[Libreoffice-commits] core.git: Branch 'distro/collabora/cp-5.3' - 15 commits - accessibility/source connectivity/source cui/source hwpfilter/source include/sfx2 include/svx include/vcl sc/source sd/source sfx2/source slideshow/source svx/source sw/qa sw/source vcl/inc vcl/source vcl/unx writerfilter/source

Eike Rathke erack at redhat.com
Wed Jul 12 08:56:11 UTC 2017


 accessibility/source/extended/accessibletabbarbase.cxx |    2 
 connectivity/source/drivers/dbase/DTable.cxx           |    7 ++
 cui/source/inc/backgrnd.hxx                            |    1 
 cui/source/tabpages/backgrnd.cxx                       |   12 ++--
 hwpfilter/source/hinfo.h                               |   11 ++--
 hwpfilter/source/hpara.cxx                             |   23 ++++-----
 hwpfilter/source/hpara.h                               |    4 -
 hwpfilter/source/hwpfile.cxx                           |   41 +++++++++++++----
 hwpfilter/source/hwpfile.h                             |    4 -
 hwpfilter/source/hwpreader.cxx                         |    4 -
 include/sfx2/notebookbar/SfxNotebookBar.hxx            |    6 ++
 include/svx/hyperdlg.hxx                               |    1 
 include/vcl/syschild.hxx                               |    6 ++
 sc/source/filter/html/htmlexp.cxx                      |   15 ++++--
 sc/source/ui/docshell/docsh8.cxx                       |    4 -
 sd/source/ui/view/drviewse.cxx                         |    5 ++
 sfx2/source/notebookbar/SfxNotebookBar.cxx             |   14 +++++
 slideshow/source/engine/opengl/TransitionerImpl.cxx    |   20 ++++++++
 svx/source/dialog/hyperdlg.cxx                         |    5 ++
 sw/qa/extras/ooxmlexport/data/fdo106029.docx           |binary
 sw/qa/extras/ooxmlexport/ooxmlexport4.cxx              |    8 +++
 sw/source/core/access/accmap.cxx                       |    5 ++
 sw/source/core/layout/flowfrm.cxx                      |   14 ++++-
 sw/source/core/layout/objectformattertxtfrm.cxx        |   27 ++++++++++-
 sw/source/core/text/frmform.cxx                        |    8 ++-
 sw/source/filter/ww8/docxexport.cxx                    |   10 ++--
 sw/source/filter/ww8/ww8par3.cxx                       |    2 
 vcl/inc/salobj.hxx                                     |    4 +
 vcl/inc/unx/salobj.h                                   |    2 
 vcl/source/window/syschild.cxx                         |    6 ++
 vcl/unx/generic/window/salobj.cxx                      |   39 ++++++++++++++++
 vcl/unx/gtk/gtksalframe.cxx                            |    4 +
 vcl/unx/gtk3/gtk3gtkdata.cxx                           |   21 ++++++--
 writerfilter/source/dmapper/DomainMapper_Impl.cxx      |    7 ++
 writerfilter/source/dmapper/SettingsTable.cxx          |   10 ++++
 writerfilter/source/dmapper/SettingsTable.hxx          |    1 
 36 files changed, 289 insertions(+), 64 deletions(-)

New commits:
commit 891f6cd2008e71c9c515f2f7b3ab5f22e377b548
Author: Eike Rathke <erack at redhat.com>
Date:   Tue Jun 20 23:56:44 2017 +0200

    Resolves: tdf#105740 select without selecting.. tdf#101588 b0rk
    
    The initial color, if determined, must result in being selected. Differentiate
    between pre-selected and user-selected.
    
    Regression of
    
        commit 429be969b39867d6d9f36978c9ac15b601e78ba6
        Date:   Mon Dec 12 21:24:20 2016 +0100
    
    Change-Id: I928af131d03c61a8e474e5cd356aea8b766112fa
    (cherry picked from commit aee66aa85e75f67135e5c6079a281e18402d261a)
    Reviewed-on: https://gerrit.libreoffice.org/39026
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit 1096d1c237a2c4fc7497dd073d0f62bb01ffe925)

diff --git a/cui/source/inc/backgrnd.hxx b/cui/source/inc/backgrnd.hxx
index 18ec128078f7..d2663f3cd27e 100644
--- a/cui/source/inc/backgrnd.hxx
+++ b/cui/source/inc/backgrnd.hxx
@@ -107,6 +107,7 @@ private:
     bool        bIsGraphicValid     : 1;
     bool        bLinkOnly           : 1;
     bool        bHighlighting       : 1;
+    bool        m_bColorSelected    : 1;
     Graphic     aBgdGraphic;
     OUString    aBgdGraphicPath;
     OUString    aBgdGraphicFilter;
diff --git a/cui/source/tabpages/backgrnd.cxx b/cui/source/tabpages/backgrnd.cxx
index 6f5d72bab35a..43d8fdd2eddb 100644
--- a/cui/source/tabpages/backgrnd.cxx
+++ b/cui/source/tabpages/backgrnd.cxx
@@ -330,6 +330,7 @@ SvxBackgroundTabPage::SvxBackgroundTabPage(vcl::Window* pParent, const SfxItemSe
     , bIsGraphicValid(false)
     , bLinkOnly(false)
     , bHighlighting(false)
+    , m_bColorSelected(false)
     , pPageImpl(new SvxBackgroundPage_Impl)
     , pImportDlg(nullptr)
     , pTableBck_Impl(nullptr)
@@ -448,6 +449,8 @@ void SvxBackgroundTabPage::Reset( const SfxItemSet* rSet )
         return;
     }
 
+    m_bColorSelected = false;
+
     // condition of the preview button is persistent due to UserData
     OUString aUserData = GetUserData();
     m_pBtnPreview->Check( !aUserData.isEmpty() && '1' == aUserData[0] );
@@ -684,7 +687,7 @@ bool SvxBackgroundTabPage::FillItemSet( SfxItemSet* rCoreSet )
             {
                 // Brush-treatment:
                 if ( rOldItem.GetColor() != aBgdColor ||
-                     (SfxItemState::DEFAULT >= eOldItemState && !m_pBackgroundColorSet->IsNoSelection()))
+                     (SfxItemState::DEFAULT >= eOldItemState && m_bColorSelected))
                 {
                     bModified = true;
                     rCoreSet->Put( SvxBrushItem( aBgdColor, nWhich ) );
@@ -1138,6 +1141,7 @@ IMPL_LINK_NOARG(SvxBackgroundTabPage, BackgroundColorHdl_Impl, ValueSet*, void)
     sal_uInt16 nItemId = m_pBackgroundColorSet->GetSelectItemId();
     Color aColor = nItemId ? ( m_pBackgroundColorSet->GetItemColor( nItemId ) ) : Color( COL_TRANSPARENT );
     aBgdColor = aColor;
+    m_bColorSelected = true;
     m_pPreviewWin1->NotifyChange( aBgdColor );
 }
 
@@ -1423,13 +1427,9 @@ void SvxBackgroundTabPage::FillControls_Impl( const SvxBrushItem& rBgdAttr,
         }
         else
         {
-            bool bNoSelection = m_pBackgroundColorSet->IsNoSelection();
             m_pBackgroundColorSet->SelectItem( nCol );
-            m_pBackgroundColorSet->SaveValue();
-            // The actual selection is user set, not what we preset.
-            if (bNoSelection)
-                m_pBackgroundColorSet->SetNoSelection();
         }
+        m_pBackgroundColorSet->SaveValue();
 
         m_pPreviewWin1->NotifyChange( aBgdColor );
 
commit c028d8391e8fae4553c5223a8ac0b38d3184d61e
Author: Szymon Kłos <eszkadev at gmail.com>
Date:   Sat Feb 18 13:27:28 2017 +0100

    tdf#103355 Hide Notebookbar during slide show
    
    Change-Id: Ie3e1b9f9dfc109ecb48cd384972dfa5a5118c3fa
    Reviewed-on: https://gerrit.libreoffice.org/34401
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Szymon Kłos <eszkadev at gmail.com>
    Reviewed-on: https://gerrit.libreoffice.org/38898
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 4e461f61ac739c6b9ff38c247095ea69b9fb4e21)

diff --git a/include/sfx2/notebookbar/SfxNotebookBar.hxx b/include/sfx2/notebookbar/SfxNotebookBar.hxx
index 471e806d96c3..8792eecf3a4f 100644
--- a/include/sfx2/notebookbar/SfxNotebookBar.hxx
+++ b/include/sfx2/notebookbar/SfxNotebookBar.hxx
@@ -37,6 +37,11 @@ public:
                             const css::uno::Reference<css::frame::XFrame> & xFrame,
                             const OUString& rUIFile);
 
+    /// Method temporarily blocks showing of the NotebookBar
+    static void LockNotebookBar();
+    /// Method restores normal behaviour of the Notebookbar
+    static void UnlockNotebookBar();
+
     static void RemoveListeners(SystemWindow* pSysWindow);
 
     static void ShowMenubar(bool bShow);
@@ -44,6 +49,7 @@ public:
 
 private:
     static bool m_bLock;
+    static bool m_bHide;
 
     DECL_STATIC_LINK(SfxNotebookBar, OpenNotebookbarPopupMenu, NotebookBar*, void);
 };
diff --git a/sd/source/ui/view/drviewse.cxx b/sd/source/ui/view/drviewse.cxx
index cff011ed0dc2..e48126db1870 100644
--- a/sd/source/ui/view/drviewse.cxx
+++ b/sd/source/ui/view/drviewse.cxx
@@ -60,6 +60,7 @@
 #include <avmedia/mediawindow.hxx>
 #include <svl/urihelper.hxx>
 #include <sfx2/docfile.hxx>
+#include <sfx2/notebookbar/SfxNotebookBar.hxx>
 
