[Libreoffice-commits] core.git: Branch 'distro/collabora/cp-5.3' - 14 commits - filter/source hwpfilter/source include/vcl jvmfwk/inc jvmfwk/plugins lotuswordpro/source sc/source svl/source sw/source vcl/source vcl/unx

Laurent Balland-Poirier laurent.balland-poirier at laposte.net
Thu Mar 16 13:44:37 UTC 2017


 filter/source/graphicfilter/itiff/itiff.cxx         |   65 ++++++++++++--------
 hwpfilter/source/drawing.h                          |    4 -
 hwpfilter/source/hgzip.cxx                          |    8 +-
 hwpfilter/source/hgzip.h                            |    2 
 hwpfilter/source/hiodev.cxx                         |   48 +++++++-------
 hwpfilter/source/hiodev.h                           |   22 +++---
 include/vcl/menu.hxx                                |    1 
 jvmfwk/inc/vendorbase.hxx                           |    2 
 jvmfwk/inc/vendorplugin.hxx                         |    1 
 jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx |    6 +
 jvmfwk/plugins/sunmajor/pluginlib/vendorbase.cxx    |   26 +++++++-
 lotuswordpro/source/filter/lwpgrfobj.cxx            |    8 ++
 lotuswordpro/source/filter/lwpobjstrm.cxx           |    9 ++
 lotuswordpro/source/filter/lwpobjstrm.hxx           |    1 
 sc/source/core/data/grouptokenconverter.cxx         |    4 +
 sc/source/core/tool/interpr4.cxx                    |    6 +
 sc/source/filter/oox/condformatcontext.cxx          |    4 -
 sc/source/ui/view/cellsh1.cxx                       |    1 
 svl/source/numbers/zformat.cxx                      |   13 +++-
 svl/source/numbers/zforscan.cxx                     |   33 +++++-----
 sw/source/uibase/dbui/dbmgr.cxx                     |    7 +-
 vcl/source/window/menu.cxx                          |   11 ++-
 vcl/unx/gtk/gtksalmenu.cxx                          |   28 +++++++-
 vcl/unx/gtk3/gtk3gtkframe.cxx                       |    2 
 24 files changed, 213 insertions(+), 99 deletions(-)

New commits:
commit 2f8b1a85a9803b94b57b5671beb70d8252f5c532
Author: Laurent Balland-Poirier <laurent.balland-poirier at laposte.net>
Date:   Sun Mar 12 23:33:24 2017 +0100

    Following tdf#106190 Treat blank after fraction bar
    
    To consider that denominator is found (bDenom=true)
    there must be some digits found after fraction bar
    
    Dummy format # ?/ ? can now work again (even with
    blank as thousands delimiter).
    However such format can not be saved (except in XLS)
    
    Change-Id: I657e97e09a6ae4c08a29ad6d0b586c85a9968e3d
    Reviewed-on: https://gerrit.libreoffice.org/35111
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit 4e1448d43e08d3f0a6ff67e75346e9559ad2af09)
    Reviewed-on: https://gerrit.libreoffice.org/35196
    (cherry picked from commit f1a108f4dfd3d82dd39a9606f54a25a076ac516d)

diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx
index be19e338d2a1..ac622bf4cc45 100644
--- a/svl/source/numbers/zformat.cxx
+++ b/svl/source/numbers/zformat.cxx
@@ -2212,7 +2212,8 @@ OUString lcl_GetDenominatorString(const ImpSvNumberformatInfo &rInfo, sal_uInt16
     {
         if( rInfo.nTypeArray[i] == NF_SYMBOLTYPE_FRAC )
         {
-            for( i++; i < nAnz; i++ )
+            while ( ( ++i < nAnz ) && rInfo.nTypeArray[i] == NF_SYMBOLTYPE_STRING );
+            for( ; i < nAnz; i++ )
             {
                 if( rInfo.nTypeArray[i] == NF_SYMBOLTYPE_FRAC_FDIV || rInfo.nTypeArray[i] == NF_SYMBOLTYPE_DIGIT )
                     aDenominatorString.append( rInfo.sStrArray[i] );
diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx
index 1cceda79d3ad..363a6219137e 100644
--- a/svl/source/numbers/zforscan.cxx
+++ b/svl/source/numbers/zforscan.cxx
@@ -1670,7 +1670,7 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
                     }
                     else if ( sStrArray[i][0] == ' ' )
                         nTypeArray[i] = NF_SYMBOLTYPE_FRACBLANK;
-                    else if ( bFrac )
+                    else if ( bFrac && ( nCounter > 0 ) )
                         bDenomin = true; // following elements are no more part of denominator
                 }
                 else if (nTypeArray[i] == NF_KEY_THAI_T)
@@ -1714,7 +1714,7 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
                 }
                 else
                 {
-                    if ( bFrac )
+                    if ( bFrac && ( nCounter > 0 ) )
                         bDenomin = true;    // next content should be treated as outside denominator
                     nTypeArray[i] = NF_SYMBOLTYPE_STRING;
                 }
@@ -1834,7 +1834,7 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
                             else
                             {
                                 nTypeArray[i] = NF_SYMBOLTYPE_STRING;
-                                if ( bFrac )
+                                if ( bFrac && (nCounter > 0) )
                                     bDenomin = true; // end of denominator
                             }
                         }
@@ -2002,7 +2002,7 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
                                 nCntPre = nCounter;
                                 nCounter = 0;
                             }
-                            if ( bFrac )
+                            if ( bFrac && (nCounter > 0) )
                                 bDenomin = true; // next content is not part of denominator
                             nTypeArray[i] = NF_SYMBOLTYPE_STRING;
                             nPos = nPos + sStrArray[i].getLength();
@@ -2010,7 +2010,7 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
                         else
                         {
                             nTypeArray[i] = NF_SYMBOLTYPE_STRING;
-                            if ( bFrac )
+                            if ( bFrac && (nCounter > 0) )
                                 bDenomin = true; // next content is not part of denominator
                             nPos = nPos + rStr.getLength();
                             i++;
commit 2c80184a77d9043bc6f33b13a3df76de710a7eff
Author: Markus Mohrhard <markus.mohrhard at googlemail.com>
Date:   Mon Feb 13 19:27:57 2017 +0100

    don't forget to set the managed flag, tdf#105544
    
    Change-Id: I46d534a157b05ce22ba42e269ca8266e3403ecd2
    Reviewed-on: https://gerrit.libreoffice.org/34229
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit 0b9e33cceb635cd3c173bd1f461af98cfd6f6ed2)
    Reviewed-on: https://gerrit.libreoffice.org/35182
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Katarina Behrens <Katarina.Behrens at cib.de>
    (cherry picked from commit d9128bc895bfa9740cd85c766a10217e35aaa937)

