[Libreoffice-commits] core.git: Branch 'feature/cib_contract57b' - 40 commits - cppcanvas/source external/curl external/liborcus hwpfilter/source include/o3tl oox/source package/source sc/qa sc/source sot/source sw/qa sw/source vcl/inc vcl/source vcl/unx writerfilter/source xmloff/source
Kohei Yoshida
kohei.yoshida at gmail.com
Fri Jun 1 14:24:28 UTC 2018
cppcanvas/source/mtfrenderer/emfplus.cxx | 16
external/curl/CVE-2017-8816.patch | 67 +
external/curl/CVE-2018-1000005.patch | 36
external/curl/CVE-2018-1000007.patch | 110 ++
external/curl/UnpackedTarball_curl.mk | 3
external/liborcus/0001-protect-the-self-closing-xml-element-code-against-se.patch | 30
external/liborcus/UnpackedTarball_liborcus.mk | 1
hwpfilter/source/hcode.cxx | 30
hwpfilter/source/hwpfile.h | 2
include/o3tl/safeint.hxx | 124 ++
oox/source/ole/vbacontrol.cxx | 10
package/source/zipapi/MemoryByteGrabber.hxx | 2
package/source/zipapi/ZipFile.cxx | 10
sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls |binary
sc/qa/unit/data/xls/pass/forcepoint-selfseriesadd.xls |binary
sc/source/core/data/column3.cxx | 4
sc/source/filter/excel/xichart.cxx | 23
sc/source/filter/xml/xmlcelli.cxx | 2
sc/source/ui/inc/viewdata.hxx | 4
sc/source/ui/view/viewdata.cxx | 12
sot/source/sdstor/stgstrms.cxx | 4
sw/qa/core/data/odt/fail/forcepoint-dtor-1.odt |binary
sw/qa/core/data/rtf/fail/forcepoint-7.rtf | 517 ++++++++++
sw/qa/core/data/rtf/pass/forcepoint-1.rtf | 193 +++
sw/source/core/txtnode/fntcache.cxx | 3
sw/source/filter/ww8/ww8toolbar.cxx | 4
sw/source/filter/xml/xmlimp.cxx | 5
sw/source/filter/xml/xmltbli.cxx | 7
sw/source/filter/xml/xmltexti.cxx | 11
vcl/inc/sft.hxx | 14
vcl/source/fontsubset/sft.cxx | 149 +-
vcl/source/gdi/pdfwriter_impl2.cxx | 27
vcl/source/helper/strhelper.cxx | 9
vcl/unx/generic/glyphs/freetype_glyphcache.cxx | 4
vcl/unx/generic/printer/jobdata.cxx | 14
writerfilter/source/dmapper/DomainMapperTableManager.cxx | 13
writerfilter/source/dmapper/DomainMapperTableManager.hxx | 1
writerfilter/source/dmapper/TableManager.cxx | 2
writerfilter/source/rtftok/rtfdispatchvalue.cxx | 2
xmloff/source/draw/ximpcustomshape.cxx | 2
xmloff/source/text/txtparai.cxx | 15
41 files changed, 1350 insertions(+), 132 deletions(-)
New commits:
commit c0e9139bb4779ca90e15bd5960a161c79dc2902d
Author: Kohei Yoshida <kohei.yoshida at gmail.com>
Date: Wed Feb 21 20:08:23 2018 -0500
Patch liborcus to avoid incorrect parsing of XML.
Found by Antti Levomäki and Christian Jalio from Forcepoint.
This one is not a backport from the master branch. On the master
branch the same fix will come from updating liborcus from 0.13.3
to 0.13.4.
(cherry picked from commit 160350de5f07024b22fb5a9b596918ccc7f22c75)
Conflicts:
external/liborcus/UnpackedTarball_liborcus.mk
Reviewed-on: https://gerrit.libreoffice.org/50147
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
(cherry picked from commit f25bc1254782589af5d24471599260b65558154a)
Conflicts:
external/liborcus/UnpackedTarball_liborcus.mk
Change-Id: I701c5a65ff67d77767913f8d056682b9db549f84
diff --git a/external/liborcus/0001-protect-the-self-closing-xml-element-code-against-se.patch b/external/liborcus/0001-protect-the-self-closing-xml-element-code-against-se.patch
new file mode 100644
index 000000000000..990665f9c383
--- /dev/null
+++ b/external/liborcus/0001-protect-the-self-closing-xml-element-code-against-se.patch
@@ -0,0 +1,30 @@
+From 12e5d89cbd7101c61fbdf063322203a1590a0ef5 Mon Sep 17 00:00:00 2001
+From: Markus Mohrhard <markus.mohrhard at googlemail.com>
+Date: Wed, 21 Feb 2018 00:29:03 +0100
+Subject: [PATCH] protect the self-closing xml element code against
+ self-closing root elements
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Found by Antti Levomäki and Christian Jalio from Forcepoint.