 #include "DrawViewShell.hxx"
 #include "slideshow.hxx"
@@ -722,8 +723,12 @@ void DrawViewShell::FuSupport(SfxRequest& rReq)
         case SID_PRESENTATION_CURRENT_SLIDE:
         case SID_REHEARSE_TIMINGS:
         {
+            sfx2::SfxNotebookBar::LockNotebookBar();
+
             slideshowhelp::ShowSlideShow(rReq, *GetDoc());
             rReq.Ignore ();
+
+            sfx2::SfxNotebookBar::UnlockNotebookBar();
         }
         break;
 
diff --git a/sfx2/source/notebookbar/SfxNotebookBar.cxx b/sfx2/source/notebookbar/SfxNotebookBar.cxx
index c3821b6d6ff9..00cc7e99c01d 100644
--- a/sfx2/source/notebookbar/SfxNotebookBar.cxx
+++ b/sfx2/source/notebookbar/SfxNotebookBar.cxx
@@ -35,6 +35,7 @@ using namespace css;
 #define MENUBAR_STR "private:resource/menubar/menubar"
 
 bool SfxNotebookBar::m_bLock = false;
+bool SfxNotebookBar::m_bHide = false;
 
 static Reference<frame::XLayoutManager> lcl_getLayoutManager( const Reference<frame::XFrame>& xFrame )
 {
@@ -168,8 +169,21 @@ void SfxNotebookBar::CloseMethod(SystemWindow* pSysWindow)
     }
 }
 
+void SfxNotebookBar::LockNotebookBar()
+{
+    m_bHide = true;
+}
+
+void SfxNotebookBar::UnlockNotebookBar()
+{
+    m_bHide = false;
+}
+
 bool SfxNotebookBar::IsActive()
 {
+    if (m_bHide)
+        return false;
+
     vcl::EnumContext::Application eApp = vcl::EnumContext::Application::Application_Any;
 
     if (SfxViewFrame::Current())
commit a5a76729768a4282669695ff511c98e28e6004ab
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Jun 13 18:09:08 2017 +0100

    make opengl transitions under X flicker free on enter/leave
    
    Change-Id: I109637dc6b3d23c0beca21f3cf0c7ba918ecb4f8
    Reviewed-on: https://gerrit.libreoffice.org/38749
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 277395b6266c57a7709c3c47986f135f6789c8e7)
    Reviewed-on: https://gerrit.libreoffice.org/38753
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit b49779db18fa094f3b2f4166ee93c072d2f117a1)

diff --git a/include/vcl/syschild.hxx b/include/vcl/syschild.hxx
index 3f5ed9beda2a..9f5be6780064 100644
--- a/include/vcl/syschild.hxx
+++ b/include/vcl/syschild.hxx
@@ -49,6 +49,12 @@ public:
     //  however, this might not always be required
     void                    EnableEraseBackground( bool bEnable );
     void                    SetForwardKey( bool bEnable );
+    //To avoid annoying flashing under X entering and leaving slides with opengl effects set the leaving
+    //bitmap as the background pixmap of the opengl child window and the entering bitmap as the background
+    //pixmap of the non-opengl parent window. If any expose events occur around the start and end of
+    //the transition then those windows are default filled by X with the desired start/end image so there's
+    //no visible flash
+    void                    SetLeaveEnterBackgrounds(const css::uno::Sequence<css::uno::Any>& rLeaveArgs, const css::uno::Sequence<css::uno::Any>& rEnterArgs);
     // return the platform specific handle/id of this window;
     sal_IntPtr              GetParentWindowHandle();
 };
diff --git a/slideshow/source/engine/opengl/TransitionerImpl.cxx b/slideshow/source/engine/opengl/TransitionerImpl.cxx
index ef1d385e77fb..61a28e9422ff 100644
--- a/slideshow/source/engine/opengl/TransitionerImpl.cxx
+++ b/slideshow/source/engine/opengl/TransitionerImpl.cxx
@@ -367,6 +367,26 @@ void OGLTransitionerImpl::setSlides( const uno::Reference< rendering::XBitmap >&
     SAL_INFO("slideshow.opengl", "leaving bitmap area: " << maSlideSize.Width << "x" << maSlideSize.Height);
     maSlideSize = mxEnteringBitmap->getSize();
     SAL_INFO("slideshow.opengl", "entering bitmap area: " << maSlideSize.Width << "x" << maSlideSize.Height);
+
+    //to avoid annoying flashing under X entering and leaving slides with opengl effects set the leaving
+    //bitmap as the background pixmap of the opengl child window and the entering bitmap as the background
+    //pixmap of the non-opengl parent window. If any expose events occur around the start and end of
+    //the transition then those windows are default filled by X with the desired start/end image so there's
+    //no visible flash
+    if (SystemChildWindow* pChildWindow = mpContext->getChildWindow())
+    {
+        css::uno::Reference<css::beans::XFastPropertySet> xEnteringFastPropertySet(mxEnteringBitmap, css::uno::UNO_QUERY);
+        css::uno::Reference<css::beans::XFastPropertySet> xLeavingFastPropertySet(mxLeavingBitmap, css::uno::UNO_QUERY);
+        css::uno::Sequence<css::uno::Any> aEnteringBitmap;
+        css::uno::Sequence<css::uno::Any> aLeavingBitmap;
+        if (xEnteringFastPropertySet.get() && xLeavingFastPropertySet.get())
+        {
+            xEnteringFastPropertySet->getFastPropertyValue(1) >>= aEnteringBitmap;
+            xLeavingFastPropertySet->getFastPropertyValue(1) >>= aLeavingBitmap;
+        }
+        if (aEnteringBitmap.getLength() == 3 && aLeavingBitmap.getLength() == 3)
+            pChildWindow->SetLeaveEnterBackgrounds(aLeavingBitmap, aEnteringBitmap);
+    }
 }
 
 
diff --git a/vcl/inc/salobj.hxx b/vcl/inc/salobj.hxx
index b1005fb87846..08d8a39ed661 100644
--- a/vcl/inc/salobj.hxx
+++ b/vcl/inc/salobj.hxx
@@ -21,7 +21,7 @@
 #define INCLUDED_VCL_INC_SALOBJ_HXX
 
 #include <vcl/dllapi.h>
-
+#include <com/sun/star/uno/Sequence.hxx>
 #include "salwtype.hxx"
 
 struct SystemEnvData;
@@ -48,6 +48,8 @@ public:
 
     virtual void                    SetForwardKey( bool /* bEnable */ ) {}
 
+    virtual void                    SetLeaveEnterBackgrounds(const css::uno::Sequence<css::uno::Any>& /*rLeaveArgs*/, const css::uno::Sequence<css::uno::Any>& /*rEnterArgs*/) {}
+
     virtual const SystemEnvData*    GetSystemData() const = 0;
 
     void                            SetCallback( void* pInst, SALOBJECTPROC pProc )
diff --git a/vcl/inc/unx/salobj.h b/vcl/inc/unx/salobj.h
index ffc738aa6987..b3170cb6c0af 100644
--- a/vcl/inc/unx/salobj.h
+++ b/vcl/inc/unx/salobj.h
@@ -76,6 +76,8 @@ public:
     virtual void                    Show( bool bVisible ) override;
     virtual void                    GrabFocus() override;
 
+    virtual void                    SetLeaveEnterBackgrounds(const css::uno::Sequence<css::uno::Any>& rLeaveArgs, const css::uno::Sequence<css::uno::Any>& rEnterArgs) override;
+
     virtual const SystemEnvData*    GetSystemData() const override;
 };
 
diff --git a/vcl/source/window/syschild.cxx b/vcl/source/window/syschild.cxx
index d6595038991b..bdeebf118dfc 100644
--- a/vcl/source/window/syschild.cxx
+++ b/vcl/source/window/syschild.cxx
@@ -162,6 +162,12 @@ void SystemChildWindow::EnableEraseBackground( bool bEnable )
         mpWindowImpl->mpSysObj->EnableEraseBackground( bEnable );
 }
 
+void SystemChildWindow::SetLeaveEnterBackgrounds(const css::uno::Sequence<css::uno::Any>& rLeaveArgs, const css::uno::Sequence<css::uno::Any>& rEnterArgs)
+{
+    if (mpWindowImpl->mpSysObj)
+        mpWindowImpl->mpSysObj->SetLeaveEnterBackgrounds(rLeaveArgs, rEnterArgs);
+}
+
 void SystemChildWindow::SetForwardKey( bool bEnable )
 {
     if ( mpWindowImpl->mpSysObj )
diff --git a/vcl/unx/generic/window/salobj.cxx b/vcl/unx/generic/window/salobj.cxx
index 80c0726214c9..2f238b7f9d7e 100644
--- a/vcl/unx/generic/window/salobj.cxx
+++ b/vcl/unx/generic/window/salobj.cxx
@@ -249,6 +249,9 @@ X11SalObject::~X11SalObject()
     rObjects.remove( this );
 
     GetGenericData()->ErrorTrapPush();
+    const SystemEnvData* pEnv   = mpParent->GetSystemData();
+    ::Window aObjectParent      = (::Window)pEnv->aWindow;
+    XSetWindowBackgroundPixmap(static_cast<Display*>(maSystemChildData.pDisplay), aObjectParent, None);
     if ( maSecondary )
         XDestroyWindow( static_cast<Display*>(maSystemChildData.pDisplay), maSecondary );
     if ( maPrimary )
@@ -474,4 +477,40 @@ bool X11SalObject::Dispatch( XEvent* pEvent )
     return false;
 }
 