diff --git a/sc/source/ui/view/cellsh1.cxx b/sc/source/ui/view/cellsh1.cxx
index 9c17a869951c..1b96a9ab80d9 100644
--- a/sc/source/ui/view/cellsh1.cxx
+++ b/sc/source/ui/view/cellsh1.cxx
@@ -1948,6 +1948,7 @@ void ScCellShell::ExecuteEdit( SfxRequest& rReq )
                     {
                         const ScCondFormatDlgItem* pDlgItem = static_cast<const ScCondFormatDlgItem*>(pItem);
                         nIndex = pDlgItem->GetIndex();
+                        bManaged = true;
                         break;
                     }
                 }
commit 33a066b518eadc06e481c35677f0224b47caefa2
Author: Samuel Mehrbrodt <Samuel.Mehrbrodt at cib.de>
Date:   Fri Mar 3 15:55:40 2017 +0100

    tdf#106271 Cannot disable Menubar under Unity
    
    Empty the global menu when the user wants to hide the menubar.
    When showing it again, the global menu is refilled.
    
    (cherry picked from commit f2fa5951bf3d02439a3e96d1f9d89962f0901edc)
    
    The following commits have been squashed into this commit:
    
    1.
    Destroy menu widget when enabling Unity integration
    
    Like GtkSalMenu::ShowMenuBar did before
    f2fa5951bf3d02439a3e96d1f9d89962f0901edc
    ("tdf#106271 Cannot disable Menubar under Unity")
    
    Should fix https://lists.freedesktop.org/archives/libreoffice/2017-
    March/077225.html
    
    (cherry-picked from commit 27f89f08cf4086802ce67f12389414bef6ab64ca)
    
    2.
    Don't use SetDisplayable when enabling Unity mode
    
    because now it tracks the global menu too, but all we need
    here is to hide the in-window menubar widget.
    
    (cherry-picked from commit 3daa6c66eb9a4c334d6f72a8fd4bb09d7360a913)
    
    Change-Id: I3c5e17100622cd8d22c4348cf90a76233dd0fd4c
    Reviewed-on: https://gerrit.libreoffice.org/34919
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Thorsten Behrens <Thorsten.Behrens at CIB.de>
    (cherry picked from commit 449733a5c3b59c7b56db1db3dbc7fd0dcefd1a55)

diff --git a/include/vcl/menu.hxx b/include/vcl/menu.hxx
index 8b996df37bd6..e09289e451d3 100644
--- a/include/vcl/menu.hxx
+++ b/include/vcl/menu.hxx
@@ -478,6 +478,7 @@ public:
     // if the menubar is unattached an empty rectangle is returned
     Rectangle GetMenuBarButtonRectPixel( sal_uInt16 nId );
     void RemoveMenuBarButton( sal_uInt16 nId );
+    void LayoutChanged();
 };
 
 inline MenuBar& MenuBar::operator=( const MenuBar& rMenu )
diff --git a/vcl/source/window/menu.cxx b/vcl/source/window/menu.cxx
index ba1e6fd92e3e..854affea713f 100644
--- a/vcl/source/window/menu.cxx
+++ b/vcl/source/window/menu.cxx
@@ -2464,6 +2464,13 @@ void MenuBar::ShowButtons( bool bClose, bool bFloat, bool bHide )
     }
 }
 
+void MenuBar::LayoutChanged()
+{
+    MenuBarWindow* pMenuWin = getMenuBarWindow();
+    if (pMenuWin)
+        pMenuWin->LayoutChanged();
+}
+
 void MenuBar::SetDisplayable( bool bDisplayable )
 {
     if( bDisplayable != mbDisplayable )
@@ -2472,9 +2479,7 @@ void MenuBar::SetDisplayable( bool bDisplayable )
             ImplGetSalMenu()->ShowMenuBar( bDisplayable );
 
         mbDisplayable = bDisplayable;
-        MenuBarWindow* pMenuWin = getMenuBarWindow();
-        if (pMenuWin)
-            pMenuWin->LayoutChanged();
+        LayoutChanged();
     }
 }
 
diff --git a/vcl/unx/gtk/gtksalmenu.cxx b/vcl/unx/gtk/gtksalmenu.cxx
index 2cf072a01d5d..807470ab1066 100644
--- a/vcl/unx/gtk/gtksalmenu.cxx
+++ b/vcl/unx/gtk/gtksalmenu.cxx
@@ -766,6 +766,9 @@ static gboolean MenuBarSignalKey(GtkWidget*, GdkEventKey* pEvent, gpointer menu)
 void GtkSalMenu::CreateMenuBarWidget()
 {
 #if GTK_CHECK_VERSION(3,0,0)
+    if (mpMenuBarContainerWidget)
+        return;
+
     GtkGrid* pGrid = mpFrame->getTopLevelGridWidget();
     mpMenuBarContainerWidget = gtk_grid_new();
 
@@ -1153,16 +1156,33 @@ void GtkSalMenu::Deactivate(const gchar* pCommand)
 
 void GtkSalMenu::EnableUnity(bool bEnable)
 {
-    if (bUnityMode != bEnable)
+    bUnityMode = bEnable;
+
+    MenuBar* pMenuBar(static_cast<MenuBar*>(mpVCLMenu.get()));
+
+    if (bEnable)
+        DestroyMenuBarWidget();
+    else
     {
-        bUnityMode = bEnable;
-        static_cast<MenuBar*>(mpVCLMenu.get())->SetDisplayable(!bEnable);
+        Update();
+        if (pMenuBar->IsDisplayable())
+            CreateMenuBarWidget();
     }
+
+    pMenuBar->LayoutChanged();
 }
 
 void GtkSalMenu::ShowMenuBar( bool bVisible )
 {
-    if (bVisible && !bUnityMode && !mpMenuBarContainerWidget)
+    // Unity tdf#106271: Can't hide global menu, so empty it instead when user wants to hide menubar,
+    if (bUnityMode)
+    {
+        if (bVisible)
+            Update();
+        else if (mpMenuModel && g_menu_model_get_n_items(G_MENU_MODEL(mpMenuModel)) > 0)
+            g_lo_menu_remove(G_LO_MENU(mpMenuModel), 0);
+    }
+    else if (bVisible)
         CreateMenuBarWidget();
     else
         DestroyMenuBarWidget();
commit 94df63a10521ebc04c577de8f9b1ba6f73034550
Author: Samuel Mehrbrodt <Samuel.Mehrbrodt at cib.de>
Date:   Thu Mar 9 20:43:09 2017 +0100