+---
+ include/orcus/sax_parser.hpp | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/orcus/sax_parser.hpp b/include/orcus/sax_parser.hpp
+index ba5ebcd..67d5943 100644
+--- a/include/orcus/sax_parser.hpp
++++ b/include/orcus/sax_parser.hpp
+@@ -171,6 +171,8 @@ void sax_parser<_Handler,_Config>::element_open(std::ptrdiff_t begin_pos)
+ m_handler.start_element(elem);
+ reset_buffer_pos();
+ m_handler.end_element(elem);
++ if (!m_nest_level)
++ m_root_elem_open = false;
+ #if ORCUS_DEBUG_SAX_PARSER
+ cout << "element_open: ns='" << elem.ns << "', name='" << elem.name << "' (self-closing)" << endl;
+ #endif
+--
+2.7.4
+
diff --git a/external/liborcus/UnpackedTarball_liborcus.mk b/external/liborcus/UnpackedTarball_liborcus.mk
index 08f3423f2424..51f6e55e1de1 100644
--- a/external/liborcus/UnpackedTarball_liborcus.mk
+++ b/external/liborcus/UnpackedTarball_liborcus.mk
@@ -16,6 +16,7 @@ $(eval $(call gb_UnpackedTarball_set_patchlevel,liborcus,1))
$(eval $(call gb_UnpackedTarball_add_patches,liborcus,\
external/liborcus/0001-workaround-a-linking-problem-on-windows.patch \
external/liborcus/rpath.patch.0 \
+ external/liborcus/0001-protect-the-self-closing-xml-element-code-against-se.patch \
))
ifeq ($(OS),WNT)
commit ecae24f56f20b47e03b445fbaaf9b0f5702b7fb2
Author: Michael Stahl <mstahl at redhat.com>
Date: Wed Jan 24 22:24:03 2018 +0100
curl: fix CVE-2018-1000005/1000007
* don't upgrade to new release, no idea how the new windows
build system likes targeting Win XP which is still supported in 5.4
Change-Id: I4fbd7f1c5f1f0563895f6f8ede10063621d10a4b
Reviewed-on: https://gerrit.libreoffice.org/48542
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Eike Rathke <erack at redhat.com>
(cherry picked from commit ed497921314ebd41fce3483c92ca433b502628ca)
diff --git a/external/curl/CVE-2018-1000005.patch b/external/curl/CVE-2018-1000005.patch
new file mode 100644
index 000000000000..7b5578b1aacc
--- /dev/null
+++ b/external/curl/CVE-2018-1000005.patch
@@ -0,0 +1,36 @@
+From fa3dbb9a147488a2943bda809c66fc497efe06cb Mon Sep 17 00:00:00 2001
+From: Zhouyihai Ding <ddyihai at ddyihai.svl.corp.google.com>
+Date: Wed, 10 Jan 2018 10:12:18 -0800
+Subject: [PATCH] http2: fix incorrect trailer buffer size
+
+Prior to this change the stored byte count of each trailer was
+miscalculated and 1 less than required. It appears any trailer
+after the first that was passed to Curl_client_write would be truncated
+or corrupted as well as the size. Potentially the size of some
+subsequent trailer could be erroneously extracted from the contents of
+that trailer, and since that size is used by client write an
+out-of-bounds read could occur and cause a crash or be otherwise
+processed by client write.
+
+The bug appears to have been born in 0761a51 (precedes 7.49.0).
+
+Closes https://github.com/curl/curl/pull/2231
+---
+ lib/http2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/http2.c b/lib/http2.c
+index 8e2fc71996..699287940e 100644
+--- a/lib/http2.c
++++ b/lib/http2.c
+@@ -925,8 +925,8 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
+
+ if(stream->bodystarted) {
+ /* This is trailer fields. */
+- /* 3 is for ":" and "\r\n". */
+- uint32_t n = (uint32_t)(namelen + valuelen + 3);
++ /* 4 is for ": " and "\r\n". */
++ uint32_t n = (uint32_t)(namelen + valuelen + 4);
+
+ DEBUGF(infof(data_s, "h2 trailer: %.*s: %.*s\n", namelen, name, valuelen,
+ value));
diff --git a/external/curl/CVE-2018-1000007.patch b/external/curl/CVE-2018-1000007.patch
new file mode 100644
index 000000000000..c474370c78ad
--- /dev/null
+++ b/external/curl/CVE-2018-1000007.patch
@@ -0,0 +1,110 @@
+From af32cd3859336ab963591ca0df9b1e33a7ee066b Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel at haxx.se>
+Date: Fri, 19 Jan 2018 13:19:25 +0100
+Subject: [PATCH] http: prevent custom Authorization headers in redirects
+
+... unless CURLOPT_UNRESTRICTED_AUTH is set to allow them. This matches how
+curl already handles Authorization headers created internally.
+
+Note: this changes behavior slightly, for the sake of reducing mistakes.
+
+Added test 317 and 318 to verify.
+
+Reported-by: Craig de Stigter
+Bug: https://curl.haxx.se/docs/adv_2018-b3bf.html
+---
+ docs/libcurl/opts/CURLOPT_HTTPHEADER.3 | 12 ++++-
+ lib/http.c | 10 +++-
+ lib/setopt.c | 2 +-
+ lib/urldata.h | 2 +-
+ tests/data/Makefile.inc | 2 +-
+ tests/data/test317 | 94 +++++++++++++++++++++++++++++++++
+ tests/data/test318 | 95 ++++++++++++++++++++++++++++++++++
+ 7 files changed, 212 insertions(+), 5 deletions(-)
+ create mode 100644 tests/data/test317
+ create mode 100644 tests/data/test318
+
+diff --git a/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 b/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
+index c5ccb1a53d..c9f29e393e 100644
+--- a/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
++++ b/docs/libcurl/opts/CURLOPT_HTTPHEADER.3
+@@ -5,7 +5,7 @@
+ .\" * | (__| |_| | _ <| |___
+ .\" * \___|\___/|_| \_\_____|
+ .\" *
+-.\" * Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel at haxx.se>, et al.
++.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel at haxx.se>, et al.
+ .\" *
+ .\" * This software is licensed as described in the file COPYING, which
+ .\" * you should have received as part of this distribution. The terms
+@@ -77,6 +77,16 @@ the headers. They may be private or otherwise sensitive to leak.
+
+ Use \fICURLOPT_HEADEROPT(3)\fP to make the headers only get sent to where you
+ intend them to get sent.
