAryLen, nStrLen ) ]);
+                            nDXAryLen = std::max(nAryLen, nStrLen);
+                            pDXAry.reset(new long[nDXAryLen]);
 
-                            for (sal_Int32 j = 0; j < nAryLen; ++j)
-                                rIStm.ReadInt32( nTmp ), pDXAry[ j ] = nTmp;
-
-                            // #106172# Add last DX array elem, if missing
-                            if( nAryLen != nStrLen )
+                            if (nDXAryLen < nLen)
+                            {
+                                //MetaTextArrayAction ctor expects pDXAry to be >= nLen if set, so if this can't
+                                //be achieved, don't read it, it's utterly broken.
+                                SAL_WARN("vcl.gdi", "dxary too short, discarding completely");
+                                rIStm.SeekRel(sizeof(sal_Int32) * nDXAryLen);
+                                nLen = 0;
+                                nIndex = 0;
+                            }
+                            else
                             {
-                                if( nAryLen+1 == nStrLen )
+                                for (sal_Int32 j = 0; j < nAryLen; ++j)
+                                    rIStm.ReadInt32( nTmp ), pDXAry[ j ] = nTmp;
+
+                                // #106172# Add last DX array elem, if missing
+                                if( nAryLen != nStrLen )
                                 {
-                                    std::unique_ptr<long[]> pTmpAry(new long[nStrLen]);
-
-                                    aFontVDev->GetTextArray( aStr, pTmpAry.get(), nIndex, nLen );
-
-                                    // now, the difference between the
-                                    // last and the second last DX array
-                                    // is the advancement for the last
-                                    // glyph. Thus, to complete our meta
-                                    // action's DX array, just add that
-                                    // difference to last elem and store
-                                    // in very last.
-                                    if( nStrLen > 1 )
-                                        pDXAry[ nStrLen-1 ] = pDXAry[ nStrLen-2 ] + pTmpAry[ nStrLen-1 ] - pTmpAry[ nStrLen-2 ];
+                                    if( nAryLen+1 == nStrLen )
+                                    {
+                                        std::unique_ptr<long[]> pTmpAry(new long[nStrLen]);
+
+                                        aFontVDev->GetTextArray( aStr, pTmpAry.get(), nIndex, nLen );
+
+                                        // now, the difference between the
+                                        // last and the second last DX array
+                                        // is the advancement for the last
+                                        // glyph. Thus, to complete our meta
+                                        // action's DX array, just add that
+                                        // difference to last elem and store
+                                        // in very last.
+                                        if( nStrLen > 1 )
+                                            pDXAry[ nStrLen-1 ] = pDXAry[ nStrLen-2 ] + pTmpAry[ nStrLen-1 ] - pTmpAry[ nStrLen-2 ];
+                                        else
+                                            pDXAry[ nStrLen-1 ] = pTmpAry[ nStrLen-1 ]; // len=1: 0th position taken to be 0
+                                    }
+        #ifdef DBG_UTIL
                                     else
-                                        pDXAry[ nStrLen-1 ] = pTmpAry[ nStrLen-1 ]; // len=1: 0th position taken to be 0
+                                        OSL_FAIL("More than one DX array element missing on SVM import");
+        #endif
                                 }
-    #ifdef DBG_UTIL
-                                else
-                                    OSL_FAIL("More than one DX array element missing on SVM import");
-    #endif
                             }
                         }
                         if ( nUnicodeCommentActionNumber == i )
commit 0353bc884e833af32629a2a1a1c4725c8d0aecae
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Jan 25 16:51:00 2017 +0000

    Resolves: tdf#94457 our EmfPlusSetPageTransform is malformed
    
    we write a single short, resulting in a record of 0x000C in length MS-EMFPLUS
    spec has EmfPlusSetPageTransform as 0x0010 in length because we're not writing
    the 4 byte PageScale value.
    
    the previous pageunit unit we are writing is of value 1, which is
    UnitTypeDisplay, the same spec says...
    
    "The unit of measure for page space coordinates, from the UnitType enumeration.
    This value SHOULD NOT be UnitTypeDisplay or UnitTypeWorld"
    
    and footnotes that with...
    
    "Windows never writes those values to the PageUnit field, but they are accepted
    with undefined results."
    
    Reviewed-on: https://gerrit.libreoffice.org/33560
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit cf730cae337d06ac4efa72c9248b194d60d91c88)
    
    Change-Id: Ic8b5ec463b59aab28ae9897947dfcdbd35b22048

diff --git a/vcl/source/filter/wmf/emfwr.cxx b/vcl/source/filter/wmf/emfwr.cxx
index c5978b0..afd9af3 100644
--- a/vcl/source/filter/wmf/emfwr.cxx
+++ b/vcl/source/filter/wmf/emfwr.cxx
@@ -239,7 +239,6 @@ void EMFWriter::WriteEMFPlusHeader( const Size &rMtfSizePix, const Size &rMtfSiz
     ImplPlusRecord( EmfPlusSetPixelOffsetMode, 0x0 );
     ImplPlusRecord( EmfPlusSetAntiAliasMode, 0x09 );      // TODO: Check actual values for AntiAlias
     ImplPlusRecord( EmfPlusSetCompositingQuality, 0x0100 ); // Default Quality
-    ImplPlusRecord( EmfPlusSetPageTransform, 1 );
     ImplPlusRecord( EmfPlusSetInterpolationMode, 0x00 );  // Default
     ImplPlusRecord( EmfPlusGetDC, 0x00 );
     ImplEndCommentRecord();
commit 23d1c222394a5b82b806018431375bf47276f3c4
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Jan 21 17:13:47 2017 +0000

    ofz#439 protect against 0 len text
    
    Change-Id: Ib67284636235b0d43df626a4aeed67f2bc64b491
    Reviewed-on: https://gerrit.libreoffice.org/33376
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 4f8205659a810e4f89ff1fc0148393aefec53f97)

diff --git a/vcl/source/filter/wmf/winmtf.cxx b/vcl/source/filter/wmf/winmtf.cxx
index 711b6fa..5881041 100644
--- a/vcl/source/filter/wmf/winmtf.cxx
+++ b/vcl/source/filter/wmf/winmtf.cxx
@@ -1470,9 +1470,9 @@ void WinMtfOutput::DrawText( Point& rPosition, OUString& rText, long* pDXArry, b
         sal_Int32 nTextWidth;
         pVDev->SetMapMode( MapMode( MAP_100TH_MM ) );
         pVDev->SetFont( maFont );
-        if( pDXArry )
+        const sal_uInt32 nLen = pDXArry ? rText.getLength() : 0;
+        if (nLen)
         {
-            sal_uInt32 nLen = rText.getLength();
             nTextWidth = pVDev->GetTextWidth( OUString(rText[ nLen - 1 ]) );
             if( nLen > 1 )
                 nTextWidth += pDXArry[ nLen - 2 ];
commit edc88f5b69f4c913517db364a04556c0177fae29
Author: Eike Rathke <erack at redhat.com>
Date:   Wed Jan 25 13:34:43 2017 +0100