    Related tdf#54443 List only matching JREs
    
    I.e. show only 64bit JRE for 64bit LO and 32bit JRE for 32bit LO
    
    Change-Id: Id5e890637c7e1014bcb4e6fdd9ed9a33765112d5
    Reviewed-on: https://gerrit.libreoffice.org/35026
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Samuel Mehrbrodt <Samuel.Mehrbrodt at cib.de>
    (cherry picked from commit 9143dd4ebe37b608e43d04434cf831624bf55b65)
    Reviewed-on: https://gerrit.libreoffice.org/35162
    Reviewed-by: Thorsten Behrens <Thorsten.Behrens at CIB.de>
    (cherry picked from commit c8f0a37ff804e6329b21a4b7bfabb0667263c6e5)

diff --git a/jvmfwk/inc/vendorbase.hxx b/jvmfwk/inc/vendorbase.hxx
index 2a24c9590858..c9ebcb256913 100644
--- a/jvmfwk/inc/vendorbase.hxx
+++ b/jvmfwk/inc/vendorbase.hxx
@@ -133,6 +133,7 @@ public:
     const OUString & getRuntimeLibrary() const;
     const OUString & getLibraryPath() const;
     bool supportsAccessibility() const;
+    bool isValidArch() const;
      /* determines if prior to running java something has to be done,
         like setting the LD_LIBRARY_PATH. This implementation checks
         if an LD_LIBRARY_PATH (getLD_LIBRARY_PATH) needs to be set and
@@ -178,6 +179,7 @@ protected:
     OUString m_sHome;
     OUString m_sRuntimeLibrary;
     OUString m_sLD_LIBRARY_PATH;
+    OUString m_sArch;
     bool m_bAccessibility;
 
 
diff --git a/jvmfwk/inc/vendorplugin.hxx b/jvmfwk/inc/vendorplugin.hxx
index 8df13b153b83..426157b6ed54 100644
--- a/jvmfwk/inc/vendorplugin.hxx
+++ b/jvmfwk/inc/vendorplugin.hxx
@@ -55,6 +55,7 @@ enum class javaPluginError
     FailedVersion,
     NoJre,
     WrongVendor,
+    WrongArch,
     VmCreationFailed
 };
 
diff --git a/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx b/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
index 63791bceac16..d69b439f2f0a 100644
--- a/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
+++ b/jvmfwk/plugins/sunmajor/pluginlib/sunjavaplugin.cxx
@@ -227,6 +227,10 @@ javaPluginError checkJavaVersionRequirements(
     rtl_uString * * arExcludeList,
     sal_Int32  nLenList)
 {
+    if (!aVendorInfo->isValidArch())
+    {
+        return javaPluginError::WrongArch;
+    }
     if (!sMinVersion.isEmpty())
     {
         try
@@ -334,7 +338,7 @@ javaPluginError jfw_plugin_getAllJavaInfos(
         javaPluginError err = checkJavaVersionRequirements(
             cur, sMinVersion, sMaxVersion, arExcludeList, nLenList);
 
-        if (err == javaPluginError::FailedVersion)
+        if (err == javaPluginError::FailedVersion || err == javaPluginError::WrongArch)
             continue;
         else if (err == javaPluginError::WrongVersionFormat)
             return err;
diff --git a/jvmfwk/plugins/sunmajor/pluginlib/vendorbase.cxx b/jvmfwk/plugins/sunmajor/pluginlib/vendorbase.cxx
index 9b580ccaa8fb..ef9da176ebc4 100644
--- a/jvmfwk/plugins/sunmajor/pluginlib/vendorbase.cxx
+++ b/jvmfwk/plugins/sunmajor/pluginlib/vendorbase.cxx
@@ -62,12 +62,14 @@ bool VendorBase::initialize(vector<pair<OUString, OUString> > props)
     OUString sVendorProperty("java.vendor");
     OUString sVersionProperty("java.version");
     OUString sHomeProperty("java.home");
+    OUString sArchProperty("os.arch");
     OUString sAccessProperty("javax.accessibility.assistive_technologies");
 
     bool bVersion = false;
     bool bVendor = false;
     bool bHome = false;
     bool bAccess = false;
+    bool bArch = false;
 
     typedef vector<pair<OUString, OUString> >::const_iterator it_prop;
     for (it_prop i = props.begin(); i != props.end(); ++i)
@@ -103,6 +105,11 @@ bool VendorBase::initialize(vector<pair<OUString, OUString> > props)
            bHome = true;
 #endif
         }
+        else if (!bArch && sArchProperty.equals(i->first))
+        {
+            m_sArch = i->second;
+            bArch = true;
+        }
         else if (!bAccess && sAccessProperty.equals(i->first))
         {
             if (!i->second.isEmpty())
@@ -115,7 +122,7 @@ bool VendorBase::initialize(vector<pair<OUString, OUString> > props)
         //must search through all properties.
 
     }
-    if (!bVersion || !bVendor || !bHome)
+    if (!bVersion || !bVendor || !bHome || !bArch)
         return false;
 
     // init m_sRuntimeLibrary
@@ -201,6 +208,23 @@ const OUString & VendorBase::getRuntimeLibrary() const
 {
     return m_sRuntimeLibrary;
 }
+
+bool VendorBase::isValidArch() const
+{
+    // Warning: These values come from the "os.arch" property.
+    // It is not defined what the exact values are.
+    // Oracle JRE 8 has "x86" and "amd64", the others were found at http://lopica.sourceforge.net/os.html .
+    // There might still be missing some options; we need to extend the check once we find out.
+#if defined _WIN32
+    return m_sArch == "x86" || m_sArch == "i386" || m_sArch == "i686";
+#elif defined _WIN64
+    return m_sArch == "amd64" || m_sArch == "x86_64";
+#else
+    (void)this;
+    return true;
+#endif
+}
+
 bool VendorBase::supportsAccessibility() const
 {
     return m_bAccessibility;
commit 93799357162ed23ff2d0c44412c442911228358c
Author: Markus Mohrhard <markus.mohrhard at googlemail.com>
Date:   Sat Feb 18 02:30:11 2017 +0100

    fix conditional format import from XLSB, tdf#105486
    
    Change-Id: I2b781f45221e434c8ec0ee079afb54c505faf2b5
    Reviewed-on: https://gerrit.libreoffice.org/34396
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    Tested-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit aaea9beabcdfa16ffd36116591c5ebea25906b94)
    Reviewed-on: https://gerrit.libreoffice.org/35154
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit e237c0109c94da27715c115cecee69d382d6c183)

diff --git a/sc/source/filter/oox/condformatcontext.cxx b/sc/source/filter/oox/condformatcontext.cxx
index 79c92d2a4d07..4a876648a80d 100644
--- a/sc/source/filter/oox/condformatcontext.cxx
+++ b/sc/source/filter/oox/condformatcontext.cxx
@@ -253,7 +253,9 @@ void CondFormatContext::onEndRecord()
     {
         case BIFF12_ID_CONDFORMATTING:
             if( mxCondFmt.get() )
-                mxCondFmt->finalizeImport();
+            {
+                mxCondFmt->setReadyForFinalize();
+            }
             break;
     }
 }
commit 6db24ee070bbf0b4290ad31d313e0a32ee7e35b5
Author: Markus Mohrhard <markus.mohrhard at googlemail.com>
Date:   Mon Mar 13 12:45:07 2017 +0100