+void X11SalObject::SetLeaveEnterBackgrounds(const css::uno::Sequence<css::uno::Any>& rLeaveArgs, const css::uno::Sequence<css::uno::Any>& rEnterArgs)
+{
+    SalDisplay* pSalDisp        = vcl_sal::getSalDisplay(GetGenericData());
+    const SystemEnvData* pEnv   = mpParent->GetSystemData();
+    Display* pDisp              = pSalDisp->GetDisplay();
+    ::Window aObjectParent      = (::Window)pEnv->aWindow;
+
+    bool bFreePixmap = false;
+    Pixmap aPixmap = None;
+    if (rEnterArgs.getLength() == 3)
+    {
+        rEnterArgs[0] >>= bFreePixmap;
+        long pixmapHandle = None;
+        rEnterArgs[1] >>= pixmapHandle;
+        aPixmap = pixmapHandle;
+    }
+
+    XSetWindowBackgroundPixmap(pDisp, aObjectParent, aPixmap);
+    if (bFreePixmap)
+        XFreePixmap(pDisp, aPixmap);
+
+    bFreePixmap = false;
+    aPixmap = None;
+    if (rLeaveArgs.getLength() == 3)
+    {
+        rLeaveArgs[0] >>= bFreePixmap;
+        long pixmapHandle = None;
+        rLeaveArgs[1] >>= pixmapHandle;
+        aPixmap = pixmapHandle;
+    }
+
+    XSetWindowBackgroundPixmap(pDisp, maSecondary, aPixmap);
+    if (bFreePixmap)
+        XFreePixmap(pDisp, aPixmap);
+}
+
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/vcl/unx/gtk/gtksalframe.cxx b/vcl/unx/gtk/gtksalframe.cxx
index 1e28c041ea47..b10994d7d4d0 100644
--- a/vcl/unx/gtk/gtksalframe.cxx
+++ b/vcl/unx/gtk/gtksalframe.cxx
@@ -2882,7 +2882,9 @@ gboolean GtkSalFrame::signalExpose( GtkWidget*, GdkEventExpose* pEvent, gpointer
 {
     GtkSalFrame* pThis = static_cast<GtkSalFrame*>(frame);
 
-    struct SalPaintEvent aEvent( pEvent->area.x, pEvent->area.y, pEvent->area.width, pEvent->area.height, OpenGLHelper::isVCLOpenGLEnabled() );
+    const bool bImmediate = OpenGLHelper::isVCLOpenGLEnabled() || pThis->m_bFullscreen;
+
+    struct SalPaintEvent aEvent( pEvent->area.x, pEvent->area.y, pEvent->area.width, pEvent->area.height, bImmediate );
 
     pThis->CallCallback( SalEvent::Paint, &aEvent );
 
commit 736c12e1b2e9dbf3437c11c67bf0fa951587bf69
Author: Michael Stahl <mstahl at redhat.com>
Date:   Wed Jun 21 12:26:19 2017 +0200

    tdf#101821 sw: fix layout footnote use-after-free
    
    After inserting a header in the bugdoc, during SwFrame::Calc of a
    SwTextFrame that is in a footnote, it decides move forward to the next
    page.  This deletes the SwFootnoteFrame and SwFootnoteContFrame that
    lcl_FormatContentOfLayoutFrame() are iterating over.
    
    For want of a more elegant solution, use a big hammer to prevent the
    problem and try to clean up so that no empty SwFootnoteFrame and
    SwFootnoteContFrame remain (as that is known to crash in other places,
    see commit c9fb347642729017ad0c613fe26310befd021db8)
    
    Invalid read of size 8
       at 0x414E1F96: SwFrame::GetNext() (frame.hxx:485)
       by 0x41AFDD07: lcl_FormatContentOfLayoutFrame(SwLayoutFrame*, SwFrame*) (objectformattertxtfrm.cxx:646)
       by 0x41AFDCC0: lcl_FormatContentOfLayoutFrame(SwLayoutFrame*, SwFrame*) (objectformattertxtfrm.cxx:642)
       by 0x41AFDCC0: lcl_FormatContentOfLayoutFrame(SwLayoutFrame*, SwFrame*) (objectformattertxtfrm.cxx:642)
       by 0x41AFDEA7: SwObjectFormatterTextFrame::FormatAnchorFrameAndItsPrevs(SwTextFrame&) (objectformattertxtfrm.cxx:696)
       by 0x41AAA680: SwFlyAtContentFrame::MakeAll(OutputDevice*) (flycnt.cxx:415)
       by 0x41A7F211: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:346)
       by 0x41B75758: SwFrame::Calc(OutputDevice*) const (trvlfrm.cxx:1761)
       by 0x41AA8927: SwFlyFrame::Calc(OutputDevice*) const (fly.cxx:2559)
       by 0x41ADB36B: SwLayAction::FormatLayoutFly(SwFlyFrame*) (layact.cxx:1414)
       by 0x41AF9658: SwObjectFormatter::FormatObj_(SwAnchoredObject&) (objectformatter.cxx:321)
       by 0x41AFCB6E: SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool) (objectformattertxtfrm.cxx:126)
       by 0x41AF9A6A: SwObjectFormatter::FormatObjsAtFrame_(SwTextFrame*) (objectformatter.cxx:443)
       by 0x41AFD275: SwObjectFormatterTextFrame::DoFormatObjs() (objectformattertxtfrm.cxx:328)
       by 0x41AF924A: SwObjectFormatter::FormatObjsAtFrame(SwFrame&, SwPageFrame const&, SwLayAction*) (objectformatter.cxx:191)
       by 0x41ADC213: SwLayAction::FormatContent(SwPageFrame const*) (layact.cxx:1633)
       by 0x41AD88DE: SwLayAction::InternalAction(OutputDevice*) (layact.cxx:760)
       by 0x41AD7080: SwLayAction::Action(OutputDevice*) (layact.cxx:351)
       by 0x41ADE32E: SwLayIdle::SwLayIdle(SwRootFrame*, SwViewShellImp*) (layact.cxx:2133)
       by 0x41FFC97E: SwViewShell::LayoutIdle() (viewsh.cxx:711)
     Address 0x505541a8 is 72 bytes inside a block of size 272 free'd
       at 0x4C2F21A: operator delete(void*) (vg_replace_malloc.c:576)
       by 0x41AD371A: SwFootnoteFrame::~SwFootnoteFrame() (ftnfrm.hxx:52)
       by 0x41B5B74C: SwFrame::DestroyFrame(SwFrame*) (ssfrm.cxx:391)
       by 0x41A97294: SwFlowFrame::CutTree(SwFrame*) (flowfrm.cxx:406)
       by 0x41A979AE: SwFlowFrame::MoveSubTree(SwLayoutFrame*, SwFrame*) (flowfrm.cxx:592)
       by 0x41ACFB69: SwContentFrame::MoveFootnoteCntFwd(bool, SwFootnoteBossFrame*) (ftnfrm.cxx:2756)
       by 0x41A9B78E: SwFlowFrame::MoveFwd(bool, bool, bool) (flowfrm.cxx:1813)
       by 0x41A85864: SwContentFrame::MakeAll(OutputDevice*) (calcmove.cxx:1681)
       by 0x41A7F211: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:346)
       by 0x41B75758: SwFrame::Calc(OutputDevice*) const (trvlfrm.cxx:1761)
       by 0x41AFDCFB: lcl_FormatContentOfLayoutFrame(SwLayoutFrame*, SwFrame*) (objectformattertxtfrm.cxx:644)
       by 0x41AFDCC0: lcl_FormatContentOfLayoutFrame(SwLayoutFrame*, SwFrame*) (objectformattertxtfrm.cxx:642)
       by 0x41AFDCC0: lcl_FormatContentOfLayoutFrame(SwLayoutFrame*, SwFrame*) (objectformattertxtfrm.cxx:642)
       by 0x41AFDCC0: lcl_FormatContentOfLayoutFrame(SwLayoutFrame*, SwFrame*) (objectformattertxtfrm.cxx:642)
       by 0x41AFDEA7: SwObjectFormatterTextFrame::FormatAnchorFrameAndItsPrevs(SwTextFrame&) (objectformattertxtfrm.cxx:696)
       by 0x41AAA680: SwFlyAtContentFrame::MakeAll(OutputDevice*) (flycnt.cxx:415)
       by 0x41A7F211: SwFrame::PrepareMake(OutputDevice*) (calcmove.cxx:346)
       by 0x41B75758: SwFrame::Calc(OutputDevice*) const (trvlfrm.cxx:1761)
       by 0x41AA8927: SwFlyFrame::Calc(OutputDevice*) const (fly.cxx:2559)
       by 0x41ADB36B: SwLayAction::FormatLayoutFly(SwFlyFrame*) (layact.cxx:1414)
       by 0x41AF9658: SwObjectFormatter::FormatObj_(SwAnchoredObject&) (objectformatter.cxx:321)
       by 0x41AFCB6E: SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool) (objectformattertxtfrm.cxx:126)
       by 0x41AF9A6A: SwObjectFormatter::FormatObjsAtFrame_(SwTextFrame*) (objectformatter.cxx:443)
       by 0x41AFD275: SwObjectFormatterTextFrame::DoFormatObjs() (objectformattertxtfrm.cxx:328)
       by 0x41AF924A: SwObjectFormatter::FormatObjsAtFrame(SwFrame&, SwPageFrame const&, SwLayAction*) (objectformatter.cxx:191)
       by 0x41ADC213: SwLayAction::FormatContent(SwPageFrame const*) (layact.cxx:1633)
       by 0x41AD88DE: SwLayAction::InternalAction(OutputDevice*) (layact.cxx:760)
       by 0x41AD7080: SwLayAction::Action(OutputDevice*) (layact.cxx:351)
       by 0x41ADE32E: SwLayIdle::SwLayIdle(SwRootFrame*, SwViewShellImp*) (layact.cxx:2133)
       by 0x41FFC97E: SwViewShell::LayoutIdle() (viewsh.cxx:711)
    