    Resolves: tdf#105351 pass matching index key to conditional format dialog
    
    Change-Id: I9d872140755c4ec0ae67349530b00f339057a356
    (cherry picked from commit 0367acdcc59e14b0b067976a08202e8afef0ecf3)
    Reviewed-on: https://gerrit.libreoffice.org/33533
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Jenkins <ci at libreoffice.org>
    (cherry picked from commit d0b841e5501881c5676e27da08fddcb5f9d4bc1a)

diff --git a/sc/source/ui/view/cellsh1.cxx b/sc/source/ui/view/cellsh1.cxx
index d2ff687..09c58da 100644
--- a/sc/source/ui/view/cellsh1.cxx
+++ b/sc/source/ui/view/cellsh1.cxx
@@ -2003,6 +2003,7 @@ void ScCellShell::ExecuteEdit( SfxRequest& rReq )
                         {
                             // found a matching range, edit this conditional format
                             bCondFormatDlg = true;
+                            nIndex = pCondFormat->GetKey();
                             break;
                         }
                     }
commit ac76c7de2d35e19cb9fe542d7378bf038d59ced9
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Jan 25 09:21:25 2017 +0000

    ofz#463 unable to mmap
    
    Reviewed-on: https://gerrit.libreoffice.org/33519
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit f6c465bc8e7583a8321f5c881cb008b980e0e3fa)
    
    Change-Id: I509faeda019f42bbe7cdc5fc249f2ea2076bb702
    Reviewed-on: https://gerrit.libreoffice.org/33522
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: David Tardon <dtardon at redhat.com>

diff --git a/vcl/source/gdi/cvtsvm.cxx b/vcl/source/gdi/cvtsvm.cxx
index 83b000a..1b1e57f 100644
--- a/vcl/source/gdi/cvtsvm.cxx
+++ b/vcl/source/gdi/cvtsvm.cxx
@@ -907,6 +907,15 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                         std::unique_ptr<long[]> pDXAry;
                         if (nAryLen > 0)
                         {
+                            const size_t nMinRecordSize = sizeof(sal_Int32);
+                            const size_t nMaxRecords = rIStm.remainingSize() / nMinRecordSize;
+                            if (static_cast<sal_uInt32>(nAryLen) > nMaxRecords)
+                            {
+                                SAL_WARN("vcl.gdi", "Parsing error: " << nMaxRecords <<
+                                         " max possible entries, but " << nAryLen << " claimed, truncating");
+                                nAryLen = nMaxRecords;
+                            }
+
                             sal_Int32 nStrLen( aStr.getLength() );
 
                             pDXAry.reset(new long[ std::max( nAryLen, nStrLen ) ]);
diff --git a/vcl/source/gdi/metaact.cxx b/vcl/source/gdi/metaact.cxx
index 2643b9b..f8d113c 100644
--- a/vcl/source/gdi/metaact.cxx
+++ b/vcl/source/gdi/metaact.cxx
@@ -1114,7 +1114,7 @@ MetaTextArrayAction::MetaTextArrayAction( const Point& rStartPt,
 {
     const sal_Int32 nAryLen = pDXAry ? mnLen : 0;
 
-    if( nAryLen )
+    if (nAryLen > 0)
     {
         mpDXAry = new long[ nAryLen ];
         memcpy( mpDXAry, pDXAry, nAryLen * sizeof(long) );
commit be08514ac4a8d3e4b837937bfc46528503d434c4
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Jan 21 16:07:46 2017 +0000

    coverity#1399031 golden, Out-of-bounds read
    
    There are 17 elements, so SAL_N_ELEMENTS(sppnPatterns) is 17 The largest valid
    index is 16, not 17, so valid max index is out by one
    
    Change-Id: Id20218a0e73cb9e502a631fa6bfbb3f0a22c4727
    (cherry picked from commit 9ad08b403be9c6646cda9a379332545c3668975b)
    Reviewed-on: https://gerrit.libreoffice.org/33401
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit 5e314dfb058990a78cd9e1b9045ac0f186de7003)

diff --git a/sc/source/filter/excel/xiescher.cxx b/sc/source/filter/excel/xiescher.cxx
index ca306b5..05f3d7b 100644
--- a/sc/source/filter/excel/xiescher.cxx
+++ b/sc/source/filter/excel/xiescher.cxx
@@ -703,7 +703,7 @@ void XclImpDrawObjBase::ConvertFillStyle( SdrObject& rSdrObj, const XclObjFillDa
                 { 0x88, 0x00, 0x22, 0x00, 0x88, 0x00, 0x22, 0x00 },
                 { 0x80, 0x00, 0x08, 0x00, 0x80, 0x00, 0x08, 0x00 }
             };
-            const sal_uInt8* const pnPattern = sppnPatterns[ ::std::min< size_t >( rFillData.mnPattern - 2, SAL_N_ELEMENTS( sppnPatterns ) ) ];
+            const sal_uInt8* const pnPattern = sppnPatterns[std::min<size_t>(rFillData.mnPattern - 2, SAL_N_ELEMENTS(sppnPatterns) - 1)];
             // create 2-colored 8x8 DIB
             SvMemoryStream aMemStrm;
             aMemStrm.WriteUInt32( 12 ).WriteInt16( 8 ).WriteInt16( 8 ).WriteUInt16( 1 ).WriteUInt16( 1 );
commit 74bd9e940d4eac90b41359a87027f0eb9fbbdfed
Author: Alex McMurchy1917 <mcmurchy1917-libreoffice at yahoo.co.uk>
Date:   Tue Dec 6 13:02:26 2016 +0000

    Fixes tdf#104412 - DirectoryNameoutofPath no longer works
    
    In the macro tools library the subroutine GetFileNameWithoutExtension
    has a missing bracket in the last line. This confuses the following
    subroutine DirectoryNameoutofPath causing it to fail.
    