    tdf#106456, don't try to use invalid ranges in external ref code
    
    Change-Id: I38e622df87dd4b5e37dd248c5181978e13890fda
    Reviewed-on: https://gerrit.libreoffice.org/35132
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit 951fcc6556346e19a028443c70dea27d0cbc9c36)
    Reviewed-on: https://gerrit.libreoffice.org/35180
    Reviewed-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit 20bcaeb0f8509e4b12d72d4612b5f3c9bfde3489)

diff --git a/sc/source/core/tool/interpr4.cxx b/sc/source/core/tool/interpr4.cxx
index f26649187be5..7a0b08b06c96 100644
--- a/sc/source/core/tool/interpr4.cxx
+++ b/sc/source/core/tool/interpr4.cxx
@@ -1317,6 +1317,12 @@ void ScInterpreter::GetExternalDoubleRef(
 
     ScComplexRefData aData(rData);
     ScRange aRange = aData.toAbs(aPos);
+    if (!ValidColRow(aRange.aStart.Col(), aRange.aStart.Row()) || !ValidColRow(aRange.aEnd.Col(), aRange.aEnd.Row()))
+    {
+        SetError(FormulaError::NoRef);
+        return;
+    }
+
     ScExternalRefCache::TokenArrayRef pArray = pRefMgr->getDoubleRefTokens(
         nFileId, rTabName, aRange, &aPos);
 
commit d371f3f0428925a06cf7954dfc29bea9e916ff13
Author: Eike Rathke <erack at redhat.com>
Date:   Fri Mar 10 13:38:28 2017 +0100

    string access out of bounds
    
     This is a combination of 3 commits.
    
    string access out of bounds
    
    Change-Id: I4f6e6e8e77cdabe593bca5719b6ef38aeecc5da7
    (cherry picked from commit 77a8cf7eaf638276030d1c5be8705f5603f071a9)
    
    prevent string access out of bounds
    
    Though only the closing 0-character and the following check excludes that,
    dbgutil asserts.
    
    Change-Id: Ife1299042a60f6f058c4cf58b406d1cc022786a7
    (cherry picked from commit c407fff205a270e02fe07885805b7250e71c28f8)
    
    guard against a (theoretical?) endless loop of blanks only
    
    Change-Id: I68d6cca1b359aa8fba42663bddb1107c31102415
    (cherry picked from commit fe73eff36718b6d99d0cf92d750c457872cc4dcc)
    Reviewed-on: https://gerrit.libreoffice.org/35043
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 0f7a1bce18b08045fd98d5de99bb9ed69a7d474d)

diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx
index 09e024eaccac..be19e338d2a1 100644
--- a/svl/source/numbers/zformat.cxx
+++ b/svl/source/numbers/zformat.cxx
@@ -2817,9 +2817,15 @@ bool SvNumberformat::ImpGetFractionOutput(double fNumber,
     bRes |= ImpNumberFill(sDiv, fNumber, k, j, nIx, NF_SYMBOLTYPE_FRAC);
     if ( !bHideFraction &&  sDenominatorFormat.getLength() > 0 )
     {
-        while ( sDiv[0] == ' ' ) // left align denominator
+        // Guard against a (theoretical?) endless loop of blanks only.
+        sal_Int32 n = sDiv.getLength();
+        sal_Int32 nDenominatorLen = sDenominatorFormat.getLength();
+        while ( n-- > 0 && sDiv[0] == ' ' ) // left align denominator
         {
-            sDiv.insert( sDenominatorFormat.getLength(), " " );
+            if (sDiv.getLength() <= nDenominatorLen)
+                sDiv.append(" ");
+            else
+                sDiv.insert( nDenominatorLen, " " );
             sDiv.remove( 0, 1 );
         }
     }
diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx
index 34137cb85f42..1cceda79d3ad 100644
--- a/svl/source/numbers/zforscan.cxx
+++ b/svl/source/numbers/zforscan.cxx
@@ -814,18 +814,21 @@ short ImpSvNumberformatScan::Next_Symbol( const OUString& rStr,
                 switch (cToken)
                 {
                 case '/': // AM/PM, A/P
-                    cNext = rStr[nPos];
-                    if ( cNext == 'P' || cNext == 'p' )
+                    if (nPos < rStr.getLength())
                     {
-                        sal_Int32 nLen = sSymbol.getLength();
-                        if ( 1 <= nLen &&
-                             (sSymbol[0] == 'A' || sSymbol[0] == 'a') &&
-                             (nLen == 1 ||
-                              (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm')
-                               && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm'))))
+                        cNext = rStr[nPos];
+                        if ( cNext == 'P' || cNext == 'p' )
                         {
-                            sSymbol += OUStringLiteral1(cToken);
-                            bDontStop = true;
+                            sal_Int32 nLen = sSymbol.getLength();
+                            if ( 1 <= nLen &&
+                                    (sSymbol[0] == 'A' || sSymbol[0] == 'a') &&
+                                    (nLen == 1 ||
+                                     (nLen == 2 && (sSymbol[1] == 'M' || sSymbol[1] == 'm')
+                                      && (rStr[nPos + 1] == 'M' || rStr[nPos + 1] == 'm'))))
+                            {
+                                sSymbol += OUStringLiteral1(cToken);
+                                bDontStop = true;
+                            }
                         }
                     }
                     break;
commit e5e54ce14ff5b4da05af49de6a1623bb37fab3e5
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Mar 13 12:44:10 2017 +0000

    Resolves: rhbz#1431540 crash in SwDBManager::releaseRevokeListener
    
    Change-Id: I8e61163de7e6192bdf613ab6b58906326499d6c2
    Reviewed-on: https://gerrit.libreoffice.org/35137
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit e1f36eddf4596901a51de42322ccbf8d1df9d139)
    Reviewed-on: https://gerrit.libreoffice.org/35138
    (cherry picked from commit 445b719b8bbff9181cea3601649bb21c27acd7b5)

diff --git a/sw/source/uibase/dbui/dbmgr.cxx b/sw/source/uibase/dbui/dbmgr.cxx
index 2d85ff75a1eb..9adf98c24340 100644
--- a/sw/source/uibase/dbui/dbmgr.cxx
+++ b/sw/source/uibase/dbui/dbmgr.cxx
@@ -3118,8 +3118,11 @@ SwDoc* SwDBManager::getDoc() const
 
 void SwDBManager::releaseRevokeListener()
 {
-    pImpl->m_xDataSourceRemovedListener->Dispose();
-    pImpl->m_xDataSourceRemovedListener.clear();
+    if (pImpl->m_xDataSourceRemovedListener.is())
+    {
+        pImpl->m_xDataSourceRemovedListener->Dispose();
+        pImpl->m_xDataSourceRemovedListener.clear();
+    }
 }
 