    Change-Id: I656cc2303eeccd5eef68ad3b8e81bb0fd47b94fb
    (cherry picked from commit 9dcb767c5bdccdf6606240afd6aa2c6bd3dcc9f4)
    Reviewed-on: https://gerrit.libreoffice.org/39105
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit f8b32e4388cfc9cfcf1acebc82d023a8d3783463)

diff --git a/sw/source/core/layout/flowfrm.cxx b/sw/source/core/layout/flowfrm.cxx
index c2ccaddaf66c..14a6ad91eac9 100644
--- a/sw/source/core/layout/flowfrm.cxx
+++ b/sw/source/core/layout/flowfrm.cxx
@@ -401,8 +401,18 @@ SwLayoutFrame *SwFlowFrame::CutTree( SwFrame *pStart )
         if ( !pLay->Lower() && !pLay->IsColLocked() &&
              !static_cast<SwFootnoteFrame*>(pLay)->IsBackMoveLocked() )
         {
-            pLay->Cut();
-            SwFrame::DestroyFrame(pLay);
+            // tdf#101821 don't delete it while iterating over it
+            if (!pLay->IsDeleteForbidden())
+            {
+                pLay->Cut();
+                SwFrame::DestroyFrame(pLay);
+            }
+            // else: assume there is code on the stack to clean up empty
+            // footnote frames
+            // (don't go into the else branch below, it produces a disconnected
+            // footnote with null upper that can be returned by
+            // SwFootnoteBossFrame::FindFootnote() causing null pointer deref
+            // in SwTextFrame::ConnectFootnote()
         }
         else
         {
diff --git a/sw/source/core/layout/objectformattertxtfrm.cxx b/sw/source/core/layout/objectformattertxtfrm.cxx
index 16d3ed4fc764..d77dc89ae996 100644
--- a/sw/source/core/layout/objectformattertxtfrm.cxx
+++ b/sw/source/core/layout/objectformattertxtfrm.cxx
@@ -29,6 +29,7 @@
 #include <fmtwrapinfluenceonobjpos.hxx>
 #include <fmtfollowtextflow.hxx>
 #include <layact.hxx>
+#include <ftnfrm.hxx>
 
 using namespace ::com::sun::star;
 
@@ -638,12 +639,36 @@ static void lcl_FormatContentOfLayoutFrame( SwLayoutFrame* pLayFrame,
             break;
         }
         if ( pLowerFrame->IsLayoutFrame() )
+        {
+            SwFrameDeleteGuard aCrudeHack(pLowerFrame); // ??? any issue setting this for non-footnote frames?
             lcl_FormatContentOfLayoutFrame( static_cast<SwLayoutFrame*>(pLowerFrame),
                                         pLastLowerFrame );
+        }
         else
             pLowerFrame->Calc(pLowerFrame->getRootFrame()->GetCurrShell()->GetOut());
 
-        pLowerFrame = pLowerFrame->GetNext();
+        // Calc on a SwTextFrame in a footnote can move it to the next page -
+        // deletion of the SwFootnoteFrame was disabled with SwFrameDeleteGuard
+        // but now we have to clean up empty footnote frames to prevent crashes.
+        // Note: check it at this level, not lower: both container and footnote
+        // can be deleted at the same time!
+        SwFrame *const pNext = pLowerFrame->GetNext();
+        if (pLowerFrame->IsFootnoteContFrame())
+        {
+            for (SwFrame * pFootnote = pLowerFrame->GetLower(); pFootnote; )
+            {
+                assert(pFootnote->IsFootnoteFrame());
+                SwFrame *const pNextNote = pFootnote->GetNext();
+                if (!pFootnote->GetLower() && !pFootnote->IsColLocked() &&
+                    !static_cast<SwFootnoteFrame*>(pFootnote)->IsBackMoveLocked())
+                {
+                    pFootnote->Cut();
+                    SwFrame::DestroyFrame(pFootnote);
+                }
+                pFootnote = pNextNote;
+            }
+        }
+        pLowerFrame = pNext;
     }
 }
 
commit dda4d454d63bc4284cbbac2b5c122c3f6450f207
Author: Michael Stahl <mstahl at redhat.com>
Date:   Fri Jun 30 15:23:15 2017 +0200

    tdf#108838 accessibility: fix horrible memory leak in AccessibleTabBarBase
    
    Reproducing tdf#108833 failed because applying the Master Page takes
    > 2 hours; the time is spent calling vcl::Window listeners, of which
    there were some 39525 after a couple minutes, almost all of which
    AccessibleTabBarBase.
    
    AccessibleTabBarBase::WindowEventListener() has an inverted condition
    that suppresses the event that is generated from TabBar::Clear()
    and thus when DrawViewShell::ResetActualPage() calls Clear() no
    AccessibleTabBarPage is removed but then the InsertPage() calls create
    duplicate objects that again register as listeners.
    
    The condition is obviously inverted given the CVS commit message:
    
    1.2.88.1
    log
    @#135353# do not pass VCLEVENT_TABBAR_PAGEREMOVED (all) to objects other than AccessibleTabBarPageList
    @
    text
    a69 8
    
            if( ( pWinEvent->GetId() == VCLEVENT_TABBAR_PAGEREMOVED ) &&
                ( (sal_uInt16)(sal_IntPtr) pWinEvent->GetData() == TAB_PAGE_NOTFOUND ) &&
                ( dynamic_cast< AccessibleTabBarPageList *> (this) != NULL ) )
            {
                return 0;
            }
    
    Change-Id: I2a3b86bbd0f0251a966f41b316a3b313517df24f
    (cherry picked from commit b2b085441dc79fb78607dbf1969c12a40db58214)
    Reviewed-on: https://gerrit.libreoffice.org/39416
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Noel Grandin <noel.grandin at collabora.co.uk>
    Reviewed-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit 5f345e3a19bf7cad56951ed90fdf78f03a15b96a)

diff --git a/accessibility/source/extended/accessibletabbarbase.cxx b/accessibility/source/extended/accessibletabbarbase.cxx
index f75d4572a789..b137da3acdd5 100644
--- a/accessibility/source/extended/accessibletabbarbase.cxx
+++ b/accessibility/source/extended/accessibletabbarbase.cxx
@@ -50,7 +50,7 @@ IMPL_LINK( AccessibleTabBarBase, WindowEventListener, VclWindowEvent&, rEvent, v
 
     if( ( rEvent.GetId() == VCLEVENT_TABBAR_PAGEREMOVED ) &&
         ( (sal_uInt16)reinterpret_cast<sal_IntPtr>(rEvent.GetData()) == TabBar::PAGE_NOT_FOUND ) &&
-        ( dynamic_cast< AccessibleTabBarPageList *> (this) != nullptr ) )
+        (dynamic_cast<AccessibleTabBarPageList *>(this) == nullptr))
     {
         return;
     }
commit 8c5e45e12c31f6fa1dce7d0b60a949fd185cfb6e
Author: Michael Stahl <mstahl at redhat.com>
Date:   Tue Jul 4 22:46:15 2017 +0200

    sw: fix use-after-free in SwAccessibleMap::FireEvents()
    
    As seen when running JunitTest_sw_unoapi_3 against "make debugrun",
    the damn thing can call itself recursively via an odd corner case in
    GetContext():
    
    0  in SwAccessibleEventList_Impl::~SwAccessibleEventList_Impl() (this=0x9a6a170, __in_chrg=<optimized out>) at sw/source/core/access/accmap.cxx:498
    1  in SwAccessibleMap::FireEvents() (this=0x8198bb0) at sw/source/core/access/accmap.cxx:3023
    2  in SwAccessibleMap::InvalidateCursorPosition(com::sun::star::uno::Reference<com::sun::star::accessibility::XAccessible> const&) (this=0x8198bb0, rAcc=uno::Reference to (SwAccessibleParagraph *) 0x9a439d8) at sw/source/core/access/accmap.cxx:1069
    3  in SwAccessibleMap::GetContext(SwFrame const*, bool) (this=0x8198bb0, pFrame=0x825ca10, bCreate=true) at sw/source/core/access/accmap.cxx:1925
    4  in SwAccessibleMap::GetContextImpl(SwFrame const*, bool) (this=0x8198bb0, pFrame=0x825ca10, bCreate=true) at sw/source/core/access/accmap.cxx:1936
    5  in SwAccessibleContext::InvalidateChildPosOrSize(sw::access::SwAccessibleChild const&, SwRect const&) (this=0x405a350, rChildFrameOrObj=..., rOldFrame=SwRect = {...}) at sw/source/core/access/acccontext.cxx:1196
    6  in SwAccessibleMap::FireEvent(SwAccessibleEvent_Impl const&) (this=0x8198bb0, rEvent=...) at sw/source/core/access/accmap.cxx:898
    7  in SwAccessibleMap::FireEvents() (this=0x8198bb0) at sw/source/core/access/accmap.cxx:3018
    8  in SwViewShellImp::FireAccessibleEvents() (this=0x7744dc0) at sw/source/core/view/viewimp.cxx:460
    9  in SwLayIdle::SwLayIdle(SwRootFrame*, SwViewShellImp*) (this=0x7ffc63395e30, pRt=0x7745120, pI=0x7744dc0) at sw/source/core/layout/layact.cxx:2267
    
    Presumably all of mpEvents, mpEventMap and mpShapes must live until
    the outermost FireEvents() completes.
    
    Change-Id: I4e5a053035bf7fc12d9407913437d721889950ae
    (cherry picked from commit ddf8d9a150e3e1725de65577c48d47918b4b11a8)
    Reviewed-on: https://gerrit.libreoffice.org/39567
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Noel Grandin <noel.grandin at collabora.co.uk>
    Reviewed-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit 665491f769c2012f83fdce032cf0265238740bad)

diff --git a/sw/source/core/access/accmap.cxx b/sw/source/core/access/accmap.cxx
index 0faee74144b7..84147a1826fd 100644
--- a/sw/source/core/access/accmap.cxx
+++ b/sw/source/core/access/accmap.cxx
@@ -3058,6 +3058,11 @@ void SwAccessibleMap::FireEvents()
         osl::MutexGuard aGuard( maEventMutex );
         if( mpEvents )
         {
+            if (mpEvents->IsFiring())
+            {
+                return; // prevent recursive FireEvents()
+            }
+
             mpEvents->SetFiring();
             mpEvents->MoveMissingXAccToEnd();
             for( auto const& aEvent : *mpEvents )
commit c3a2e92407b63e7c408e2f9e481207534716c2ed
Author: Michael Stahl <mstahl at redhat.com>
Date:   Mon Jul 10 21:33:18 2017 +0200

    svx: assert on undisposed AbstractSvxHpLinkDlg
    
    3  in () at /lib64/libc.so.6
    4  in VclPtr<AbstractSvxHpLinkDlg>::~VclPtr() (this=0x88d47e8, __in_chrg=<optimized out>) at include/vcl/vclptr.hxx:115
    5  in SvxHlinkDlgWrapper::~SvxHlinkDlgWrapper() (this=0x88d47a0, __in_chrg=<optimized out>) at include/svx/hyperdlg.hxx:34
    6  in SvxHlinkDlgWrapper::~SvxHlinkDlgWrapper() (this=0x88d47a0, __in_chrg=<optimized out>) at include/svx/hyperdlg.hxx:34
    7  in SfxChildWindow::Destroy() (this=0x88d47a0) at sfx2/source/appl/childwin.cxx:182
    8  in SfxWorkWindow::RemoveChildWin_Impl(SfxChildWin_Impl*) (this=0x6c83940, pCW=0x683bc20) at sfx2/source/appl/workwin.cxx:1425
    9  in SfxWorkWindow::ToggleChildWindow_Impl(unsigned short, bool) (this=0x6c83940, nId=5678, bSetFocus=true) at sfx2/source/appl/workwin.cxx:1832
    10 in SfxViewFrame::ToggleChildWindow(unsigned short) (this=0x6afdae0, nId=5678) at sfx2/source/view/viewfrm.cxx:2964
    