    This only came to light after the introduction of commit
    
    "tdf#80731 Closing parenthesis is now detected (Mid statement and functions)."
    
    which tightened up on syntax validation.
    
    This commit adds in the missing bracket to subroutine
    GetFileNameWithoutExtension in the macro tools library.
    
    Change-Id: I015c88a29a933cd42b7a7623a9ae70d090739c54
    Reviewed-on: https://gerrit.libreoffice.org/31677
    Reviewed-by: Katarina Behrens <Katarina.Behrens at cib.de>
    Tested-by: Katarina Behrens <Katarina.Behrens at cib.de>
    (cherry picked from commit 08befaceb65bf2f0f0e8ec976f7826be8f5dd7d7)
    Reviewed-on: https://gerrit.libreoffice.org/31695
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Jan-Marek Glogowski <glogow at fbihome.de>
    (cherry picked from commit b1f739b2bc227f81b1ec740e05927e866fa81d94)
    Reviewed-on: https://gerrit.libreoffice.org/33340
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit bf7f3c0baabf0a8e74687ca192ff59c8f3d06207)

diff --git a/wizards/source/tools/Strings.xba b/wizards/source/tools/Strings.xba
index 6938938..4c2802f 100644
--- a/wizards/source/tools/Strings.xba
+++ b/wizards/source/tools/Strings.xba
@@ -345,7 +345,7 @@ Dim SepList() as String
 		FileName = FileNameoutofPath(FileName, Separator)
 	End If
 	SepList() = ArrayoutofString(FileName,".", MaxIndex)
-	GetFileNameWithoutExtension = RTrimStr(FileName, "." & SepList(MaxIndex)
+	GetFileNameWithoutExtension = RTrimStr(FileName, "." & SepList(MaxIndex))
 End Function
 
 
commit 1dbe4d89e40b577dc6b51900df86e8822a77f560
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jan 19 13:34:31 2017 +0000

    Related: tdf#80731 bug in our own wizards revealed by new bracket test
    
    Change-Id: Iec49bf80794a4ba61a70b22d0fc1769349ca4508
    (cherry picked from commit ecd82b5121899fe23f0ccbdd8a89c8b18436f027)
    Reviewed-on: https://gerrit.libreoffice.org/33313
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit ad00157b7b60fa1feb35d1e5a4f7a6d418d10f19)

diff --git a/wizards/source/importwizard/DialogModul.xba b/wizards/source/importwizard/DialogModul.xba
index 65fb1f2..e552669 100644
--- a/wizards/source/importwizard/DialogModul.xba
+++ b/wizards/source/importwizard/DialogModul.xba
@@ -375,7 +375,7 @@ Dim sPath as String
 	ElseIf oCheckbox.State = 0 Then
 		CheckControlPath = True
 	Else
-		sPath = ConvertToUrl(Trim(oTextBox.Text)
+		sPath = ConvertToUrl(Trim(oTextBox.Text))
 		CheckControlPath = oUcb.Exists(sPath)
 	End If
 End Function
diff --git a/wizards/source/importwizard/FilesModul.xba b/wizards/source/importwizard/FilesModul.xba
index c796cad..1e6363f 100644
--- a/wizards/source/importwizard/FilesModul.xba
+++ b/wizards/source/importwizard/FilesModul.xba
@@ -327,7 +327,7 @@ Dim sPrevMimeTypeorExtension as String
 			CurFiltername =	GetFilterName(sMimeTypeorExtension, sFilterName(), sExtension, FilterIndex)
 			ApplIndex = FilesList(i,2)
 			If sMimeTypeorExtension <> sPrevMimeTypeorExtension Then
-				CreateLogTable(ApplIndex, sMimeTypeOrExtension, sFiltername()
+				CreateLogTable(ApplIndex, sMimeTypeOrExtension, sFiltername())
 			End If
 			If ApplIndex > Ubound(Applications) or (ApplIndex < 0) Then
 				Msgbox "Applicationindex out of bounds:" & sSourcUrl
diff --git a/wizards/source/tools/ModuleControls.xba b/wizards/source/tools/ModuleControls.xba
index 96f23ad..300b6ee 100644
--- a/wizards/source/tools/ModuleControls.xba
+++ b/wizards/source/tools/ModuleControls.xba
@@ -311,7 +311,7 @@ Dim sProdName as String
 		Filternames(i,0) = ReplaceString(Filternames(i,0), sProdName,"%productname%")
 		oDialog.AppendFilter(FilterNames(i,0), FilterNames(i,1))
 	Next i
-	oDialog.SetCurrentFilter(FilterNames(0,0)
+	oDialog.SetCurrentFilter(FilterNames(0,0))
 End Sub
 
 
commit 99eb937edce92299b42927f2fbeb846e1cfeb3c5
Author: Michael Stahl <mstahl at redhat.com>
Date:   Wed Jan 18 18:25:46 2017 +0100

    tdf#99074 sw: remove duplicate property "IsBrowseMode" again
    
    Commit e0f9bb795251d950b5dd960fcd030170c8eb67aa added the property
    "IsBrowseMode" to SwXDocumentSettings, but it is already available in
    the API as SwXViewSettings property "ShowOnlineLayout".
    
    The problem is that both of these properties get exported in ODF into
    settings.xml, so it contains "IsBrowseMode" twice.
    
    Unfortunately the SwXViewSettings are not available in writerfilter,
    because the XModel::getCurrentController() is null, the view is created
    after the import.
    
    But there is already a way to store ViewData in the SfxBaseModel, which
    is then used by SfxBaseController::ConnectSfxFrame_Impl() when creating
    the view.  This applies the property at just the right time.
    