 SwConnectionDisposedListener_Impl::SwConnectionDisposedListener_Impl(SwDBManager& rManager)
commit b3173ad9e28f29a8b9e5a5aac1aa6bd04e46a66e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Mar 13 12:28:12 2017 +0000

    rhbz#1431476 dnd has started copying instead of moving slides
    
    Is suspect something has changed in gtk3, and I think we're
    not supposed to use gdk_drag_drop_succeeded at this point, but
    instead we'd get a dragFailed signal on the failure case
    
    Change-Id: I6b305db56a29255b468ca9182d1f7e57cb4c10f4
    (cherry picked from commit 4ea76db5e53235971b597a2810a6d12618d6aaea)
    Reviewed-on: https://gerrit.libreoffice.org/35135
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 3a4d2433fbf2ef6f41b82482ea99ed79fb2d6735)

diff --git a/vcl/unx/gtk3/gtk3gtkframe.cxx b/vcl/unx/gtk3/gtk3gtkframe.cxx
index 4b65a5527e12..2752fc75e172 100644
--- a/vcl/unx/gtk3/gtk3gtkframe.cxx
+++ b/vcl/unx/gtk3/gtk3gtkframe.cxx
@@ -4241,7 +4241,7 @@ void GtkDragSource::dragEnd(GdkDragContext* context)
     {
         datatransfer::dnd::DragSourceDropEvent aEv;
         aEv.DropAction = GdkToVcl(gdk_drag_context_get_selected_action(context));
-        aEv.DropSuccess = gdk_drag_drop_succeeded(context);
+        aEv.DropSuccess = true;
         auto xListener = m_xListener;
         m_xListener.clear();
         xListener->dragDropEnd(aEv);
commit ca53b3a2e55f6cbd21bd58c537ec5cd8c79d883b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Mar 12 17:37:05 2017 +0000

    ofz#829 ensure palette can fulfil largest index used
    
    Change-Id: I95aa4796875ee71e8b06a2bb8985845f270b8817
    Reviewed-on: https://gerrit.libreoffice.org/35104
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 71f095d734c93e22279c2ab8afe788182eb5bdbb)

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx
index 48f985e12ab6..db1ddccd1e64 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -52,6 +52,7 @@ private:
     Bitmap                  aBitmap;
     BitmapWriteAccess*      pAcc;
     sal_uInt16              nDstBitsPerPixel;
+    int                     nLargestPixelIndex;
     AlphaMask*              pAlphaMask;
     BitmapWriteAccess*      pMaskAcc;
 
@@ -120,6 +121,9 @@ private:
         // converts a Scanline to the Windows-BMP format
 
     bool HasAlphaChannel() const;
+
+    void SetPixelIndex(BitmapWriteAccess *pAcc, long nY, long nX, sal_uInt8 cIndex);
+
 public:
 
     TIFFReader()
@@ -127,6 +131,7 @@ public:
         , pTIFF(nullptr)
         , pAcc(nullptr)
         , nDstBitsPerPixel(0)
+        , nLargestPixelIndex(-1)
         , pAlphaMask(nullptr)
         , pMaskAcc(nullptr)
         , nOrigPos(0)
@@ -783,6 +788,11 @@ sal_uLong TIFFReader::GetBits( const sal_uInt8 * pSrc, sal_uLong nBitsPos, sal_u
     return nRes;
 }
 
+void TIFFReader::SetPixelIndex(BitmapWriteAccess *pWriteAcc, long nY, long nX, sal_uInt8 cIndex)
+{
+    pWriteAcc->SetPixelIndex(nY, nX, cIndex);
+    nLargestPixelIndex = std::max<int>(nLargestPixelIndex, cIndex);
+}
 