    Change-Id: I84a1ba817dc8449dc1942b6ebd443ec955e8c622
    (cherry picked from commit 07341af48ed8ec2368aee87d120942f3e6bb6d49)
    Reviewed-on: https://gerrit.libreoffice.org/39805
    Reviewed-by: Noel Grandin <noel.grandin at collabora.co.uk>
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit c9b3f21706e5cfc2f49c52a6d04d7b342ea543e0)

diff --git a/include/svx/hyperdlg.hxx b/include/svx/hyperdlg.hxx
index c0a41a602345..2671a34b4857 100644
--- a/include/svx/hyperdlg.hxx
+++ b/include/svx/hyperdlg.hxx
@@ -39,6 +39,7 @@ private:
 public:
     SvxHlinkDlgWrapper( vcl::Window*pParent, sal_uInt16 nId,
                         SfxBindings* pBindings, SfxChildWinInfo* pInfo );
+    virtual ~SvxHlinkDlgWrapper() override;
 
     SFX_DECL_CHILDWINDOW_WITHID(SvxHlinkDlgWrapper);
     virtual bool    QueryClose() override;
diff --git a/svx/source/dialog/hyperdlg.cxx b/svx/source/dialog/hyperdlg.cxx
index a276c38e2f7d..2bc82c4a2503 100644
--- a/svx/source/dialog/hyperdlg.cxx
+++ b/svx/source/dialog/hyperdlg.cxx
@@ -77,4 +77,9 @@ bool SvxHlinkDlgWrapper::QueryClose()
     return !mpDlg || mpDlg->QueryClose();
 }
 
+SvxHlinkDlgWrapper::~SvxHlinkDlgWrapper()
+{
+    mpDlg.disposeAndClear();
+}
+
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
commit eb9e447bb0fe49d931ceed85dc0e3f8222b945cb
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jun 22 11:47:29 2017 +0100

    Resolves: tdf#108452 gtk3 xbm cursors invisible on black bg
    
    Change-Id: I5c9b27862da6ac76ae38542f85a51f9aefdd013d
    Reviewed-on: https://gerrit.libreoffice.org/39113
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 57272e5476d15d355018883c1cc9762d785d967c)

diff --git a/vcl/unx/gtk3/gtk3gtkdata.cxx b/vcl/unx/gtk3/gtk3gtkdata.cxx
index f911d384253e..b2c298bd81d5 100644
--- a/vcl/unx/gtk3/gtk3gtkdata.cxx
+++ b/vcl/unx/gtk3/gtk3gtkdata.cxx
@@ -170,13 +170,22 @@ GdkCursor* GtkSalDisplay::getFromXBM( const unsigned char *pBitmap,
                                       int nWidth, int nHeight,
                                       int nXHot, int nYHot )
 {
-    int cairo_stride = cairo_format_stride_for_width(CAIRO_FORMAT_A1, nWidth);
+    cairo_surface_t *source = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, nWidth, nHeight);
+    cairo_t *cr = cairo_create(source);
+    cairo_set_source_rgba(cr, 1, 1, 1, 1);
+    cairo_paint(cr);
+
+    const int cairo_stride = cairo_format_stride_for_width(CAIRO_FORMAT_A1, nWidth);
 
     unsigned char *pPaddedXBM = ensurePaddedForCairo(pBitmap, nWidth, nHeight, cairo_stride);
-    cairo_surface_t *source = cairo_image_surface_create_for_data(
+    cairo_surface_t *xbm = cairo_image_surface_create_for_data(
         pPaddedXBM,
         CAIRO_FORMAT_A1, nWidth, nHeight,
         cairo_stride);
+    cairo_set_source_rgba(cr, 0, 0, 0, 1);
+    cairo_mask_surface(cr, xbm, 0, 0);
+    cairo_surface_destroy(xbm);
+    cairo_destroy(cr);
 
     unsigned char *pPaddedMaskXBM = ensurePaddedForCairo(pMask, nWidth, nHeight, cairo_stride);
     cairo_surface_t *mask = cairo_image_surface_create_for_data(
@@ -184,10 +193,12 @@ GdkCursor* GtkSalDisplay::getFromXBM( const unsigned char *pBitmap,
         CAIRO_FORMAT_A1, nWidth, nHeight,
         cairo_stride);
 
-    cairo_surface_t *s = cairo_surface_create_similar(source, CAIRO_CONTENT_ALPHA, nWidth, nHeight);
-    cairo_t *cr = cairo_create(s);
+    cairo_surface_t *s = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, nWidth, nHeight);
+    cr = cairo_create(s);
     cairo_set_source_surface(cr, source, 0, 0);
     cairo_mask_surface(cr, mask, 0, 0);
+    cairo_surface_destroy(mask);
+    cairo_surface_destroy(source);
     cairo_destroy(cr);
 
 #if GTK_CHECK_VERSION(3,10,0)
@@ -199,8 +210,6 @@ GdkCursor* GtkSalDisplay::getFromXBM( const unsigned char *pBitmap,
 #endif
 
     cairo_surface_destroy(s);
-    cairo_surface_destroy(mask);
-    cairo_surface_destroy(source);
 
     if (pPaddedMaskXBM != pMask)
         delete [] pPaddedMaskXBM;
commit d9fb589b0c152fa69832df373995d160b4ef1468
Author: nikki <nikkic at epoq.co.uk>
Date:   Wed Apr 12 16:52:49 2017 +0100

    Fix tdf#106029 - Add setting XML_doNotExpandShiftReturn when exporting to docx
    
    Change-Id: Ie8ffb0f2d5444c6ead13bdc894715c5a2e6d0baa
    Reviewed-on: https://gerrit.libreoffice.org/36485
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 9ad9c5183f348384b62ec88459a3a5922e423d83)
    Reviewed-on: https://gerrit.libreoffice.org/39749
    (cherry picked from commit a59cf3ecab2f327801c2b580d20df9e8b643cc6c)

diff --git a/sw/qa/extras/ooxmlexport/data/fdo106029.docx b/sw/qa/extras/ooxmlexport/data/fdo106029.docx
new file mode 100644
index 000000000000..b19d63d4c218
Binary files /dev/null and b/sw/qa/extras/ooxmlexport/data/fdo106029.docx differ
diff --git a/sw/qa/extras/ooxmlexport/ooxmlexport4.cxx b/sw/qa/extras/ooxmlexport/ooxmlexport4.cxx
index d777cd528ece..aac74c777bb5 100644
--- a/sw/qa/extras/ooxmlexport/ooxmlexport4.cxx
+++ b/sw/qa/extras/ooxmlexport/ooxmlexport4.cxx
@@ -337,6 +337,14 @@ DECLARE_OOXMLEXPORT_TEST(testFdo73541,"fdo73541.docx")
     assertXPath(pXmlDoc, "/w:settings/w:mirrorMargins");
 }
 
+DECLARE_OOXMLEXPORT_TEST(testFdo106029,"fdo106029.docx")
+{
+    xmlDocPtr pXmlDoc = parseExport("word/settings.xml");
+    if (!pXmlDoc)
+        return;
+    assertXPath(pXmlDoc, "/w:settings/w:compat/w:doNotExpandShiftReturn");
+}
+
 DECLARE_OOXMLEXPORT_TEST(testFDO74106, "FDO74106.docx")
 {
     xmlDocPtr pXmlDoc = parseExport("word/numbering.xml");
diff --git a/sw/source/filter/ww8/docxexport.cxx b/sw/source/filter/ww8/docxexport.cxx
index 48b6e300ff92..0e3cfd280f22 100644
--- a/sw/source/filter/ww8/docxexport.cxx
+++ b/sw/source/filter/ww8/docxexport.cxx
@@ -875,7 +875,13 @@ void DocxExport::WriteSettings()
     {
         pFS->singleElementNS( XML_w, XML_documentProtection, FSNS(XML_w, XML_edit), "forms", FSNS(XML_w, XML_enforcement), "1",  FSEND );
     }
-
+    // Do not justify lines with manual break
+    if( m_pDoc->getIDocumentSettingAccess().get( DocumentSettingId::DO_NOT_JUSTIFY_LINES_WITH_MANUAL_BREAK ))
+    {
+        pFS->startElementNS( XML_w, XML_compat, FSEND );
+        pFS->singleElementNS( XML_w, XML_doNotExpandShiftReturn, FSEND );
+        pFS->endElementNS( XML_w, XML_compat );
+    }
     // Automatic hyphenation: it's a global setting in Word, it's a paragraph setting in Writer.
     // Use the setting from the default style.
     SwTextFormatColl* pColl = m_pDoc->getIDocumentStylePoolAccess().GetTextCollFromPool(RES_POOLCOLL_STANDARD, /*bRegardLanguage=*/false);
@@ -959,7 +965,6 @@ void DocxExport::WriteSettings()
                         FSNS( XML_w, XML_val ),  OUStringToOString(aValue, RTL_TEXTENCODING_UTF8).getStr(),
                         FSEND);
                 }
-
                 pFS->endElementNS( XML_w, XML_compat );
             }
         }
@@ -973,7 +978,6 @@ void DocxExport::WriteSettings()
                               FSNS( XML_w, XML_edit ), "forms",
                               FSEND );
     }
-
     pFS->endElementNS( XML_w, XML_settings );
 }
 
diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index 1e646350cfcd..25751c12be4e 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -86,6 +86,10 @@
 #include <comphelper/propertyvalue.hxx>
 #include <unotools/mediadescriptor.hxx>
 