    (cherry picked from commit 2dce8dd41c208ecda40c054635f3736147ec8914)
    
    Change-Id: I842845d09a7b3fe81e27a1ed8ac8a8594da7f4e8
    Reviewed-on: https://gerrit.libreoffice.org/33285
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 8c940adc98ed9e5844506d5b66a0cdf57f9e1e7c)

diff --git a/sw/qa/extras/ooxmlimport/ooxmlimport.cxx b/sw/qa/extras/ooxmlimport/ooxmlimport.cxx
index 85e3b20..4c3d0f1 100644
--- a/sw/qa/extras/ooxmlimport/ooxmlimport.cxx
+++ b/sw/qa/extras/ooxmlimport/ooxmlimport.cxx
@@ -65,6 +65,7 @@
 #include <com/sun/star/style/CaseMap.hpp>
 #include <com/sun/star/style/PageStyleLayout.hpp>
 #include <com/sun/star/util/DateTime.hpp>
+#include <com/sun/star/view/XViewSettingsSupplier.hpp>
 #include <com/sun/star/document/XFilter.hpp>
 #include <com/sun/star/document/XImporter.hpp>
 #include <vcl/bitmapaccess.hxx>
@@ -3256,10 +3257,13 @@ DECLARE_SW_IMPORT_TEST(testHFLinkToPrev, "headerfooter-link-to-prev.docx",
 
 DECLARE_OOXMLIMPORT_TEST(testTdf99074, "tdf99074.docx")
 {
-    uno::Reference<lang::XMultiServiceFactory> xFactory(mxComponent, uno::UNO_QUERY);
-    uno::Reference<uno::XInterface> xSettings = xFactory->createInstance("com.sun.star.document.Settings");
+    uno::Reference<frame::XModel> xModel(mxComponent, uno::UNO_QUERY);
+    uno::Reference<view::XViewSettingsSupplier> const xController(
+        xModel->getCurrentController(), uno::UNO_QUERY);
+    uno::Reference<beans::XPropertySet> const xViewSettings(
+        xController->getViewSettings());
     // This was false, Web Layout was ignored on import.
-    CPPUNIT_ASSERT(getProperty<bool>(xSettings, "InBrowseMode"));
+    CPPUNIT_ASSERT(getProperty<bool>(xViewSettings, "ShowOnlineLayout"));
 }
 
 DECLARE_OOXMLIMPORT_TEST(testTdf103664, "tdf103664.docx")
diff --git a/sw/source/uibase/uiview/view.cxx b/sw/source/uibase/uiview/view.cxx
index e95ac2e..8b2556b 100644
--- a/sw/source/uibase/uiview/view.cxx
+++ b/sw/source/uibase/uiview/view.cxx
@@ -1268,7 +1268,8 @@ void SwView::ReadUserDataSequence ( const uno::Sequence < beans::PropertyValue >
                  bGotVisibleTop = false, bGotVisibleRight = false,
                  bGotVisibleBottom = false, bGotZoomType = false,
                  bGotZoomFactor = false, bGotIsSelectedFrame = false,
-                 bGotViewLayoutColumns = false, bGotViewLayoutBookMode = false;
+                 bGotViewLayoutColumns = false, bGotViewLayoutBookMode = false,
+                 bBrowseMode = false, bGotBrowseMode = false;
 
         for (sal_Int32 i = 0 ; i < nLength; i++)
         {
@@ -1331,8 +1332,18 @@ void SwView::ReadUserDataSequence ( const uno::Sequence < beans::PropertyValue >
                pValue->Value >>= bSelectedFrame;
                bGotIsSelectedFrame = true;
             }
+            else if (pValue->Name == "ShowOnlineLayout")
+            {
+               pValue->Value >>= bBrowseMode;
+               bGotBrowseMode = true;
+            }
             pValue++;
         }
+        if (bGotBrowseMode)
+        {
+            // delegate further
+            GetViewImpl()->GetUNOObject_Impl()->getViewSettings()->setPropertyValue("ShowOnlineLayout", uno::Any(bBrowseMode));
+        }
         if (bGotVisibleBottom)
         {
             Point aCursorPos( nX, nY );
diff --git a/sw/source/uibase/uno/SwXDocumentSettings.cxx b/sw/source/uibase/uno/SwXDocumentSettings.cxx
index 6b02035..962eaeb 100644
--- a/sw/source/uibase/uno/SwXDocumentSettings.cxx
+++ b/sw/source/uibase/uno/SwXDocumentSettings.cxx
@@ -132,7 +132,6 @@ enum SwDocumentSettingsPropertyHandles
     HANDLE_APPLY_PARAGRAPH_MARK_FORMAT_TO_NUMBERING,
     HANDLE_PROP_LINE_SPACING_SHRINKS_FIRST_LINE,
     HANDLE_SUBTRACT_FLYS,
-    HANDLE_BROWSE_MODE,
 };
 
 static MasterPropertySetInfo * lcl_createSettingsInfo()
@@ -208,7 +207,6 @@ static MasterPropertySetInfo * lcl_createSettingsInfo()
         { OUString("ApplyParagraphMarkFormatToNumbering"), HANDLE_APPLY_PARAGRAPH_MARK_FORMAT_TO_NUMBERING, cppu::UnoType<bool>::get(), 0},
         { OUString("PropLineSpacingShrinksFirstLine"),       HANDLE_PROP_LINE_SPACING_SHRINKS_FIRST_LINE,         cppu::UnoType<bool>::get(),           0},
         { OUString("SubtractFlysAnchoredAtFlys"),       HANDLE_SUBTRACT_FLYS,         cppu::UnoType<bool>::get(),           0},
-        { OUString("InBrowseMode"), HANDLE_BROWSE_MODE, cppu::UnoType<bool>::get(), 0},
 /*
  * As OS said, we don't have a view when we need to set this, so I have to
  * find another solution before adding them to this property set - MTG
@@ -855,15 +853,6 @@ void SwXDocumentSettings::_setSingleValue( const comphelper::PropertyInfo & rInf
             }
         }
         break;
-        case HANDLE_BROWSE_MODE:
-        {
-            bool bTmp;
-            if (rValue >>= bTmp)
-            {
-                mpDoc->getIDocumentSettingAccess().set(DocumentSettingId::BROWSE_MODE, bTmp);
-            }
-        }
-        break;
         default:
             throw UnknownPropertyException();
     }
@@ -1273,11 +1262,6 @@ void SwXDocumentSettings::_getSingleValue( const comphelper::PropertyInfo & rInf
             rValue <<= mpDoc->getIDocumentSettingAccess().get(DocumentSettingId::SUBTRACT_FLYS);
         }
         break;
-        case HANDLE_BROWSE_MODE:
-        {
-            rValue <<= mpDoc->getIDocumentSettingAccess().get(DocumentSettingId::BROWSE_MODE);
-        }
-        break;
         default:
             throw UnknownPropertyException();
     }
diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index 5117116..a637964 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -67,6 +67,7 @@
 #include <com/sun/star/drawing/XControlShape.hpp>
 #include <com/sun/star/text/ControlCharacter.hpp>
 #include <com/sun/star/text/XTextColumns.hpp>
+
 #include <oox/mathml/import.hxx>
 #include <GraphicHelpers.hxx>
 #include <dmapper/GraphicZOrderHelper.hxx>
@@ -5034,18 +5035,21 @@ void DomainMapper_Impl::ApplySettingsTable()
                 xTextDefaults->setPropertyValue(getPropertyName(PROP_PARA_LINE_SPACING), uno::makeAny(aSpacing));
             }
 