 bool TIFFReader::ConvertScanline(sal_Int32 nY)
 {
@@ -945,7 +955,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
                             for (sal_Int32 nx = 0; nx < nImageWidth; ++nx)
                             {
                                 nLast += nx == 0 ? BYTESWAP( (sal_uInt8)*pt++ ) : *pt++;
-                                pAcc->SetPixelIndex( nY, nx, nLast );
+                                SetPixelIndex(pAcc, nY, nx, nLast);
                             }
                         }
                         else
@@ -953,7 +963,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
                             for (sal_Int32 nx = 0; nx < nImageWidth; ++nx)
                             {
                                 sal_uInt8 nLast = *pt++;
-                                pAcc->SetPixelIndex( nY, nx, static_cast<sal_uInt8>( (BYTESWAP((sal_uLong)nLast) - nMinSampleValue) * nMinMax ) );
+                                SetPixelIndex(pAcc, nY, nx, static_cast<sal_uInt8>( (BYTESWAP((sal_uLong)nLast) - nMinSampleValue) * nMinMax ));
                             }
                         }
                     }
@@ -965,15 +975,14 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
                             for (sal_Int32 nx = 0; nx < nImageWidth; ++nx)
                             {
                                 nLast += *pt++;
-                                pAcc->SetPixelIndex( nY, nx, nLast );
+                                SetPixelIndex(pAcc, nY, nx, nLast);
                             }
                         }
                         else
                         {
                             for (sal_Int32 nx = 0; nx < nImageWidth; ++nx)
                             {
-                                pAcc->SetPixelIndex( nY, nx, static_cast<sal_uInt8>( ((sal_uLong)*pt++ - nMinSampleValue) * nMinMax ) );
-
+                                SetPixelIndex(pAcc, nY, nx, static_cast<sal_uInt8>( ((sal_uLong)*pt++ - nMinSampleValue) * nMinMax ));
                             }
                         }
                     }
@@ -990,7 +999,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
                     for (sal_Int32 nx = 0; nx < nImageWidth; ++nx)
                     {
                         nVal = ( GetBits( pt, nx * nBitsPerSample, nBitsPerSample ) - nMinSampleValue ) * nMinMax;
-                        pAcc->SetPixelIndex( nY, nx, static_cast<sal_uInt8>(nVal));
+                        SetPixelIndex(pAcc, nY, nx, static_cast<sal_uInt8>(nVal));
                     }
                 }
                 break;
@@ -1011,28 +1020,28 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
                         while (nByteCount--)
                         {
                             nByteVal = *pt++;
-                            pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, nx++, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, nx++, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, nx++, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, nx++, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, nx++, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, nx++, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, nx++, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, nx++, nByteVal );
+                            SetPixelIndex(pAcc, nY, nx++, nByteVal);
                         }
                         if ( nImageWidth & 7 )
                         {
                             nByteVal = *pt++;
                             while ( nx < nImageWidth )
                             {
-                                pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
+                                SetPixelIndex(pAcc, nY, nx++, nByteVal & 1);
                                 nByteVal >>= 1;
                             }
                         }
@@ -1043,21 +1052,21 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
                         while (nByteCount--)
                         {
                             nByteVal = *pt++;
-                            pAcc->SetPixelIndex( nY, nx, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, nx, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, --nx, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, --nx, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, --nx, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, --nx, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, --nx, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, --nx, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, --nx, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, --nx, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, --nx, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, --nx, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, --nx, nByteVal & 1 );
+                            SetPixelIndex(pAcc, nY, --nx, nByteVal & 1);
                             nByteVal >>= 1;
-                            pAcc->SetPixelIndex( nY, --nx, nByteVal );
+                            SetPixelIndex(pAcc, nY, --nx, nByteVal);
                             nx += 15;
                         }
                         if ( nImageWidth & 7 )
@@ -1067,7 +1076,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
                             nShift = 7;
                             while ( nx < nImageWidth )
                             {
-                                pAcc->SetPixelIndex( nY, nx++, ( nByteVal >> nShift ) & 1);
+                                SetPixelIndex(pAcc, nY, nx++, ( nByteVal >> nShift ) & 1);
                             }
                         }
                     }
@@ -1088,7 +1097,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
             sal_uInt8*  pt = pMap[ 0 ];
             for (sal_Int32 nx = 0; nx < nImageWidth; nx++, pt += 2 )
             {
-                pAcc->SetPixelIndex( nY, nx, static_cast<sal_uInt8>( ((sal_uLong)*pt - nMinSampleValue) * nMinMax) );
+                SetPixelIndex(pAcc, nY, nx, static_cast<sal_uInt8>( ((sal_uLong)*pt - nMinSampleValue) * nMinMax));
             }
         }
     }
@@ -1110,6 +1119,11 @@ void TIFFReader::MakePalCol()
             nNumColors = (sal_uLong)1 << nBitsPerSample;
             if ( nNumColors > 256 )
                 nNumColors = 256;
+            if (nLargestPixelIndex >= static_cast<int>(nNumColors))
+            {
+                SAL_WARN("filter.tiff", "palette has less entries that largest index used. Expanding palette to match");
+                nNumColors = nLargestPixelIndex + 1;
+            }
             pAcc->SetPaletteEntryCount( (sal_uInt16)nNumColors );
             for ( i = 0; i < nNumColors; i++ )
             {
@@ -1340,6 +1354,7 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic )
                 bStatus = false;
             if ( bStatus )
             {
+                nLargestPixelIndex = -1;
                 if ( nMaxSampleValue == 0 )
                 {
                     if ( nBitsPerSample == 32 )         // sj: i93300, compiler bug, 1 << 32 gives 1 one 32bit windows platforms,
commit 490843ac55c9f76939470e25a5c18d391eff4a5f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Mar 11 17:44:52 2017 +0000

    ofz#820 oom terminate
    
    comments claim return is len of data, but negative numbers for compressed data errors
    are returned. Make things return the amount of successful data read and turn into
    unsigned size_t to match ofz#727
    
    Change-Id: Iadddfae67bb5d4960ddf82e169fc2592ded85950
    Reviewed-on: https://gerrit.libreoffice.org/35078
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 4a7e226fa4bb5fe5e94a7cc5883b1747a4fd716b)

diff --git a/hwpfilter/source/drawing.h b/hwpfilter/source/drawing.h
index 00eef6335571..1967ddffed1c 100644
--- a/hwpfilter/source/drawing.h
+++ b/hwpfilter/source/drawing.h
@@ -107,14 +107,14 @@ static bool SkipPrivateBlock(int type)
     {
         if (!hmem->read4b(n))
             return false;
-        if (hmem->state() || hmem->skipBlock(n) != n)
+        if (hmem->state() || hmem->skipBlock(n) != static_cast<size_t>(n))
             return false;
     }
     if (!hmem->read4b(n))
         return false;
     if (hmem->state())
         return false;
-    return hmem->skipBlock(n) == n;
+    return hmem->skipBlock(n) == static_cast<size_t>(n);
 }
 
 static int SizeExpected;
diff --git a/hwpfilter/source/hgzip.cxx b/hwpfilter/source/hgzip.cxx
index 81dda52e60f1..d4adc6961431 100644
--- a/hwpfilter/source/hgzip.cxx
+++ b/hwpfilter/source/hgzip.cxx
@@ -148,17 +148,17 @@ static int destroy(gz_stream * s)
    Reads the given number of uncompressed bytes from the compressed file.
    gz_read returns the number of bytes actually read (0 for end of file).
 */
-int gz_read(gz_stream * file, voidp buf, unsigned len)
+size_t gz_read(gz_stream * file, voidp buf, unsigned len)
 {
 //printf("@@ gz_read : len : %d\t",len);
     gz_stream *s = file;
     Bytef *start = static_cast<Bytef *>(buf);                 /* starting point for crc computation */
     Byte *next_out;                               /* == stream.next_out but not forced far (for MSDOS) */
     if (s == nullptr)
-        return Z_STREAM_ERROR;
+        return 0;
 
     if (s->z_err == Z_DATA_ERROR || s->z_err == Z_ERRNO)
-        return -1;
+        return 0;
     if (s->z_err == Z_STREAM_END)
         return 0;                                 /* EOF */
 
@@ -201,7 +201,7 @@ int gz_read(gz_stream * file, voidp buf, unsigned len)
             break;
     }
     s->crc = crc32(s->crc, start, (uInt) (s->stream.next_out - start));
-    return (int) (len - s->stream.avail_out);
+    return len - s->stream.avail_out;
 }
 
 /* ===========================================================================
diff --git a/hwpfilter/source/hgzip.h b/hwpfilter/source/hgzip.h
index 4cff263ed390..40260a99dcc7 100644
--- a/hwpfilter/source/hgzip.h
+++ b/hwpfilter/source/hgzip.h
@@ -80,7 +80,7 @@ int     gz_close    ( gz_stream *file );
  * @param len Length of data to be read
  * @returns The number of bytes actually read
  */
-int     gz_read     ( gz_stream *file, voidp  buf, unsigned len );
+size_t     gz_read     ( gz_stream *file, voidp  buf, unsigned len );
 /**
  * Flushes all pending output into the compressed file
  * gz_flush should be called only when strictly necessary because it can
diff --git a/hwpfilter/source/hiodev.cxx b/hwpfilter/source/hiodev.cxx
index 48d105ff23ed..45ccb987bcd5 100644
--- a/hwpfilter/source/hiodev.cxx
+++ b/hwpfilter/source/hiodev.cxx
@@ -34,7 +34,7 @@
 #include "hwpfile.h"
 #include "hstream.hxx"
 