+
+
+
+
 using namespace ::com::sun::star;
 using namespace oox;
 namespace writerfilter {
@@ -5126,6 +5130,9 @@ void DomainMapper_Impl::ApplySettingsTable()
             }
 
             uno::Reference< beans::XPropertySet > xSettings(m_xTextFactory->createInstance("com.sun.star.document.Settings"), uno::UNO_QUERY);
+
+            if (m_pSettingsTable->GetDoNotExpandShiftReturn())
+                xSettings->setPropertyValue( "DoNotJustifyLinesWithManualBreak", uno::makeAny(true) );
             if (m_pSettingsTable->GetUsePrinterMetrics())
                 xSettings->setPropertyValue("PrinterIndependentLayout", uno::makeAny(document::PrinterIndependentLayout::DISABLED));
             if( m_pSettingsTable->GetEmbedTrueTypeFonts())
diff --git a/writerfilter/source/dmapper/SettingsTable.cxx b/writerfilter/source/dmapper/SettingsTable.cxx
index 9a52c416f029..038723e6c1b4 100644
--- a/writerfilter/source/dmapper/SettingsTable.cxx
+++ b/writerfilter/source/dmapper/SettingsTable.cxx
@@ -65,6 +65,7 @@ struct SettingsTable_Impl
     bool                m_bWidowControl;
     bool                m_bSplitPgBreakAndParaMark;
     bool                m_bMirrorMargin;
+    bool                m_bDoNotExpandShiftReturn;
     bool                m_bProtectForm;
     bool                m_bDisplayBackgroundShape;
 
@@ -92,6 +93,7 @@ struct SettingsTable_Impl
     , m_bWidowControl(false)
     , m_bSplitPgBreakAndParaMark(false)
     , m_bMirrorMargin(false)
+    , m_bDoNotExpandShiftReturn(false)
     , m_bProtectForm(false)
     , m_bDisplayBackgroundShape(false)
     , m_pThemeFontLangProps(3)
@@ -279,6 +281,9 @@ void SettingsTable::lcl_sprm(Sprm& rSprm)
     case NS_ooxml::LN_CT_Settings_widowControl:
         m_pImpl->m_bWidowControl = nIntValue;
         break;
+    case NS_ooxml::LN_CT_Compat_doNotExpandShiftReturn:
+        m_pImpl->m_bDoNotExpandShiftReturn = true;
+        break;
     case NS_ooxml::LN_CT_Settings_displayBackgroundShape:
         m_pImpl->m_bDisplayBackgroundShape = nIntValue;
         break;
@@ -362,6 +367,11 @@ bool SettingsTable::GetDisplayBackgroundShape() const
     return m_pImpl->m_bDisplayBackgroundShape;
 }
 
+bool SettingsTable::GetDoNotExpandShiftReturn() const
+{
+    return m_pImpl->m_bDoNotExpandShiftReturn;
+}
+
 bool SettingsTable::GetProtectForm() const
 {
     return m_pImpl->m_bProtectForm;
diff --git a/writerfilter/source/dmapper/SettingsTable.hxx b/writerfilter/source/dmapper/SettingsTable.hxx
index 75c0d76e490e..28db5c26fb73 100644
--- a/writerfilter/source/dmapper/SettingsTable.hxx
+++ b/writerfilter/source/dmapper/SettingsTable.hxx
@@ -71,6 +71,7 @@ class SettingsTable : public LoggedProperties, public LoggedTable
     bool GetSplitPgBreakAndParaMark() const;
     bool GetMirrorMarginSettings() const;
     bool GetDisplayBackgroundShape() const;
+    bool GetDoNotExpandShiftReturn() const;
     bool GetNoColumnBalance() const;
     bool GetProtectForm() const;
 
commit 236bfad12b2f7718713e751fe06cb87c735b0e8b
Author: Sean Stangl <sean.stangl at gmail.com>
Date:   Sat Jul 8 22:33:48 2017 -0700

    tdf#79304 - Handle CrossedOutItems in HTML export.
    
    Change-Id: I766fedb34737a1a7815693bf496fa08c08f492b1
    Reviewed-on: https://gerrit.libreoffice.org/39719
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit 2f2eba56d1f8ec5cdcadb4852e8856858477c008)
    Reviewed-on: https://gerrit.libreoffice.org/39722
    Tested-by: Jenkins <ci at libreoffice.org>
    (cherry picked from commit 884979ebe7d464e8b29d331a58ddf943bc9030df)

diff --git a/sc/source/filter/html/htmlexp.cxx b/sc/source/filter/html/htmlexp.cxx
index 4177226146fc..c376672332bf 100644
--- a/sc/source/filter/html/htmlexp.cxx
+++ b/sc/source/filter/html/htmlexp.cxx
@@ -28,6 +28,7 @@
 #include <editeng/boxitem.hxx>
 #include <editeng/brushitem.hxx>
 #include <editeng/colritem.hxx>
+#include <editeng/crossedoutitem.hxx>
 #include <editeng/fhgtitem.hxx>
 #include <editeng/fontitem.hxx>
 #include <editeng/postitem.hxx>
@@ -979,6 +980,9 @@ void ScHTMLExport::WriteCell( SCCOL nCol, SCROW nRow, SCTAB nTab )
     const SvxUnderlineItem& rUnderlineItem = static_cast<const SvxUnderlineItem&>(
         pAttr->GetItem( ATTR_FONT_UNDERLINE, pCondItemSet ) );
 
+    const SvxCrossedOutItem& rCrossedOutItem = static_cast<const SvxCrossedOutItem&>(
+        pAttr->GetItem( ATTR_FONT_CROSSEDOUT, pCondItemSet ) );
+
     const SvxColorItem& rColorItem = static_cast<const SvxColorItem&>( pAttr->GetItem(
             ATTR_FONT_COLOR, pCondItemSet ) );
 
@@ -997,10 +1001,11 @@ void ScHTMLExport::WriteCell( SCCOL nCol, SCROW nRow, SCTAB nTab )
     else
         aBgColor = rBrushItem.GetColor();
 
-    bool bBold          = ( WEIGHT_BOLD     <= rWeightItem.GetWeight() );
-    bool bItalic        = ( ITALIC_NONE     != rPostureItem.GetPosture() );
-    bool bUnderline     = ( LINESTYLE_NONE  != rUnderlineItem.GetLineStyle() );
-    bool bSetFontColor  = ( COL_AUTO        != rColorItem.GetValue().GetColor() );  // default is AUTO now
+    bool bBold          = ( WEIGHT_BOLD      <= rWeightItem.GetWeight() );
+    bool bItalic        = ( ITALIC_NONE      != rPostureItem.GetPosture() );
+    bool bUnderline     = ( LINESTYLE_NONE   != rUnderlineItem.GetLineStyle() );
+    bool bCrossedOut    = ( STRIKEOUT_SINGLE <= rCrossedOutItem.GetStrikeout() );
+    bool bSetFontColor  = ( COL_AUTO         != rColorItem.GetValue().GetColor() );  // default is AUTO now
     bool bSetFontName   = ( aHTMLStyle.aFontFamilyName  != rFontItem.GetFamilyName() );
     sal_uInt16 nSetFontSizeNumber = 0;
     sal_uInt32 nFontHeight = rFontHeightItem.GetHeight();
@@ -1102,6 +1107,7 @@ void ScHTMLExport::WriteCell( SCCOL nCol, SCROW nRow, SCTAB nTab )
     if ( bBold )        TAG_ON( OOO_STRING_SVTOOLS_HTML_bold );
     if ( bItalic )      TAG_ON( OOO_STRING_SVTOOLS_HTML_italic );
     if ( bUnderline )   TAG_ON( OOO_STRING_SVTOOLS_HTML_underline );
+    if ( bCrossedOut )  TAG_ON( OOO_STRING_SVTOOLS_HTML_strikethrough );
 
     if ( bSetFont )
     {
@@ -1199,6 +1205,7 @@ void ScHTMLExport::WriteCell( SCCOL nCol, SCROW nRow, SCTAB nTab )
         WriteGraphEntry( pGraphEntry );
 
     if ( bSetFont )     TAG_OFF( OOO_STRING_SVTOOLS_HTML_font );
+    if ( bCrossedOut )  TAG_OFF( OOO_STRING_SVTOOLS_HTML_strikethrough );
     if ( bUnderline )   TAG_OFF( OOO_STRING_SVTOOLS_HTML_underline );
     if ( bItalic )      TAG_OFF( OOO_STRING_SVTOOLS_HTML_italic );
     if ( bBold )        TAG_OFF( OOO_STRING_SVTOOLS_HTML_bold );
commit b6b565a6e9cea0a3b13678d29004a5b6771e1d89
Author: Xisco Fauli <anistenis at gmail.com>
Date:   Mon Jun 12 18:05:27 2017 +0200

    tdf#104640, tdf#108469: Insert image where the cursor is
    
    Partially revert 72a4987434368bfb0b15f5ebb70a52
    Besides, add bDelta to the condition so the statement is false
    if the image is resized
    