-            if (m_pSettingsTable->GetZoomFactor())
+            if (m_pSettingsTable->GetZoomFactor() || m_pSettingsTable->GetView())
             {
-                uno::Sequence<beans::PropertyValue> aViewProps(3);
-                aViewProps[0].Name = "ZoomFactor";
-                aViewProps[0].Value <<= m_pSettingsTable->GetZoomFactor();
-                aViewProps[1].Name = "VisibleBottom";
-                aViewProps[1].Value <<= sal_Int32(0);
-                aViewProps[2].Name = "ZoomType";
-                aViewProps[2].Value <<= sal_Int16(0);
-
+                std::vector<beans::PropertyValue> aViewProps;
+                if (m_pSettingsTable->GetZoomFactor())
+                {
+                    aViewProps.push_back(beans::PropertyValue("ZoomFactor", -1, uno::makeAny(m_pSettingsTable->GetZoomFactor()), beans::PropertyState_DIRECT_VALUE));
+                    aViewProps.push_back(beans::PropertyValue("VisibleBottom", -1, uno::makeAny(sal_Int32(0)), beans::PropertyState_DIRECT_VALUE));
+                    aViewProps.push_back(beans::PropertyValue("ZoomType", -1, uno::makeAny(sal_Int16(0)), beans::PropertyState_DIRECT_VALUE));
+                }
+                if (m_pSettingsTable->GetView())
+                {
+                    aViewProps.push_back(beans::PropertyValue("ShowOnlineLayout", -1, uno::makeAny(m_pSettingsTable->GetView() == NS_ooxml::LN_Value_doc_ST_View_web), beans::PropertyState_DIRECT_VALUE));
+                }
                 uno::Reference<container::XIndexContainer> xBox = document::IndexedPropertyValues::create(m_xComponentContext);
-                xBox->insertByIndex(sal_Int32(0), uno::makeAny(aViewProps));
+                xBox->insertByIndex(sal_Int32(0), uno::makeAny(comphelper::containerToSequence(aViewProps)));
                 uno::Reference<container::XIndexAccess> xIndexAccess(xBox, uno::UNO_QUERY);
                 uno::Reference<document::XViewDataSupplier> xViewDataSupplier(m_xTextDocument, uno::UNO_QUERY);
                 xViewDataSupplier->setViewData(xIndexAccess);
@@ -5059,9 +5063,6 @@ void DomainMapper_Impl::ApplySettingsTable()
             if( m_pSettingsTable->GetEmbedSystemFonts())
                 xSettings->setPropertyValue( getPropertyName( PROP_EMBED_SYSTEM_FONTS ), uno::makeAny(true) );
             xSettings->setPropertyValue("AddParaTableSpacing", uno::makeAny(m_pSettingsTable->GetDoNotUseHTMLParagraphAutoSpacing()));
-            // Web Layout.
-            if (m_pSettingsTable->GetView() == NS_ooxml::LN_Value_doc_ST_View_web)
-                xSettings->setPropertyValue("InBrowseMode", uno::makeAny(true));
             if( m_pSettingsTable->GetProtectForm() )
                 xSettings->setPropertyValue("ProtectForm", uno::makeAny( true ));
         }
commit 12ec1061aa22b595c730b65a7f8e2d42f8fc8b5b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jan 19 10:47:56 2017 +0000

    Related: tdf#100813 don't crash traversing table in page 43
    
    master has...
    
    commit 1281bd5d87361fa516cdf247b055aeb4bb5e13fb
    Author: Mike Kaganski <mike.kaganski at collabora.com>
    Date:   Wed Jan 18 09:25:55 2017 +0300
    
        tdf#104181 related: don't throw on this document
    
    which is more extreme, keep it minimal for the backport,
    MoveFootnoteCntFwd always derefs pOldBoss so check for null
    before calling into it here
    
    Change-Id: I726095567e4101170f2bf9244efbf8960cc39380
    Reviewed-on: https://gerrit.libreoffice.org/33305
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 2671816be19e541941b9b3cbd3f085ea3748261d)

diff --git a/sw/source/core/layout/flowfrm.cxx b/sw/source/core/layout/flowfrm.cxx
index 986be89..6d90c7f 100644
--- a/sw/source/core/layout/flowfrm.cxx
+++ b/sw/source/core/layout/flowfrm.cxx
@@ -1795,7 +1795,7 @@ bool SwFlowFrame::MoveFwd( bool bMakePage, bool bPageBreak, bool bMoveAlways )
     SwFootnoteBossFrame *pOldBoss = m_rThis.FindFootnoteBossFrame();
     if (m_rThis.IsInFootnote())
     {
-        if (!m_rThis.IsContentFrame())
+        if (!m_rThis.IsContentFrame() || !pOldBoss)
         {
             SAL_WARN("sw.core", "Tables in footnotes are not truly supported");
             return false;
commit 94a9d669885fdd275030f6df0eb8f50e5de30fbc
Author: Yossi Zahn <yossizahn at gmail.com>
Date:   Mon Nov 28 13:01:40 2016 +0000

    tdf#96354 correct broken autocorrect INitial CApitals
    
    Change-Id: If65ec7814c3aed5e4c17294ae57c34550373469d
    Reviewed-on: https://gerrit.libreoffice.org/31317
    Reviewed-by: jan iversen <jani at documentfoundation.org>
    Tested-by: jan iversen <jani at documentfoundation.org>
    (cherry picked from commit c6db0e064959ec154db9471a8e1f1e2716bb3523)
    Reviewed-on: https://gerrit.libreoffice.org/33266
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 42849da8f266972ef370104c332d74ff7b15fc71)

diff --git a/editeng/source/misc/svxacorr.cxx b/editeng/source/misc/svxacorr.cxx
index a341851..7106674 100644
--- a/editeng/source/misc/svxacorr.cxx
+++ b/editeng/source/misc/svxacorr.cxx
@@ -104,13 +104,13 @@ static inline bool IsWordDelim( const sal_Unicode c )
 static inline bool IsLowerLetter( sal_Int32 nCharType )
 {
     return CharClass::isLetterType( nCharType ) &&
-            0 == ( css::i18n::KCharacterType::UPPER & nCharType);
+           ( css::i18n::KCharacterType::LOWER & nCharType);
 }
 