++
++Custom headers are sent in all requests done by the easy handles, which
++implies that if you tell libcurl to follow redirects
++(\fBCURLOPT_FOLLOWLOCATION(3)\fP), the same set of custom headers will be sent
++in the subsequent request. Redirects can of course go to other hosts and thus
++those servers will get all the contents of your custom headers too.
++
++Starting in 7.58.0, libcurl will specifically prevent "Authorization:" headers
++from being sent to other hosts than the first used one, unless specifically
++permitted with the \fBCURLOPT_UNRESTRICTED_AUTH(3)\fP option.
+ .SH DEFAULT
+ NULL
+ .SH PROTOCOLS
+diff --git a/lib/http.c b/lib/http.c
+index c1cdf2da02..a5007670d7 100644
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -714,7 +714,7 @@ Curl_http_output_auth(struct connectdata *conn,
+ if(!data->state.this_is_a_follow ||
+ conn->bits.netrc ||
+ !data->state.first_host ||
+- data->set.http_disable_hostname_check_before_authentication ||
++ data->set.allow_auth_to_other_hosts ||
+ strcasecompare(data->state.first_host, conn->host.name)) {
+ result = output_auth_headers(conn, authhost, request, path, FALSE);
+ }
+@@ -1636,6 +1636,14 @@ CURLcode Curl_add_custom_headers(struct connectdata *conn,
+ checkprefix("Transfer-Encoding:", headers->data))
+ /* HTTP/2 doesn't support chunked requests */
+ ;
++ else if(checkprefix("Authorization:", headers->data) &&
++ /* be careful of sending this potentially sensitive header to
++ other hosts */
++ (data->state.this_is_a_follow &&
++ data->state.first_host &&
++ !data->set.allow_auth_to_other_hosts &&
++ !strcasecompare(data->state.first_host, conn->host.name)))
++ ;
+ else {
+ CURLcode result = Curl_add_bufferf(req_buffer, "%s\r\n",
+ headers->data);
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 66f30ea653..a5ef75c722 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -976,7 +976,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option,
+ * Send authentication (user+password) when following locations, even when
+ * hostname changed.
+ */
+- data->set.http_disable_hostname_check_before_authentication =
++ data->set.allow_auth_to_other_hosts =
+ (0 != va_arg(param, long)) ? TRUE : FALSE;
+ break;
+
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 4dcd1a322c..5c04ad1720 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -1599,7 +1599,7 @@ struct UserDefined {
+ bool http_keep_sending_on_error; /* for HTTP status codes >= 300 */
+ bool http_follow_location; /* follow HTTP redirects */
+ bool http_transfer_encoding; /* request compressed HTTP transfer-encoding */
+- bool http_disable_hostname_check_before_authentication;
++ bool allow_auth_to_other_hosts;
+ bool include_header; /* include received protocol headers in data output */
+ bool http_set_referer; /* is a custom referer used */
+ bool http_auto_referer; /* set "correct" referer when following location: */
diff --git a/external/curl/UnpackedTarball_curl.mk b/external/curl/UnpackedTarball_curl.mk
index 4cabf2f1b80b..f9f3a8bf6016 100644
--- a/external/curl/UnpackedTarball_curl.mk
+++ b/external/curl/UnpackedTarball_curl.mk
@@ -24,6 +24,8 @@ $(eval $(call gb_UnpackedTarball_add_patches,curl,\
external/curl/curl-7.26.0_win-proxy.patch \
external/curl/curl-xp.patch.1 \
external/curl/CVE-2017-8816.patch \
+ external/curl/CVE-2018-1000005.patch \
+ external/curl/CVE-2018-1000007.patch \
))
ifeq ($(SYSTEM_NSS),)
commit 05448abb3cd6f4c2bb85da5d6e4993fa7d1435ba
Author: Michael Stahl <mstahl at redhat.com>
Date: Wed Nov 29 12:28:03 2017 +0100
curl: fix CVE-2017-8816
* don't upgrade to new release, no idea how the new windows
build system likes targeting Win XP which is still supported in 5.4
* CVE-2017-8817 doesn't affect LO as CURLOPT_WILDCARDMATCH isn't used
* CVE-2017-8818 doesn't affect the old 7.52 version
Change-Id: I49ddb771ccdb93d5fe8f4b3544f74ab9b171c156
Reviewed-on: https://gerrit.libreoffice.org/45487
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit aa0f44de5b260b2b2a39bdd2de9445d72ab14265)
diff --git a/external/curl/CVE-2017-8816.patch b/external/curl/CVE-2017-8816.patch
new file mode 100644
index 000000000000..dd4fa677e03f
--- /dev/null
+++ b/external/curl/CVE-2017-8816.patch
@@ -0,0 +1,67 @@
+From 7947c50bcd09cf471c95511739bc66d2cb506ee2 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel at haxx.se>
+Date: Mon, 6 Nov 2017 23:51:52 +0100
+Subject: [PATCH] ntlm: avoid integer overflow for malloc size
+
+Reported-by: Alex Nichols
+Assisted-by: Kamil Dudka and Max Dymond
+
+CVE-2017-8816
+
+Bug: https://curl.haxx.se/docs/adv_2017-11e7.html
+---