-const int BUFSIZE = 1024;
+const size_t BUFSIZE = 1024;
 static uchar rBuf[BUFSIZE];
 
 // HIODev abstract class
@@ -55,14 +55,14 @@ void HIODev::init()
 }
 
 
-int HIODev::read1b(void *ptr, int nmemb)
+size_t HIODev::read1b(void *ptr, size_t nmemb)
 {
     uchar *p = static_cast<uchar *>(ptr);
-    int ii;
 
     if (state())
-        return -1;
-    for (ii = 0; ii < nmemb; ii++)
+        return 0;
+    size_t ii;
+    for (ii = 0; ii < nmemb; ++ii)
     {
         if (!read1b(p[ii]))
             break;
@@ -72,14 +72,14 @@ int HIODev::read1b(void *ptr, int nmemb)
     return ii;
 }
 
-int HIODev::read2b(void *ptr, int nmemb)
+size_t HIODev::read2b(void *ptr, size_t nmemb)
 {
     ushort *p = static_cast<ushort *>(ptr);
-    int ii;
 
     if (state())
-        return -1;
-    for (ii = 0; ii < nmemb; ii++)
+        return 0;
+    size_t ii;
+    for (ii = 0; ii < nmemb; ++ii)
     {
         if (!read2b(p[ii]))
             break;
@@ -89,14 +89,14 @@ int HIODev::read2b(void *ptr, int nmemb)
     return ii;
 }
 
-int HIODev::read4b(void *ptr, int nmemb)
+size_t HIODev::read4b(void *ptr, size_t nmemb)
 {
     uint *p = static_cast<uint *>(ptr);
-    int ii;
 
     if (state())
-        return -1;
-    for (ii = 0; ii < nmemb; ii++)
+        return 0;
+    size_t ii;
+    for (ii = 0; ii < nmemb; ++ii)
     {
         if (!read4b(p[ii]))
             break;
@@ -174,7 +174,7 @@ bool HStreamIODev::setCompressed(bool flag)
 
 bool HStreamIODev::read1b(unsigned char &out)
 {
-    int res = (compressed) ? GZREAD(rBuf, 1) : _stream->readBytes(rBuf, 1);
+    size_t res = (compressed) ? GZREAD(rBuf, 1) : _stream->readBytes(rBuf, 1);
 
     if (res < 1)
         return false;
@@ -194,7 +194,7 @@ bool HStreamIODev::read1b(char &out)
 
 bool HStreamIODev::read2b(unsigned short &out)
 {
-    int res = (compressed) ? GZREAD(rBuf, 2) : _stream->readBytes(rBuf, 2);
+    size_t res = (compressed) ? GZREAD(rBuf, 2) : _stream->readBytes(rBuf, 2);
 
     if (res < 2)
         return false;
@@ -205,7 +205,7 @@ bool HStreamIODev::read2b(unsigned short &out)
 
 bool HStreamIODev::read4b(unsigned int &out)
 {
-    int res = (compressed) ? GZREAD(rBuf, 4) : _stream->readBytes(rBuf, 4);
+    size_t res = (compressed) ? GZREAD(rBuf, 4) : _stream->readBytes(rBuf, 4);
 
     if (res < 4)
         return false;
@@ -224,9 +224,9 @@ bool HStreamIODev::read4b(int &out)
     return true;
 }
 
-int HStreamIODev::readBlock(void *ptr, int size)
+size_t HStreamIODev::readBlock(void *ptr, size_t size)
 {
-    int count =
+    size_t count =
         (compressed) ? GZREAD(ptr, size) : _stream->readBytes(static_cast<byte *>(ptr),
 
         size);
@@ -234,16 +234,16 @@ int HStreamIODev::readBlock(void *ptr, int size)
     return count;
 }
 
-int HStreamIODev::skipBlock(int size)
+size_t HStreamIODev::skipBlock(size_t size)
 {
     if (compressed){
           if( size <= BUFSIZE )
                 return GZREAD(rBuf, size);
           else{
-                int remain = size;
+                size_t remain = size;
                 while(remain){
                      if( remain > BUFSIZE ) {
-                          int read = GZREAD(rBuf, BUFSIZE);
+                          size_t read = GZREAD(rBuf, BUFSIZE);
                           remain -= read;
                           if (read != BUFSIZE)
                               break;
@@ -260,7 +260,7 @@ int HStreamIODev::skipBlock(int size)
 }
 
 
-HMemIODev::HMemIODev(char *s, int len)
+HMemIODev::HMemIODev(char *s, size_t len)
 {
     init();
     ptr = reinterpret_cast<uchar *>(s);
@@ -357,7 +357,7 @@ bool HMemIODev::read4b(int &out)
     return true;
 }
 
-int HMemIODev::readBlock(void *p, int size)
+size_t HMemIODev::readBlock(void *p, size_t size)
 {
     if (length < pos + size)
         size = length - pos;
@@ -366,7 +366,7 @@ int HMemIODev::readBlock(void *p, int size)
     return size;
 }
 
-int HMemIODev::skipBlock(int size)
+size_t HMemIODev::skipBlock(size_t size)
 {
     if (length < pos + size)
         return 0;
diff --git a/hwpfilter/source/hiodev.h b/hwpfilter/source/hiodev.h
index 7c20e1ffa699..af49703c3482 100644
--- a/hwpfilter/source/hiodev.h
+++ b/hwpfilter/source/hiodev.h
@@ -56,12 +56,12 @@ class DLLEXPORT HIODev
         virtual bool read2b(unsigned short &out) = 0;
         virtual bool read4b(unsigned int &out) = 0;
         virtual bool read4b(int &out) = 0;
-        virtual int readBlock( void *ptr, int size ) = 0;
-        virtual int skipBlock( int size ) = 0;
+        virtual size_t readBlock( void *ptr, size_t size ) = 0;
+        virtual size_t skipBlock( size_t size ) = 0;
 