 static inline bool IsUpperLetter( sal_Int32 nCharType )
 {
     return CharClass::isLetterType( nCharType ) &&
-            0 == ( css::i18n::KCharacterType::LOWER & nCharType);
+            ( css::i18n::KCharacterType::UPPER & nCharType);
 }
 
 bool lcl_IsUnsupportedUnicodeChar( CharClass& rCC, const OUString& rTxt,
@@ -407,7 +407,7 @@ bool SvxAutoCorrect::FnCapitalStartWord( SvxAutoCorrDoc& rDoc, const OUString& r
                 if( xSpeller->hasLanguage(eLang) )
                 {
                     Sequence< css::beans::PropertyValue > aEmptySeq;
-                    if (!xSpeller->spell(sWord, eLang, aEmptySeq).is())
+                    if (xSpeller->isValid(sWord, eLang, aEmptySeq))
                     {
                         return false;
                     }
commit a64646c1ba05963229ed5b147b14a058c8d86357
Author: Eike Rathke <erack at redhat.com>
Date:   Wed Jan 18 16:18:38 2017 +0100

    tdf#104967 prevent crash when pasting notes originating from a closed document
    
    This is only a workaround to prevent a crash, the actual note content is lost
    when pasting, only a standard empty note caption will be pasted.
    
    Change-Id: Ifaef5d30cc2024f3d03d6b2b4f56c5ccfbb67142
    (cherry picked from commit cb566c056b0e8f9f73dac3cbaf497e102a247cb9)
    Reviewed-on: https://gerrit.libreoffice.org/33274
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 4d3b4a8ad12767c846b48c3a424e6bb0fa7af924)

diff --git a/sc/source/core/data/documen2.cxx b/sc/source/core/data/documen2.cxx
index 5b701fa..c77e038 100644
--- a/sc/source/core/data/documen2.cxx
+++ b/sc/source/core/data/documen2.cxx
@@ -372,6 +372,21 @@ ScDocument::~ScDocument()
         delete pRefreshTimerControl, pRefreshTimerControl = nullptr;
     }
 
+    if (IsClipboardSource())
+    {
+        // Notes copied to the clipboard have a raw SdrCaptionObj pointer
+        // copied from this document, forget it as it references this
+        // document's drawing layer pages and what not, which otherwise when
+        // pasting to another document after this document was destructed would
+        // attempt to access non-existing data.
+        /* XXX this is only a workaround to prevent a crash, the actual note
+         * content is lost, only a standard empty note caption will be pasted.
+         * TODO: come up with a solution. */
+        ScDocument* pClipDoc = ScModule::GetClipDoc();
+        if (pClipDoc)
+            pClipDoc->ForgetNoteCaptions( ScRangeList( ScRange( 0,0,0, MAXCOL, MAXROW, pClipDoc->GetTableCount()-1)));
+    }
+
     mxFormulaParserPool.reset();
     // Destroy the external ref mgr instance here because it has a timer
     // which needs to be stopped before the app closes.
commit a38477e3939959b8d18665461d3b59f43c5079ea
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Jan 18 09:43:17 2017 +0000

    ofz: reduce scope, check stream, validate nActions
    
    (cherry picked from commit bd78b28a1233e26c023a52df6b119d60a61d53ad)
    
    Change-Id: Ie420ad40b0d852708828620cd26c2f746398f5a8
    Reviewed-on: https://gerrit.libreoffice.org/33260
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>

diff --git a/vcl/source/gdi/cvtsvm.cxx b/vcl/source/gdi/cvtsvm.cxx
index 6ad9e4a..83b000a 100644
--- a/vcl/source/gdi/cvtsvm.cxx
+++ b/vcl/source/gdi/cvtsvm.cxx
@@ -474,12 +474,12 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
     char    aCode[ 5 ];
     Size    aPrefSz;
-    sal_Int16   nSize;
-    sal_Int16   nVersion;
 
     // read header
     rIStm.Read( aCode, sizeof( aCode ) );  // Identifier
+    sal_Int16 nSize(0);
     rIStm.ReadInt16( nSize );                                 // Size
+    sal_Int16 nVersion(0);
     rIStm.ReadInt16( nVersion );                              // Version
     sal_Int32 nTmp32(0);
     rIStm.ReadInt32( nTmp32 );
@@ -511,24 +511,37 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
         Point       aPt, aPt1;
         Size        aSz;
         Color       aActionColor;
-        sal_Int32       nTmp, nTmp1, nActionSize;
-        sal_Int32       nActions;
-        sal_Int16       nType;
 
         sal_uInt32  nUnicodeCommentStreamPos = 0;
         sal_Int32       nUnicodeCommentActionNumber = 0;
 
         ImplReadMapMode( rIStm, aMapMode );             // MapMode
-        rIStm.ReadInt32( nActions );                              // Action count
+        sal_Int32 nActions(0);
+        rIStm.ReadInt32( nActions );                    // Action count
+        if (nActions < 0)
+        {
+            SAL_WARN("vcl.gdi", "svm claims negative action count (" << nActions << ")");
+            nActions = 0;
+        }
+
+        const size_t nMinActionSize = sizeof(sal_uInt16) + sizeof(sal_Int32);
+        const size_t nMaxPossibleActions = rIStm.remainingSize() / nMinActionSize;
+        if (static_cast<sal_uInt32>(nActions) > nMaxPossibleActions)
+        {
+            SAL_WARN("vcl.gdi", "svm claims more actions (" << nActions << ") than stream could provide, truncating");
+            nActions = nMaxPossibleActions;
+        }
 
         rMtf.SetPrefSize( aPrefSz );
         rMtf.SetPrefMapMode( aMapMode );
         size_t nLastPolygonAction(0);
 
-        for (sal_Int32 i = 0; i < nActions; ++i)
+        for (sal_Int32 i = 0; i < nActions && rIStm.good(); ++i)
         {
+            sal_Int16 nType(0);
             rIStm.ReadInt16( nType );
             sal_Int32 nActBegin = rIStm.Tell();
+            sal_Int32 nActionSize(0);
             rIStm.ReadInt32( nActionSize );
 