+ lib/curl_ntlm_core.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/lib/curl_ntlm_core.c b/lib/curl_ntlm_core.c
+index 1309bf0d9..e8962769c 100644
+--- a/lib/curl_ntlm_core.c
++++ b/lib/curl_ntlm_core.c
+@@ -644,23 +644,42 @@ CURLcode Curl_hmac_md5(const unsigned char *key, unsigned int keylen,
+ Curl_HMAC_final(ctxt, output);
+
+ return CURLE_OK;
+ }
+
++#ifndef SIZE_T_MAX
++/* some limits.h headers have this defined, some don't */
++#if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)
++#define SIZE_T_MAX 18446744073709551615U
++#else
++#define SIZE_T_MAX 4294967295U
++#endif
++#endif
++
+ /* This creates the NTLMv2 hash by using NTLM hash as the key and Unicode
+ * (uppercase UserName + Domain) as the data
+ */
+ CURLcode Curl_ntlm_core_mk_ntlmv2_hash(const char *user, size_t userlen,
+ const char *domain, size_t domlen,
+ unsigned char *ntlmhash,
+ unsigned char *ntlmv2hash)
+ {
+ /* Unicode representation */
+- size_t identity_len = (userlen + domlen) * 2;
+- unsigned char *identity = malloc(identity_len);
++ size_t identity_len;
++ unsigned char *identity;
+ CURLcode result = CURLE_OK;
+
++ /* we do the length checks below separately to avoid integer overflow risk
++ on extreme data lengths */
++ if((userlen > SIZE_T_MAX/2) ||
++ (domlen > SIZE_T_MAX/2) ||
++ ((userlen + domlen) > SIZE_T_MAX/2))
++ return CURLE_OUT_OF_MEMORY;
++
++ identity_len = (userlen + domlen) * 2;
++ identity = malloc(identity_len);
++
+ if(!identity)
+ return CURLE_OUT_OF_MEMORY;
+
+ ascii_uppercase_to_unicode_le(identity, user, userlen);
+ ascii_to_unicode_le(identity + (userlen << 1), domain, domlen);
+--
+2.15.0
+
diff --git a/external/curl/UnpackedTarball_curl.mk b/external/curl/UnpackedTarball_curl.mk
index 6a5720d78459..4cabf2f1b80b 100644
--- a/external/curl/UnpackedTarball_curl.mk
+++ b/external/curl/UnpackedTarball_curl.mk
@@ -23,6 +23,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,curl,\
external/curl/curl-7.26.0_mingw.patch \
external/curl/curl-7.26.0_win-proxy.patch \
external/curl/curl-xp.patch.1 \
+ external/curl/CVE-2017-8816.patch \
))
ifeq ($(SYSTEM_NSS),)
commit f58bf719637363f4f87f41afdeba8eacce3a543e
Author: Caolán McNamara <caolanm at redhat.com>
Date: Fri Feb 9 10:35:33 2018 +0000
various sft fixes
backport removing unneeded code
use ptr diff rather than int
(cherry picked from commit 5b426038a7befcaf0d05824ffb20200ff8833ad3)
fix mem leak
(cherry picked from commit 603cb6cf31a5212d03736a552770e5734b0e8066)
check more table sizes
(cherry picked from commit 1828490bb22f1c8273c4a9f5b1db819b173ca70d)
check cmap offset
(cherry picked from commit 683d9883ad8fd6568e6a7832e5bb347c1d043e4b)
check tableoffset against size
(cherry picked from commit ae73c3ff112e1ed38eb4678ac5745990661a2e66)
check ntables offset
(cherry picked from commit 75a171a405afd6eac236af93aa9d29a9c3ec9c64)
use safeint on calculations
(cherry picked from commit 139b6c6cf898467098f3a6f29fa84013a182285f)
simplify returns
(cherry picked from commit e8b2aad1cb2107304761e68aa380b5c29d8ef22f)
extend to cover the last byte needed
(cherry picked from commit c7b0117f26a386c98a721ff3897479c268103d74)
bounds check
(cherry picked from commit bb32616bdd6e3b327654bab0e1d790d8d50b893d)
move largest bounds check to start
(cherry picked from commit f832198e6a33052c7cc86b25843badfb962a2ae8)
android:update safeint header to use the else implementation with clang
Clang toolchain does not defines the __builtin_mul_overflow for 32-bit
ARM. So, fallback to else implementation of checked_multiply when
building Android with Clang
Reviewed-on: https://gerrit.libreoffice.org/39005
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
(cherry picked from commit 2149d4a88e9dc88c30e7475f8ea317e5c7b78529)
add checked_add
Reviewed-on: https://gerrit.libreoffice.org/43779
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit 9cfb27ae6cb94f0a853ff70e9ad9f3109d305a94)
Change-Id: I0b59f1b93d31a7cb5b8db2a21736db11aed46536
a174fd94c57cc3c899c10e1c0dc5968965a50427
0d329357ac282d4652b0f7ebc401cbd51963461b
004a6d322f60d916cc4635b362ce948e8a10d7c7
5aae26c38f3645020f0e1d6d7b6877c2727af1b4
a79be052dd3f6b6ed38fb326558924c853af5fff
d75f5f4b578fd176c17e5763569f1403260c6594
c063786ba41aa9a985f505e62b43d3d543a0d48f
1a67cb2f1c686032438852fec1267a59fbd04d7f
5177d42b47a4bca614878dce4a69ab16b5cfe163
6d32a6b6f1dd91db42a3f154700ea55603f0e4dd
03fe80f9568759b829fac4e9bcfd496efebe6a26
6120606f521ce121541a5b7f1150229258012d55
10cba898bba528f5f1bfbd583e27a6821c789ab9
Reviewed-on: https://gerrit.libreoffice.org/49485
Reviewed-by: Michael Stahl <mstahl at redhat.com>
Tested-by: Jenkins <ci at libreoffice.org>