-        int read1b( void *ptr, int nmemb );
-        int read2b( void *ptr, int nmemb );
-        int read4b( void *ptr, int nmemb );
+        size_t read1b( void *ptr, size_t nmemb );
+        size_t read2b( void *ptr, size_t nmemb );
+        size_t read4b( void *ptr, size_t nmemb );
 };
 
 struct gz_stream;
@@ -117,11 +117,11 @@ class HStreamIODev final: public HIODev
 /**
  * Read some bytes from stream to given pointer as amount of size
  */
-        virtual int readBlock( void *ptr, int size ) override;
+        virtual size_t readBlock( void *ptr, size_t size ) override;
 /**
  * Move current pointer of stream as amount of size
  */
-        virtual int skipBlock( int size ) override;
+        virtual size_t skipBlock( size_t size ) override;
     private:
 /**
  * Initialize this object
@@ -137,9 +137,9 @@ class HStreamIODev final: public HIODev
 class HMemIODev final: public HIODev
 {
     uchar *ptr;
-    int pos, length;
+    size_t pos, length;
     public:
-        HMemIODev(char *s, int len);
+        HMemIODev(char *s, size_t len);
         virtual ~HMemIODev() override;
 
         virtual bool open() override;
@@ -155,8 +155,8 @@ class HMemIODev final: public HIODev
         using HIODev::read4b;
         virtual bool read4b(unsigned int &out) override;
         virtual bool read4b(int &out) override;
-        virtual int readBlock( void *ptr, int size ) override;
-        virtual int skipBlock( int size ) override;
+        virtual size_t readBlock( void *ptr, size_t size ) override;
+        virtual size_t skipBlock( size_t size ) override;
     private:
         virtual void init() override;
 };
commit 73efdb66ad4f40388d711da902ebf54a0d5071ef
Author: Eike Rathke <erack at redhat.com>
Date:   Fri Mar 10 18:32:27 2017 +0100

    Resolves: tdf#106459 3D reference can't be handled as vector reference
    
    Change-Id: Icba12a6218086079a7d5538f7263bccb1f2ee1b0
    (cherry picked from commit ca1f051972946b24cb6658143fb0d0ac3587a988)
    Reviewed-on: https://gerrit.libreoffice.org/35051
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit b16868ab2f7f3f0e09d68faba75d16fff1d851c1)

diff --git a/sc/source/core/data/grouptokenconverter.cxx b/sc/source/core/data/grouptokenconverter.cxx
index 024a2520af4f..12751a178364 100644
--- a/sc/source/core/data/grouptokenconverter.cxx
+++ b/sc/source/core/data/grouptokenconverter.cxx
@@ -169,6 +169,10 @@ bool ScGroupTokenConverter::convert( ScTokenArray& rCode, sc::FormulaLogger::Gro
                 ScComplexRefData aRef = *p->GetDoubleRef();
                 ScRange aAbs = aRef.toAbs(mrPos);
 
+                // Multiple sheets not handled by vector/matrix.
+                if (aRef.Ref1.Tab() != aRef.Ref2.Tab())
+                    return false;
+
                 // Check for self reference.
                 if (aRef.Ref1.IsRowRel())
                 {
commit 04a5606b6ea5da5747bc97095cf6a1c91a28caf4
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Mar 10 10:21:41 2017 +0000

    ofz#801 avoid oom
    
    Change-Id: Id3167d1eb3f058543ab7596008012d51b3d242b7
    (cherry picked from commit 1353ebe535732022aef4377030d86ad7153c3144)
    Reviewed-on: https://gerrit.libreoffice.org/35036
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 7dc65a1e0ff3059bc1f7ab77c302930e61f72831)

diff --git a/lotuswordpro/source/filter/lwpgrfobj.cxx b/lotuswordpro/source/filter/lwpgrfobj.cxx
index 882f7d2b31e1..c3dc6450f7b0 100644
--- a/lotuswordpro/source/filter/lwpgrfobj.cxx
+++ b/lotuswordpro/source/filter/lwpgrfobj.cxx
@@ -113,6 +113,14 @@ void LwpGraphicObject::Read()
     unsigned char *pServerContext = nullptr;
     if (nServerContextSize > 0)
     {
+        sal_uInt16 nMaxPossibleSize = m_pObjStrm->remainingSize();
+
+        if (nServerContextSize > nMaxPossibleSize)
+        {
+            SAL_WARN("lwp", "stream too short for claimed no of records");
+            nServerContextSize = nMaxPossibleSize;
+        }
+
         pServerContext = new unsigned char[nServerContextSize];
         m_pObjStrm->QuickRead(pServerContext, static_cast<sal_uInt16>(nServerContextSize));
         if (nServerContextSize > 44)
diff --git a/lotuswordpro/source/filter/lwpobjstrm.cxx b/lotuswordpro/source/filter/lwpobjstrm.cxx
index c9350d8705db..bc968a550f43 100644
--- a/lotuswordpro/source/filter/lwpobjstrm.cxx
+++ b/lotuswordpro/source/filter/lwpobjstrm.cxx
@@ -156,6 +156,12 @@ void LwpObjectStream::ReleaseBuffer()
         }
     }
 }
+
+sal_uInt16 LwpObjectStream::remainingSize() const
+{
+    return m_nBufSize - m_nReadPos;
+}
+
 /**
  * @descr  read len bytes from object stream to buffer
  */
diff --git a/lotuswordpro/source/filter/lwpobjstrm.hxx b/lotuswordpro/source/filter/lwpobjstrm.hxx
index 918659da82b4..83062eebd0e8 100644
--- a/lotuswordpro/source/filter/lwpobjstrm.hxx
+++ b/lotuswordpro/source/filter/lwpobjstrm.hxx
@@ -85,6 +85,7 @@ private:
     LwpSvStream* m_pStrm;
     bool m_bCompressed;
 public:
+    sal_uInt16 remainingSize() const;
     sal_uInt16 QuickRead(void* buf, sal_uInt16 len);
     sal_uInt16 GetPos() { return m_nReadPos; }
     void SeekRel(sal_uInt16 pos);
commit 9d56e2580f32411c6e13ee8f1f6a0ded3123a54b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Mar 11 20:20:02 2017 +0000

    ofz: turn assert into throw
    
    cause size arg is controllable by the file data
    
    Change-Id: Ia92b56c04271557afbec1ab47620bcb34f1c0e8a
    (cherry picked from commit 1e8d00719c851d69d36cd66eb115c517c1696b64)
    Reviewed-on: https://gerrit.libreoffice.org/35083
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit 562a13c8d2325f7cb80c61f198c87b98d8922e63)

diff --git a/lotuswordpro/source/filter/lwpobjstrm.cxx b/lotuswordpro/source/filter/lwpobjstrm.cxx
index 8a28c9fd214a..c9350d8705db 100644
--- a/lotuswordpro/source/filter/lwpobjstrm.cxx
+++ b/lotuswordpro/source/filter/lwpobjstrm.cxx
@@ -68,7 +68,8 @@ LwpObjectStream::LwpObjectStream(LwpSvStream *pStrm, bool isCompressed, sal_uInt
     :m_pContentBuf(nullptr), m_nBufSize(size), m_nReadPos(0),
     m_pStrm(pStrm), m_bCompressed(isCompressed)
 {
-    assert(size<IO_BUFFERSIZE);
+    if (size >= IO_BUFFERSIZE)
+        throw std::range_error("bad Object size");
     // read object data from stream
     if(m_nBufSize == 0)
     {


More information about the Libreoffice-commits mailing list