             DBG_ASSERT( ( nType <= 33 ) || ( nType >= 1024 ), "Unknown GDIMetaAction while converting!" );
@@ -665,6 +678,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                 case( GDI_RECT_ACTION ):
                 {
                     ImplReadRect( rIStm, aRect );
+                    sal_Int32 nTmp(0), nTmp1(0);
                     rIStm.ReadInt32( nTmp ).ReadInt32( nTmp1 );
 
                     if( nTmp || nTmp1 )
@@ -857,7 +871,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
                 case( GDI_TEXT_ACTION ):
                 {
-                    sal_Int32       nIndex, nLen;
+                    sal_Int32 nIndex(0), nLen(0), nTmp(0);
 
                     ReadPair( rIStm, aPt ).ReadInt32( nIndex ).ReadInt32( nLen ).ReadInt32( nTmp );
                     if (nTmp > 0)
@@ -878,7 +892,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
                 case( GDI_TEXTARRAY_ACTION ):
                 {
-                    sal_Int32   nIndex, nLen, nAryLen;
+                    sal_Int32 nIndex(0), nLen(0), nAryLen(0), nTmp(0);
 
                     ReadPair( rIStm, aPt ).ReadInt32( nIndex ).ReadInt32( nLen ).ReadInt32( nTmp ).ReadInt32( nAryLen );
                     if (nTmp > 0)
@@ -937,7 +951,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
                 case( GDI_STRETCHTEXT_ACTION ):
                 {
-                    sal_Int32       nIndex, nLen, nWidth;
+                    sal_Int32 nIndex(0), nLen(0), nWidth(0), nTmp(0);
 
                     ReadPair( rIStm, aPt ).ReadInt32( nIndex ).ReadInt32( nLen ).ReadInt32( nTmp ).ReadInt32( nWidth );
                     if (nTmp > 0)
@@ -1090,6 +1104,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
                 case( GDI_MOVECLIPREGION_ACTION ):
                 {
+                    sal_Int32 nTmp(0), nTmp1(0);
                     rIStm.ReadInt32( nTmp ).ReadInt32( nTmp1 );
                     rMtf.AddAction( new MetaMoveClipRegionAction( nTmp, nTmp1 ) );
                 }
commit cbebf9f2a067056a2ba57e3b2e60147cf347f590
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Feb 8 10:55:52 2017 +0100

    ofz#419 same problem as wmf and emf
    
    Change-Id: If2063563ace56f285f332b9e85ef81ea8f671859

diff --git a/vcl/source/gdi/cvtsvm.cxx b/vcl/source/gdi/cvtsvm.cxx
index 1013154..6ad9e4a 100644
--- a/vcl/source/gdi/cvtsvm.cxx
+++ b/vcl/source/gdi/cvtsvm.cxx
@@ -463,6 +463,8 @@ SVMConverter::SVMConverter( SvStream& rStm, GDIMetaFile& rMtf, sal_uLong nConver
     }
 }
 
+#define LF_FACESIZE 32
+
 void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 {
     const sal_uLong         nPos = rIStm.Tell();
@@ -808,7 +810,7 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
                 case( GDI_FONT_ACTION ):
                 {
                     vcl::Font   aFont;
-                    char        aName[ 32 ];
+                    char        aName[LF_FACESIZE+1];
                     sal_Int32   nWidth, nHeight;
                     sal_Int16   nCharSet, nFamily, nPitch, nAlign, nWeight, nUnderline, nStrikeout;
                     sal_Int16   nCharOrient, nLineOrient;
@@ -816,7 +818,8 @@ void SVMConverter::ImplConvertFromSVM1( SvStream& rIStm, GDIMetaFile& rMtf )
 
                     ImplReadColor( rIStm, aActionColor ); aFont.SetColor( aActionColor );
                     ImplReadColor( rIStm, aActionColor ); aFont.SetFillColor( aActionColor );
-                    rIStm.Read( aName, 32 );
+                    size_t nRet = rIStm.Read(aName, LF_FACESIZE);
+                    aName[nRet] = 0;
                     aFont.SetName( OUString( aName, strlen(aName), rIStm.GetStreamCharSet() ) );
                     rIStm.ReadInt32( nWidth ).ReadInt32( nHeight );
                     rIStm.ReadInt16( nCharOrient ).ReadInt16( nLineOrient );
commit e536fbb2e5c6b42049effbd0608d56a932fd8d5a
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Jan 17 21:19:13 2017 +0000

    ofz#414 crash in DXFHatchEntity::EvaluateGroup
    
    (cherry picked from commit 5434d51d12611eb2726ce1394eb01921d008fa89)
    
    ofz#415 crash in DXFVector::DXFVector
    
    (cherry picked from commit 2a9b4363ca190f1d783d540e95a031357f852858)
    
    Change-Id: I15c8cb7aeb8c45f32357afd0ea2f550ffe11dbf7
    Reviewed-on: https://gerrit.libreoffice.org/33235
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 0f213087f25853bbb0100f6496d5392ce708ab45)

diff --git a/filter/source/graphicfilter/idxf/dxfentrd.cxx b/filter/source/graphicfilter/idxf/dxfentrd.cxx
index 85508ac..d4f7e30 100644
--- a/filter/source/graphicfilter/idxf/dxfentrd.cxx
+++ b/filter/source/graphicfilter/idxf/dxfentrd.cxx
@@ -422,8 +422,11 @@ void DXFLWPolyLineEntity::EvaluateGroup( DXFGroupReader & rDGR )
         case 90 :
         {
             nCount = rDGR.GetI();
-            if ( nCount )
+            // limit alloc to max reasonable size based on remaining data in stream
+            if (nCount > 0 && static_cast<sal_uInt32>(nCount) <= rDGR.remainingSize())
                 pP = new DXFVector[ nCount ];
+            else
+                nCount = 0;
         }
         break;
         case 70: nFlags = rDGR.GetI(); break;
@@ -600,8 +603,11 @@ bool DXFBoundaryPathData::EvaluateGroup( DXFGroupReader & rDGR )
             case 93 :
             {
                 nPointCount = rDGR.GetI();
-                if ( nPointCount )
+                // limit alloc to max reasonable size based on remaining data in stream
+                if (nPointCount > 0 && static_cast<sal_uInt32>(nPointCount) <= rDGR.remainingSize())
                     pP = new DXFVector[ nPointCount ];
+                else
+                    nPointCount = 0;
             }
             break;
             case 72 : nHasBulgeFlag = rDGR.GetI(); break;
@@ -679,8 +685,11 @@ void DXFHatchEntity::EvaluateGroup( DXFGroupReader & rDGR )
         {
             bIsInBoundaryPathContext = true;
             nBoundaryPathCount = rDGR.GetI();
-            if ( nBoundaryPathCount )
+            // limit alloc to max reasonable size based on remaining data in stream
+            if (nBoundaryPathCount > 0 && static_cast<sal_uInt32>(nBoundaryPathCount) <= rDGR.remainingSize())
                 pBoundaryPathData = new DXFBoundaryPathData[ nBoundaryPathCount ];
+            else
+                nBoundaryPathCount = 0;
         }
         break;
         case 75 :
diff --git a/filter/source/graphicfilter/idxf/dxfgrprd.cxx b/filter/source/graphicfilter/idxf/dxfgrprd.cxx
index ac1ca2d..f4669fd 100644
--- a/filter/source/graphicfilter/idxf/dxfgrprd.cxx
+++ b/filter/source/graphicfilter/idxf/dxfgrprd.cxx
@@ -222,5 +222,9 @@ void DXFGroupReader::ReadS()
     S = DXFReadLine(rIS);
 }
 