diff --git a/include/o3tl/safeint.hxx b/include/o3tl/safeint.hxx
new file mode 100644
index 000000000000..5ebf353b6bd6
--- /dev/null
+++ b/include/o3tl/safeint.hxx
@@ -0,0 +1,124 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/*
+ * This file is part of the LibreOffice project.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+#ifndef INCLUDED_O3TL_SAFEINT_HXX
+#define INCLUDED_O3TL_SAFEINT_HXX
+
+#include <limits>
+#if defined(_MSC_VER)
+#include <safeint.h>
+#else
+#ifndef __has_builtin
+# define __has_builtin(x) 0
+#endif
+#endif
+
+namespace o3tl
+{
+
+#if defined(_MSC_VER)
+
+template<typename T> inline bool checked_multiply(T a, T b, T& result)
+{
+ return !msl::utilities::SafeMultiply(a, b, result);
+}
+
+template<typename T> inline bool checked_add(T a, T b, T& result)
+{
+ return !msl::utilities::SafeAdd(a, b, result);
+}
+
+#elif (defined __GNUC__ && __GNUC__ >= 5) || (__has_builtin(__builtin_mul_overflow) && !(defined ANDROID && defined __clang__))
+
+template<typename T> inline bool checked_multiply(T a, T b, T& result)
+{
+ return __builtin_mul_overflow(a, b, &result);
+}
+
+template<typename T> inline bool checked_add(T a, T b, T& result)
+{
+ return __builtin_add_overflow(a, b, &result);
+}
+
+#else
+
+//https://www.securecoding.cert.org/confluence/display/c/INT32-C.+Ensure+that+operations+on+signed+integers+do+not+result+in+overflow
+template<typename T> inline typename std::enable_if<std::is_signed<T>::value, bool>::type checked_multiply(T a, T b, T& result)
+{
+ if (a > 0) { /* a is positive */
+ if (b > 0) { /* a and b are positive */
+ if (a > (std::numeric_limits<T>::max() / b)) {
+ return true; /* Handle error */
+ }
+ } else { /* a positive, b nonpositive */
+ if (b < (std::numeric_limits<T>::min() / a)) {
+ return true; /* Handle error */
+ }
+ } /* a positive, b nonpositive */
+ } else { /* a is nonpositive */
+ if (b > 0) { /* a is nonpositive, b is positive */
+ if (a < (std::numeric_limits<T>::min() / b)) {
+ return true; /* Handle error */
+ }
+ } else { /* a and b are nonpositive */
+ if ( (a != 0) && (b < (std::numeric_limits<T>::max() / a))) {
+ return true; /* Handle error */
+ }
+ } /* End if a and b are nonpositive */
+ } /* End if a is nonpositive */
+
+ result = a * b;
+
+ return false;
+}
+
+//https://www.securecoding.cert.org/confluence/display/c/INT30-C.+Ensure+that+unsigned+integer+operations+do+not+wrap
+template<typename T> inline typename std::enable_if<std::is_unsigned<T>::value, bool>::type checked_multiply(T a, T b, T& result)
+{
+ if (b && a > std::numeric_limits<T>::max() / b) {
+ return true;/* Handle error */
+ }
+
+ result = a * b;
+
+ return false;
+}
+
+//https://www.securecoding.cert.org/confluence/display/c/INT32-C.+Ensure+that+operations+on+signed+integers+do+not+result+in+overflow
+template<typename T> inline typename std::enable_if<std::is_signed<T>::value, bool>::type checked_add(T a, T b, T& result)
+{
+ if (((b > 0) && (a > (std::numeric_limits<T>::max() - b))) ||
+ ((b < 0) && (a < (std::numeric_limits<T>::min() - b)))) {
+ return true;
+ }
+
+ result = a + b;
+
+ return false;
+}
+
+//https://www.securecoding.cert.org/confluence/display/c/INT30-C.+Ensure+that+unsigned+integer+operations+do+not+wrap
+template<typename T> inline typename std::enable_if<std::is_unsigned<T>::value, bool>::type checked_add(T a, T b, T& result)
+{
+ if (std::numeric_limits<T>::max() - a < b) {
+ return true;/* Handle error */
+ }
+
+ result = a + b;
+
+ return false;
+}
+
+#endif
+
+}
+
+#endif
+
+/* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/vcl/inc/sft.hxx b/vcl/inc/sft.hxx
index 80c62c11b878..0b3c3afcfbef 100644
--- a/vcl/inc/sft.hxx
+++ b/vcl/inc/sft.hxx
@@ -189,21 +189,15 @@ namespace vcl
int descender; /**< typographic descent. */
int linegap; /**< typographic line gap.\ Negative values are treated as
zero in Win 3.1, System 6 and System 7. */
- int vascent; /**< typographic ascent for vertical writing mode */
- int vdescent; /**< typographic descent for vertical writing mode */
int typoAscender; /**< OS/2 portable typographic ascender */
int typoDescender; /**< OS/2 portable typographic descender */
int typoLineGap; /**< OS/2 portable typographic line gap */
int winAscent; /**< ascender metric for Windows */
int winDescent; /**< descender metric for Windows */
bool symbolEncoded; /**< true: MS symbol encoded */
- int rangeFlag; /**< if set to 1 Unicode Range flags are applicable */
- sal_uInt32 ur1; /**< bits 0 - 31 of Unicode Range flags */
- sal_uInt32 ur2; /**< bits 32 - 63 of Unicode Range flags */