    Change-Id: Ib07d328e040c38c63a30f6230ed9f6b605d76d9f
    Reviewed-on: https://gerrit.libreoffice.org/38705
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Xisco Faulí <xiscofauli at libreoffice.org>
    (cherry picked from commit 3919d87210ea12ed3166c649ac52730026db01a4)
    Reviewed-on: https://gerrit.libreoffice.org/38772
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit f44f65019a60b5bd70b08eb11db8d1baf4f6e229)

diff --git a/sw/source/core/text/frmform.cxx b/sw/source/core/text/frmform.cxx
index 5dd45a76e4c8..7cd2940a80bd 100644
--- a/sw/source/core/text/frmform.cxx
+++ b/sw/source/core/text/frmform.cxx
@@ -1081,7 +1081,13 @@ void SwTextFrame::FormatAdjust( SwTextFormatter &rLine,
 
     const SwTwips nDocPrtTop = Frame().Top() + Prt().Top();
     const SwTwips nOldHeight = Prt().SSize().Height();
-    const SwTwips nChg = rLine.CalcBottomLine() - nDocPrtTop - nOldHeight;
+    SwTwips nChg = rLine.CalcBottomLine() - nDocPrtTop - nOldHeight;
+
+    //#i84870# - no shrink of text frame, if it only contains one as-character anchored object.
+    if ( nChg < 0 && !bDelta && bOnlyContainsAsCharAnchoredObj )
+    {
+        nChg = 0;
+    }
 
     // Vertical Formatting:
     // The (rotated) repaint rectangle's x coordinate referes to the frame.
commit b8c84562702f21d7a9f37981e12309dda5243c31
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jul 6 08:51:01 2017 +0100

    ofz: stay inside string
    
    Change-Id: Ia0d0ddfce4ee3d5f8763be6804fe52c514375bb3
    Reviewed-on: https://gerrit.libreoffice.org/39629
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 073a2b2aef5c0b579aea8ed203dd9c1c5790b650)
    Reviewed-on: https://gerrit.libreoffice.org/39645
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Jenkins <ci at libreoffice.org>
    (cherry picked from commit e2be5d28877a817ae302b3dca7af2f71597a912f)

diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index 497f5445d159..f3211bac3b6b 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -234,7 +234,7 @@ eF_ResT SwWW8ImplReader::Read_F_FormListBox( WW8FieldDesc* pF, OUString& rStr)
 {
     WW8FormulaListBox aFormula(*this);
 
-    if (rStr[pF->nLCode-1]==0x01)
+    if (pF->nLCode > 0 && rStr.getLength() >= pF->nLCode && rStr[pF->nLCode-1] == 0x01)
         ImportFormulaControl(aFormula,pF->nSCode+pF->nLCode-1, WW8_CT_DROPDOWN);
 
     const SvtFilterOptions& rOpt = SvtFilterOptions::Get();
commit 5e202bddea9042a0a546c33621a0ca28f7125fab
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jul 6 12:25:58 2017 +0100

    ofz#2452 use shared_ptr for cshape
    
    Change-Id: Icf576c08b3502ea3e24fa4b3685b55f794e844db
    Reviewed-on: https://gerrit.libreoffice.org/39652
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Jenkins <ci at libreoffice.org>
    (cherry picked from commit cc7fafdb7ae954861a9bc83bb8a5207e9c9eccdf)

diff --git a/hwpfilter/source/hinfo.h b/hwpfilter/source/hinfo.h
index 7f1eee0657c7..7adc9e94ac30 100644
--- a/hwpfilter/source/hinfo.h
+++ b/hwpfilter/source/hinfo.h
@@ -23,6 +23,7 @@
 #include "hwplib.h"
 #include "string.h"
 
+#include <memory>
 #include <vector>
 
 #define CHAIN_MAX_PATH  40
@@ -282,11 +283,10 @@ struct ParaShape
     unsigned char outline;
     unsigned char outline_continue;
     unsigned char reserved[2];
-    CharShape *cshape;
-     unsigned char pagebreak;
+    std::shared_ptr<CharShape> cshape;
+    unsigned char pagebreak;
 
     void  Read(HWPFile &);
-//  virtual ~ParaShape();
 };
 #endif // INCLUDED_HWPFILTER_SOURCE_HINFO_H
 
diff --git a/hwpfilter/source/hpara.cxx b/hwpfilter/source/hpara.cxx
index a9a6fa2c147f..28d579507d95 100644
--- a/hwpfilter/source/hpara.cxx
+++ b/hwpfilter/source/hpara.cxx
@@ -111,7 +111,7 @@ bool HWPPara::Read(HWPFile & hwpf, unsigned char flag)
     if (nch && !reuse_shape)
     {
         pshape->Read(hwpf);
-        pshape->cshape = cshape.get();
+        pshape->cshape = cshape;
         pshape->pagebreak = etcflag;
     }
 
diff --git a/hwpfilter/source/hwpreader.cxx b/hwpfilter/source/hwpreader.cxx
index 4fc026a34b04..54ec8f550842 100644
--- a/hwpfilter/source/hwpreader.cxx
+++ b/hwpfilter/source/hwpreader.cxx
@@ -1477,7 +1477,7 @@ void HwpReader::makePStyle(ParaShape * pshape)
     rstartEl("style:style", mxList.get());
     mxList->clear();
     parseParaShape(pshape);
-    parseCharShape(pshape->cshape);
+    parseCharShape(pshape->cshape.get());
     rstartEl("style:properties", mxList.get());
     mxList->clear();
 
commit 0560a658e65089348da43340c543612aa9cae404
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Feb 28 12:32:07 2017 +0000

    backport various ofz findings
    
    hwp: avoid low hanging invalid input
    
    Change-Id: I06133d6db14edb9d915c38e4c120a9d0905495dd
    (cherry picked from commit b9483aacadf443e57f7708f8db64aeeba4666f2a)
    
    ofz#711: direct leak
    
    Change-Id: I65ec47b4290d845f1803b20b93f149d35d9a60ea
    (cherry picked from commit 86463ec54dcdc562121bdb57b1ac4e85b135b2df)
    
    ofz: ReadBlock has to be HWPIDLen to be useful
    
    Change-Id: Iaa349921972bb19b40bf68c6a3b0c7128cff4b8d
    (cherry picked from commit 425572b9d510cee805dc4160d7e81887d8f27577)
    
    ofz: oom in reading hwp data
    
    Change-Id: I1e4dc5f474b229d4d68d3fc34bc23c88767e5e50
    (cherry picked from commit 76201c60a9162804b502726a0150ca925ee08719)
    
    Missing include
    
    Change-Id: I2fb82e3c5a9b26b1016cf99e943cf0cc30225495
    (cherry picked from commit 64cca8d6237ef90c3b222df36de257dbb859d99e)
    
    ofz#860 clear old data before reading new data
    
    Change-Id: I3bf5c2072a328052004c4c0551c2b125cb8ab19b
    Reviewed-on: https://gerrit.libreoffice.org/35165
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 65dcd1d8195069c8c8acb3a188b8e5616c51029c)
    
    treat ParaShape like CharShape
    
    (cherry picked from commit 00aeabb61d1d535684b05145bcc98a8d8a3e10ab)
    
    Change-Id: I7870fdeee6bd097c94d7ae58b67506c4ab2a6fb5
    Reviewed-on: https://gerrit.libreoffice.org/39651
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    Tested-by: Jenkins <ci at libreoffice.org>
    (cherry picked from commit 4f949e1c3f6a378eb9c04bc7107b8972815661ea)

diff --git a/hwpfilter/source/hinfo.h b/hwpfilter/source/hinfo.h
index d16da5d09013..7f1eee0657c7 100644
--- a/hwpfilter/source/hinfo.h
+++ b/hwpfilter/source/hinfo.h
@@ -23,6 +23,8 @@
 #include "hwplib.h"
 #include "string.h"
 
+#include <vector>
+
 #define CHAIN_MAX_PATH  40
 #define ANNOTATION_LEN  24
 
@@ -77,7 +79,7 @@ struct PaperBackInfo
     int range; /* 0-????, 1-????????, 3-??????, 4-?????? */
     char reserved3[27];
     int size;
-    char *data;        // image data
+    std::vector<char> data;        // image data
     bool isset;
     PaperBackInfo()
         : type(0)
@@ -87,7 +89,6 @@ struct PaperBackInfo
         , flag(0)
         , range(0)
         , size(0)
-        , data(nullptr)
         , isset(false)
     {
         memset(reserved1, 0, sizeof(reserved1));
diff --git a/hwpfilter/source/hpara.cxx b/hwpfilter/source/hpara.cxx
index cce909ead16e..a9a6fa2c147f 100644
--- a/hwpfilter/source/hpara.cxx
+++ b/hwpfilter/source/hpara.cxx
@@ -57,10 +57,10 @@ void LineInfo::Read(HWPFile & hwpf, HWPPara *pPara)
 
     if( pex >> 15 & 0x01 )
     {
-          if( pex & 0x01 )
-                hwpf.AddPage();
-        pPara->pshape.reserved[0] = sal::static_int_cast<unsigned char>(pex & 0x01);
-        pPara->pshape.reserved[1] = sal::static_int_cast<unsigned char>(pex & 0x02);
+        if (pex & 0x01)
+            hwpf.AddPage();
+        pPara->pshape->reserved[0] = sal::static_int_cast<unsigned char>(pex & 0x01);
+        pPara->pshape->reserved[1] = sal::static_int_cast<unsigned char>(pex & 0x02);
     }
 }
 
@@ -76,10 +76,11 @@ HWPPara::HWPPara()
     , ctrlflag(0)
     , pstyno(0)
     , cshape(new CharShape)
+    , pshape(new ParaShape)
     , linfo(nullptr)
 {
     memset(cshape.get(), 0, sizeof(CharShape));
-    memset(&pshape, 0, sizeof(pshape));
+    memset(pshape.get(), 0, sizeof(ParaShape));
 }
 
 HWPPara::~HWPPara()
@@ -109,9 +110,9 @@ bool HWPPara::Read(HWPFile & hwpf, unsigned char flag)
 /* Paragraph paragraphs shape  */
     if (nch && !reuse_shape)
     {
-        pshape.Read(hwpf);
-        pshape.cshape = cshape.get();
-        pshape.pagebreak = etcflag;
+        pshape->Read(hwpf);
+        pshape->cshape = cshape.get();
+        pshape->pagebreak = etcflag;
     }
 
     linfo = ::comphelper::newArray_null<LineInfo>(nline);
@@ -125,8 +126,8 @@ bool HWPPara::Read(HWPFile & hwpf, unsigned char flag)
      }
 
     if (nch && !reuse_shape){
-         if( pshape.coldef.ncols > 1 ){
-             hwpf.SetColumnDef( &pshape.coldef );
+         if( pshape->coldef.ncols > 1 ) {
+             hwpf.SetColumnDef(&(pshape->coldef));
          }
      }
 