+sal_uInt64 DXFGroupReader::remainingSize() const
+{
+    return rIS.remainingSize();
+}
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/filter/source/graphicfilter/idxf/dxfgrprd.hxx b/filter/source/graphicfilter/idxf/dxfgrprd.hxx
index 8228208..6064a7e 100644
--- a/filter/source/graphicfilter/idxf/dxfgrprd.hxx
+++ b/filter/source/graphicfilter/idxf/dxfgrprd.hxx
@@ -64,6 +64,7 @@ public:
 
     void SetS(); // (will be copied)
 
+    sal_uInt64 remainingSize() const;
 private:
 
     long   ReadI();
commit ce7ffd0da5e856e13f2bfec22c474fbad7fc6ff4
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Jan 16 17:00:06 2017 +0000

    ofz: ensure nOldSize is > 0
    
    Change-Id: Iaf385c9cd4fd37d56879908c00c7483762d66a0b
    (cherry picked from commit dd70861fd7123c826feefa86f8af1da1f4877c97)
    Reviewed-on: https://gerrit.libreoffice.org/33178
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 7deb0227ad0556e2c40231f26b637272e84f5d7e)

diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx
index ff578ac..d132aa4 100644
--- a/filter/source/graphicfilter/ios2met/ios2met.cxx
+++ b/filter/source/graphicfilter/ios2met/ios2met.cxx
@@ -510,7 +510,7 @@ void OS2METReader::AddPointsToArea(const tools::Polygon & rPoly)
     else {
         tools::Polygon aLastPoly(pPP->GetObject(pPP->Count()-1));
         nOldSize=aLastPoly.GetSize();
-        if (aLastPoly.GetPoint(nOldSize-1)==rPoly.GetPoint(0)) nOldSize--;
+        if (nOldSize && aLastPoly.GetPoint(nOldSize-1)==rPoly.GetPoint(0)) nOldSize--;
         nNewSize=nOldSize+rPoly.GetSize();
         aLastPoly.SetSize(nNewSize);
         for (i=nOldSize; i<nNewSize; i++) {
@@ -531,7 +531,7 @@ void OS2METReader::AddPointsToPath(const tools::Polygon & rPoly)
     else {
         tools::Polygon aLastPoly(pPP->GetObject(pPP->Count()-1));
         nOldSize=aLastPoly.GetSize();
-        if (aLastPoly.GetPoint(nOldSize-1)!=rPoly.GetPoint(0)) pPP->Insert(rPoly);
+        if (nOldSize && aLastPoly.GetPoint(nOldSize-1)!=rPoly.GetPoint(0)) pPP->Insert(rPoly);
         else {
             nOldSize--;
             nNewSize=nOldSize+rPoly.GetSize();
commit 7ac82f6a50c10c171853cb69c58e94e56b70c2b3
Author: Stephan Bergmann <sbergman at redhat.com>
Date:   Tue Jan 17 10:03:49 2017 +0100

    tdf#105212: BASIC sets Delimiter prop to integer value
    
    LO's BASIC doesn't have first-class support for the UNO CHAR type, often uses
    integer values to represent such CHAR values (cf. <https://wiki.openoffice.org/
    wiki/Documentation/DevGuide/ProUNO/Basic/Mapping_of_Simple_Types>).
    
    Since 0b07406f7147b9abbb2095d9e038b13293cb8b10 "Use C++11 char16_t for
    sal_Unicode" (for non-Windows, since LO 5.1) resp.
    e16fa715c43dcdf836ce8c400b6d54eae87b627d "Handle wchar_t as native C++11 type on
    windows" (for Windows, since LO 5.2), C++ css::uno::Any >>=, <<=, etc. with a
    sal_Unicode argument no longer silently treat the argument as sal_uInt16
    instead.  That means that BASIC code putting an integer value into a UNO ANY
    that shall hold a value of CHAR type may no longer work.  (Arguably, such code
    only ever happened to work by coincidence.  For example, if the ANY were
    processed by Java instead of C++ code, it would never have worked.)
    
    Luckily, the use of CHAR in the UNO API is rare (for a good reason, as a single
    UTF-16 code unit is hardly ever the right choice to represent "a character").
    The only documented place I could find using a CHAR property is Delimiter in the
    css.text.TextSortDescriptor and css.text.TextSortDescriptor2 services.  And the
    only processing of such a property that I could find across the LO code base is
    in the file modified here, which thus just takes a one-off special effort to
    take care of this problem.
    
    The direction from C++ to BASIC is left as-is.  The value of the Delimiter
    property is now reported as a CHAR value (where in the past it was---arguably
    erroneously---reported as an UNSIGNED SHORT value), and BASIC is generally
    capable of handling such CHAR values it receives well.  For example, in the
    BASIC code attached to tdf#105212,
    
    >   MsgBox("Sort: " + SortDesc(1).Name  + " = " + SortDesc(1).Value)
    
    SortDesc(1).Value will now print a (space) character instead of its numeric
    value (32).  Also, any other uses of individual CHAR values in the UNO API apart
    from properties appear to already be handled well enough by BASIC, as the sample

... etc. - the rest is truncated


More information about the Libreoffice-commits mailing list