- sal_uInt32 ur3; /**< bits 64 - 95 of Unicode Range flags */
- sal_uInt32 ur4; /**< bits 96 - 127 of Unicode Range flags */
- sal_uInt8 panose[10]; /**< PANOSE classification number */
- sal_uInt32 typeFlags; /**< type flags (copyright bits + PS-OpenType flag) */
+ sal_uInt8 panose[10]; /**< PANOSE classification number */
+ sal_uInt32 typeFlags; /**< type flags (copyright bits + PS-OpenType flag) */
+ sal_uInt16 fsSelection; /**< OS/2 fsSelection */
} TTGlobalFontInfo;
#define TYPEFLAG_INVALID 0x8000000
@@ -521,8 +515,6 @@ namespace vcl
/*- private definitions */
struct TrueTypeFont {
- sal_uInt32 tag;
-
char *fname;
sal_Int32 fsize;
sal_uInt8 *ptr;
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 150b21ec676a..e6bfd7509da3 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -39,7 +39,7 @@
#include "xlat.hxx"
#include <rtl/crc.h>
#include <rtl/ustring.hxx>
-
+#include <o3tl/safeint.hxx>
#include <osl/endian.h>
#include <algorithm>
@@ -104,9 +104,6 @@ typedef struct {
sal_uInt32 *offs; /* array of nGlyphs offsets */
} GlyphOffsets;
-/* private tags */
-static const sal_uInt32 TTFontClassTag = 0x74746663; /* 'ttfc' */
-
static const sal_uInt32 T_true = 0x74727565; /* 'true' */
static const sal_uInt32 T_ttcf = 0x74746366; /* 'ttcf' */
static const sal_uInt32 T_otto = 0x4f54544f; /* 'OTTO' */
@@ -1341,6 +1338,13 @@ static void FindCmap(TrueTypeFont *ttf)
}
if (ttf->cmapType != CMAP_NOT_USABLE) {
+ if( (ttf->cmap - ttf->ptr + 2U) > static_cast<sal_uInt32>(ttf->fsize) ) {
+ ttf->cmapType = CMAP_NOT_USABLE;
+ ttf->cmap = nullptr;
+ }
+ }
+
+ if (ttf->cmapType != CMAP_NOT_USABLE) {
switch (GetUInt16(ttf->cmap, 0, 1)) {
case 0: ttf->mapper = getGlyph0; break;
case 2: ttf->mapper = getGlyph2; break;
@@ -1461,7 +1465,6 @@ static void allocTrueTypeFont( TrueTypeFont** ttf )
*ttf = static_cast<TrueTypeFont*>(calloc(1,sizeof(TrueTypeFont)));
if( *ttf != nullptr )
{
- (*ttf)->tag = 0;
(*ttf)->fname = nullptr;
(*ttf)->fsize = -1;
(*ttf)->ptr = nullptr;
@@ -1546,10 +1549,41 @@ int OpenTTFontBuffer(const void* pBuffer, sal_uInt32 nLen, sal_uInt32 facenum, T
return doOpenTTFont( facenum, *ttf );
}
+namespace {
+
+bool withinBounds(sal_uInt32 tdoffset, sal_uInt32 moreoffset, sal_uInt32 len, sal_uInt32 available)
+{
+ sal_uInt32 result;
+ if (o3tl::checked_add(tdoffset, moreoffset, result))
+ return false;
+ if (o3tl::checked_add(result, len, result))
+ return false;
+ return result <= available;
+}
+
+class TTFontCloser
+{
+ TrueTypeFont* m_font;
+public:
+ TTFontCloser(TrueTypeFont* t)
+ : m_font(t)
+ {
+ }
+ void clear() { m_font = nullptr; }
+ ~TTFontCloser()
+ {
+ if (m_font)
+ CloseTTFont(m_font);
+ }
+};
+
+}
+
static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
{
+ TTFontCloser aCloseGuard(t);
+
if (t->fsize < 4) {
- CloseTTFont(t);
return SF_TTFORMAT;
}
int i;
@@ -1563,27 +1597,28 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
} else if (TTCTag == T_otto) { /* PS-OpenType font */
tdoffset = 0;
} else if (TTCTag == T_ttcf) { /* TrueType collection */
+ if (!withinBounds(12, 4 * facenum, sizeof(sal_uInt32), t->fsize)) {
+ return SF_FONTNO;
+ }
sal_uInt32 Version = GetUInt32(t->ptr, 4, 1);
if (Version != 0x00010000 && Version != 0x00020000) {
- CloseTTFont(t);
return SF_TTFORMAT;
}
if (facenum >= GetUInt32(t->ptr, 8, 1)) {
- CloseTTFont(t);
return SF_FONTNO;
}
tdoffset = GetUInt32(t->ptr, 12 + 4 * facenum, 1);
} else {
- CloseTTFont(t);
return SF_TTFORMAT;
}
- /* magic number */
- t->tag = TTFontClassTag;
+ if (withinBounds(tdoffset, 0, 4 + sizeof(sal_uInt16), t->fsize)) {
+ t->ntables = GetUInt16(t->ptr + tdoffset, 4, 1);
+ }
- t->ntables = GetUInt16(t->ptr + tdoffset, 4, 1);
- if( t->ntables >= 128 )
+ if (t->ntables >= 128 || t->ntables == 0) {
return SF_TTFORMAT;
+ }
t->tables = static_cast<const sal_uInt8**>(calloc(NUM_TAGS, sizeof(sal_uInt8 *)));
assert(t->tables != nullptr);
@@ -1595,7 +1630,7 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
int nIndex;
const sal_uInt32 nStart = tdoffset + 12;
const sal_uInt32 nOffset = 16 * i;
- if (nStart + nOffset + sizeof(sal_uInt32) <= static_cast<sal_uInt32>(t->fsize))
+ if (withinBounds(nStart, nOffset, sizeof(sal_uInt32), t->fsize))
tag = GetUInt32(t->ptr + nStart, nOffset, 1);
else
tag = static_cast<sal_uInt32>(-1);
@@ -1620,9 +1655,10 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
case T_CFF: nIndex = O_CFF; break;
default: nIndex = -1; break;
}
- if( nIndex >= 0 ) {
- sal_uInt32 nTableOffset = GetUInt32(t->ptr + tdoffset + 12, 16 * i + 8, 1);
- length = GetUInt32(t->ptr + tdoffset + 12, 16 * i + 12, 1);
+