@@ -173,7 +174,7 @@ bool HWPPara::Read(HWPFile & hwpf, unsigned char flag)
         if (hhstr[ii]->hh == CH_END_PARA)
             break;
           if( hhstr[ii]->hh < CH_END_PARA )
-                pshape.reserved[0] = 0;
+                pshape->reserved[0] = 0;
         ii += hhstr[ii]->WSize();
     }
     return nch && !hwpf.State();
diff --git a/hwpfilter/source/hpara.h b/hwpfilter/source/hpara.h
index b598c201b569..9810853e4245 100644
--- a/hwpfilter/source/hpara.h
+++ b/hwpfilter/source/hpara.h
@@ -104,7 +104,7 @@ class DLLEXPORT HWPPara
         unsigned long     ctrlflag;
         unsigned char     pstyno;
         std::shared_ptr<CharShape> cshape;                     /* When characters are all the same shape */
-        ParaShape     pshape;                     /* if reuse flag is 0, */
+        std::shared_ptr<ParaShape> pshape;                     /* if reuse flag is 0, */
 
         LineInfo      *linfo;
         std::vector<std::shared_ptr<CharShape>>   cshapep;
@@ -128,7 +128,7 @@ class DLLEXPORT HWPPara
 /**
  * Returns the style of paragraph.
  */
-        ParaShape& GetParaShape(void) { return pshape;}
+        ParaShape& GetParaShape(void) { return *pshape; }
 
 /**
  * Returns next paragraph.
diff --git a/hwpfilter/source/hwpfile.cxx b/hwpfilter/source/hwpfile.cxx
index 96395da5c6da..326c428d98f7 100644
--- a/hwpfilter/source/hwpfile.cxx
+++ b/hwpfilter/source/hwpfile.cxx
@@ -19,6 +19,7 @@
 
 #include "precompile.h"
 
+#include <algorithm>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -124,7 +125,7 @@ int HWPFile::Open(HStream * stream)
 
     char idstr[HWPIDLen];
 
-    if (ReadBlock(idstr, HWPIDLen) <= 0
+    if (ReadBlock(idstr, HWPIDLen) < HWPIDLen
         || HWP_V30 != (version = detect_hwp_version(idstr)))
     {
         return SetState(HWP_UNSUPPORTED_VERSION);
@@ -261,9 +262,9 @@ bool HWPFile::ReadParaList(std::list < HWPPara* > &aplist, unsigned char flag)
                      spNode->reuse_shape = 0;
                 }
         }
-          spNode->pshape.pagebreak = spNode->etcflag;
-          if( spNode->nch )
-                AddParaShape( &spNode->pshape );
+        spNode->pshape->pagebreak = spNode->etcflag;
+        if (spNode->nch)
+            AddParaShape(spNode->pshape);
 
         if (!aplist.empty())
             aplist.back()->SetNext(spNode.get());
@@ -347,8 +348,30 @@ void HWPFile::TagsRead()
                      if (!Read4b(_hwpInfo.back_info.size))
                         return;
 
-                     _hwpInfo.back_info.data = new char[(unsigned int)_hwpInfo.back_info.size];
-                     ReadBlock(_hwpInfo.back_info.data, _hwpInfo.back_info.size);
+                     if (_hwpInfo.back_info.size < 0)
+                     {
+                        _hwpInfo.back_info.size = 0;
+                        return;
+                     }
+
+                     _hwpInfo.back_info.data.clear();
+
+                     //read potentially compressed data in blocks as its more
+                     //likely large values are simply broken and we'll run out
+                     //of data before we need to realloc
+                     for (int i = 0; i < _hwpInfo.back_info.size; i+= SAL_MAX_UINT16)
+                     {
+                        int nOldSize = _hwpInfo.back_info.data.size();
+                        size_t nBlock = std::min<int>(SAL_MAX_UINT16, _hwpInfo.back_info.size - nOldSize);
+                        _hwpInfo.back_info.data.resize(nOldSize + nBlock);
+                        size_t nReadBlock = ReadBlock(_hwpInfo.back_info.data.data() + nOldSize, nBlock);
+                        if (nBlock != nReadBlock)
+                        {
+                            _hwpInfo.back_info.data.resize(nOldSize + nReadBlock);
+                            break;
+                        }
+                     }
+                     _hwpInfo.back_info.size = _hwpInfo.back_info.data.size();
 
                      if( _hwpInfo.back_info.size > 0 )
                           _hwpInfo.back_info.type = 2;
@@ -450,7 +473,7 @@ ParaShape *HWPFile::getParaShape(int index)
 {
     if (index < 0 || static_cast<unsigned int>(index) >= pslist.size())
         return nullptr;
-    return pslist[index];
+    return pslist[index].get();
 }
 
 CharShape *HWPFile::getCharShape(int index)
@@ -495,7 +518,7 @@ Table *HWPFile::getTable(int index)
     return tables[index];
 }
 
-void HWPFile::AddParaShape(ParaShape * pshape)
+void HWPFile::AddParaShape(std::shared_ptr<ParaShape>& pshape)
 {
     int nscount = 0;
     for(int j = 0 ; j < MAXTABS-1 ; j++)
@@ -516,7 +539,7 @@ void HWPFile::AddParaShape(ParaShape * pshape)
     if( nscount )
         pshape->tabs[MAXTABS-1].type = sal::static_int_cast<char>(nscount);
 
-    int value = compareParaShape(pshape);
+    int value = compareParaShape(pshape.get());
 
     if( value == 0 || nscount )
     {
diff --git a/hwpfilter/source/hwpfile.h b/hwpfilter/source/hwpfile.h
index 7f3d29f80225..d58faa569a7b 100644
--- a/hwpfilter/source/hwpfile.h
+++ b/hwpfilter/source/hwpfile.h
@@ -212,7 +212,7 @@ class DLLEXPORT HWPFile
         void AddPage(){ m_nCurrentPage++;}
         void AddColumnInfo();
         void SetColumnDef(ColumnDef *coldef);
-        void AddParaShape(ParaShape *);
+        void AddParaShape(std::shared_ptr<ParaShape>&);
         void AddCharShape(std::shared_ptr<CharShape>&);
         void AddFBoxStyle(FBoxStyle *);
         void AddDateFormat(DateCode *);
@@ -283,7 +283,7 @@ class DLLEXPORT HWPFile
         std::list<EmPicture*> emblist;
         std::list<HyperText*> hyperlist;
         int currenthyper;
-        std::vector<ParaShape*> pslist;             /* 스타오피스의 구조상 필요 */
+        std::vector<std::shared_ptr<ParaShape>> pslist;             /* 스타오피스의 구조상 필요 */
         std::vector<std::shared_ptr<CharShape>> cslist;
         std::vector<FBoxStyle*> fbslist;
         std::vector<DateCode*> datecodes;
diff --git a/hwpfilter/source/hwpreader.cxx b/hwpfilter/source/hwpreader.cxx
index 27c3b514417e..4fc026a34b04 100644
--- a/hwpfilter/source/hwpreader.cxx
+++ b/hwpfilter/source/hwpreader.cxx
@@ -1738,7 +1738,7 @@ void HwpReader::makePageStyle()
              if( hwpinfo.back_info.type == 2 ){
                  rstartEl("office:binary-data", mxList.get());
                  mxList->clear();
-                 std::shared_ptr<char> pStr(base64_encode_string(reinterpret_cast<unsigned char *>(hwpinfo.back_info.data), hwpinfo.back_info.size ), Free<char>());
+                 std::shared_ptr<char> pStr(base64_encode_string(reinterpret_cast<unsigned char *>(hwpinfo.back_info.data.data()), hwpinfo.back_info.size ), Free<char>());
                  rchars(ascii(pStr.get()));
                  rendEl("office:binary-data");
              }
commit 4517bf30bc5102ea30b343a3ae5cdb48cf658875
Author: Julien Nabet <serval2412 at yahoo.fr>
Date:   Sun Jul 2 14:23:19 2017 +0200

    tdf#108789 quick fix for 5.3 branch only
    
    Change-Id: Ib3a9475a6eec1551a77fb5b5994ec1073f275708
    Reviewed-on: https://gerrit.libreoffice.org/39449
    Reviewed-by: Lionel Elie Mamane <lionel at mamane.lu>
    Tested-by: Jenkins <ci at libreoffice.org>
    (cherry picked from commit 91bafeff8b8a195d9ecc242c0def413361161d79)

diff --git a/connectivity/source/drivers/dbase/DTable.cxx b/connectivity/source/drivers/dbase/DTable.cxx
index 9c3e777e74e2..06d709032757 100644
--- a/connectivity/source/drivers/dbase/DTable.cxx
+++ b/connectivity/source/drivers/dbase/DTable.cxx
@@ -282,8 +282,11 @@ void ODbaseTable::readHeader()
                 }
                 else
                 {
-                    // Default Encoding
-                    m_eEncoding = RTL_TEXTENCODING_IBM_850;
+                    if (getConnection()->isTextEncodingDefaulted())
+                    {
+                        // Default Encoding
+                        m_eEncoding = RTL_TEXTENCODING_IBM_850;
+                    }
                 }
                 break;
             case dBaseIVMemo:
diff --git a/sc/source/ui/docshell/docsh8.cxx b/sc/source/ui/docshell/docsh8.cxx
index 646656e56358..f30c95f6f654 100644
--- a/sc/source/ui/docshell/docsh8.cxx
+++ b/sc/source/ui/docshell/docsh8.cxx
@@ -299,10 +299,6 @@ sal_uLong ScDocShell::DBaseImport( const OUString& rFullFileName, rtl_TextEncodi
 
     sal_uLong nErr = eERR_OK;
 
-    // Try to get the Text Encoding from the driver
-    if( eCharSet == RTL_TEXTENCODING_IBM_850 )
-        eCharSet = RTL_TEXTENCODING_DONTKNOW;
-
     try
     {
         long i;


More information about the Libreoffice-commits mailing list