+ if ((nIndex >= 0) && withinBounds(nStart, nOffset, 12 + sizeof(sal_uInt32), t->fsize)) {
+ sal_uInt32 nTableOffset = GetUInt32(t->ptr + nStart, nOffset + 8, 1);
+ length = GetUInt32(t->ptr + nStart, nOffset + 12, 1);
t->tables[nIndex] = t->ptr + nTableOffset;
t->tlens[nIndex] = length;
}
@@ -1631,8 +1667,9 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
/* Fixup offsets when only a TTC extract was provided */
if( facenum == (sal_uInt32)~0 ) {
sal_uInt8* pHead = const_cast<sal_uInt8*>(t->tables[O_head]);
- if( !pHead )
+ if (!pHead) {
return SF_TTFORMAT;
+ }
/* limit Head candidate to TTC extract's limits */
if( pHead > t->ptr + (t->fsize - 54) )
pHead = t->ptr + (t->fsize - 54);
@@ -1648,8 +1685,9 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
break;
}
}
- if( p <= t->ptr )
+ if (p <= t->ptr) {
return SF_TTFORMAT;
+ }
}
/* Check the table offsets after TTC correction */
@@ -1671,7 +1709,7 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
}
else if( const_cast<sal_uInt8*>(t->tables[i]) + t->tlens[i] > t->ptr + t->fsize )
{
- int nMaxLen = (t->ptr + t->fsize) - t->tables[i];
+ sal_PtrDiff nMaxLen = (t->ptr + t->fsize) - t->tables[i];
if( nMaxLen < 0 )
nMaxLen = 0;
t->tlens[i] = nMaxLen;
@@ -1689,7 +1727,6 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
*/
if( !(getTable(t, O_maxp) && getTable(t, O_head) && getTable(t, O_name) && getTable(t, O_cmap)) ) {
- CloseTTFont(t);
return SF_TTFORMAT;
}
@@ -1700,14 +1737,12 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
table = getTable(t, O_head);
table_size = getTableSize(t, O_head);
if (table_size < 52) {
- CloseTTFont(t);
return SF_TTFORMAT;
}
t->unitsPerEm = GetUInt16(table, 18, 1);
int indexfmt = GetInt16(table, 50, 1);
if( ((indexfmt != 0) && (indexfmt != 1)) || (t->unitsPerEm <= 0) ) {
- CloseTTFont(t);
return SF_TTFORMAT;
}
@@ -1731,7 +1766,6 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
/* TODO: implement to get subsetting */
assert(t->goffsets != nullptr);
} else {
- CloseTTFont(t);
return SF_TTFORMAT;
}
@@ -1748,6 +1782,8 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
GetKern(t);
ReadGSUB( t, 0, 0 );
+ aCloseGuard.clear();
+
return SF_OK;
}
@@ -2590,13 +2626,6 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, TTGlobalFontInfo *info)
if( info->winDescent > 5*UPEm )
info->winDescent = XUnits(UPEm, GetInt16(table, 76,1));
}
- if (ttf->cmapType == CMAP_MS_Unicode) {
- info->rangeFlag = 1;
- info->ur1 = GetUInt32(table, 42, 1);
- info->ur2 = GetUInt32(table, 46, 1);
- info->ur3 = GetUInt32(table, 50, 1);
- info->ur4 = GetUInt32(table, 54, 1);
- }
memcpy(info->panose, table + 32, 10);
info->typeFlags = GetUInt16( table, 8, 1 );
if( getTable(ttf, O_CFF) )
@@ -2610,24 +2639,24 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, TTGlobalFontInfo *info)
}
table = getTable(ttf, O_head); /* 'head' tables is always there */
- info->xMin = XUnits(UPEm, GetInt16(table, 36, 1));
- info->yMin = XUnits(UPEm, GetInt16(table, 38, 1));
- info->xMax = XUnits(UPEm, GetInt16(table, 40, 1));
- info->yMax = XUnits(UPEm, GetInt16(table, 42, 1));
- info->macStyle = GetInt16(table, 44, 1);
+ table_size = getTableSize(ttf, O_head);
+ if (table_size >= 46) {
+ info->xMin = XUnits(UPEm, GetInt16(table, 36, 1));
+ info->yMin = XUnits(UPEm, GetInt16(table, 38, 1));
+ info->xMax = XUnits(UPEm, GetInt16(table, 40, 1));
+ info->yMax = XUnits(UPEm, GetInt16(table, 42, 1));
+ info->macStyle = GetInt16(table, 44, 1);
+ }
table = getTable(ttf, O_hhea);
- if (table) {
+ table_size = getTableSize(ttf, O_hhea);
+ if (table && table_size >= 10) {
info->ascender = XUnits(UPEm, GetInt16(table, 4, 1));
info->descender = XUnits(UPEm, GetInt16(table, 6, 1));
info->linegap = XUnits(UPEm, GetInt16(table, 8, 1));
}
table = getTable(ttf, O_vhea);
- if (table) {
- info->vascent = XUnits(UPEm, GetInt16(table, 4, 1));
- info->vdescent = XUnits(UPEm, GetInt16(table, 6, 1));
- }
}
GlyphData *GetTTRawGlyphData(TrueTypeFont *ttf, sal_uInt32 glyphID)
commit 14487b93b115634cb53ac48ddb52bbabddbbf83a
Author: Caolán McNamara <caolanm at redhat.com>
Date: Wed Feb 7 15:50:35 2018 +0000
check O_head size
Change-Id: Idf5d30eaed0196cfa9266e35131c538c606a0960
Reviewed-on: https://gerrit.libreoffice.org/49365
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit b10ae2faae6f3c448bbab71585550387e18cc248)
Reviewed-on: https://gerrit.libreoffice.org/49367
Reviewed-by: Michael Stahl <mstahl at redhat.com>
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index b34037ebdba1..150b21ec676a 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1555,7 +1555,6 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
int i;
sal_uInt32 length, tag;
sal_uInt32 tdoffset = 0; /* offset to TableDirectory in a TTC file. For TTF files is 0 */
- int indexfmt;
sal_uInt32 TTCTag = GetInt32(t->ptr, 0, 1);
@@ -1699,8 +1698,13 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
t->nglyphs = table_size >= 6 ? GetUInt16(table, 4, 1) : 0;
table = getTable(t, O_head);
+ table_size = getTableSize(t, O_head);
+ if (table_size < 52) {
+ CloseTTFont(t);
+ return SF_TTFORMAT;
+ }
t->unitsPerEm = GetUInt16(table, 18, 1);
- indexfmt = GetInt16(table, 50, 1);
+ int indexfmt = GetInt16(table, 50, 1);
if( ((indexfmt != 0) && (indexfmt != 1)) || (t->unitsPerEm <= 0) ) {
CloseTTFont(t);
commit 45deaff92ab812f944637ab2f442b27e7b182492
Author: Caolán McNamara <caolanm at redhat.com>
Date: Wed Feb 7 16:44:43 2018 +0000
check O_hhea and O_vhea sizes
Change-Id: I82e47732815f0112801c8c3a3e5b0b09ac25610a
Reviewed-on: https://gerrit.libreoffice.org/49439
Reviewed-by: Michael Stahl <mstahl at redhat.com>
Tested-by: Jenkins <ci at libreoffice.org>
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index d97be8071272..b34037ebdba1 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1548,8 +1548,10 @@ int OpenTTFontBuffer(const void* pBuffer, sal_uInt32 nLen, sal_uInt32 facenum, T
static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
{
- if (t->fsize < 4)
+ if (t->fsize < 4) {
+ CloseTTFont(t);
return SF_TTFORMAT;
+ }
int i;
sal_uInt32 length, tag;
sal_uInt32 tdoffset = 0; /* offset to TableDirectory in a TTC file. For TTF files is 0 */
@@ -1730,10 +1732,12 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
}
table = getTable(t, O_hhea);
- t->numberOfHMetrics = (table != nullptr) ? GetUInt16(table, 34, 1) : 0;
+ table_size = getTableSize(t, O_hhea);
+ t->numberOfHMetrics = (table && table_size >= 36) ? GetUInt16(table, 34, 1) : 0;
table = getTable(t, O_vhea);
- t->numOfLongVerMetrics = (table != nullptr) ? GetUInt16(table, 34, 1) : 0;
+ table_size = getTableSize(t, O_vhea);
+ t->numOfLongVerMetrics = (table && table_size >= 36) ? GetUInt16(table, 34, 1) : 0;
GetNames(t);
FindCmap(t);
commit 7c764ca83bfcc0f46048f45de2d47bfea0bb46e5
Author: Caolán McNamara <caolanm at redhat.com>
Date: Wed Feb 7 15:33:36 2018 +0000
check table size before reading nglyphs
Change-Id: Ib511fdf16006877ca76085137eb9200601b2f8f7
Reviewed-on: https://gerrit.libreoffice.org/49363
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit 08dd51bfcaa6b493e134bcc7787cc18c36ad5db1)
Reviewed-on: https://gerrit.libreoffice.org/49436
Reviewed-by: Michael Stahl <mstahl at redhat.com>
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 0e0978b779c0..d97be8071272 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1693,7 +1693,8 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
}
const sal_uInt8* table = getTable(t, O_maxp);
- t->nglyphs = GetUInt16(table, 4, 1);
+ sal_uInt32 table_size = getTableSize(t, O_maxp);
+ t->nglyphs = table_size >= 6 ? GetUInt16(table, 4, 1) : 0;
table = getTable(t, O_head);
t->unitsPerEm = GetUInt16(table, 18, 1);
commit 61a36e172e0ebdfdc6efae4c5be49b7e2a3f3886
Author: Caolán McNamara <caolanm at redhat.com>
Date: Wed Feb 7 16:20:54 2018 +0000
return early on short stream
Change-Id: Ia9cb4dec5358281322a2428c5f2153836a1ee1af
Reviewed-on: https://gerrit.libreoffice.org/49375
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <mstahl at redhat.com>
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index cc4893216d3d..0e0978b779c0 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1548,6 +1548,8 @@ int OpenTTFontBuffer(const void* pBuffer, sal_uInt32 nLen, sal_uInt32 facenum, T
static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
{
+ if (t->fsize < 4)
+ return SF_TTFORMAT;
int i;
sal_uInt32 length, tag;
sal_uInt32 tdoffset = 0; /* offset to TableDirectory in a TTC file. For TTF files is 0 */
commit 777927c46b2d0d16e554cbeadbae8223ba27e6c3
Author: Caolán McNamara <caolanm at redhat.com>
Date: Wed Feb 7 16:05:08 2018 +0000
stay within font bounds
Change-Id: Ie8ed610b71cb1b20963827c2be97155d2d8aa22c
Reviewed-on: https://gerrit.libreoffice.org/49371
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <mstahl at redhat.com>
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index dfe66eb5d58c..cc4893216d3d 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1590,7 +1590,12 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
/* parse the tables */
for (i=0; i<(int)t->ntables; i++) {
int nIndex;
- tag = GetUInt32(t->ptr + tdoffset + 12, 16 * i, 1);
+ const sal_uInt32 nStart = tdoffset + 12;
+ const sal_uInt32 nOffset = 16 * i;
+ if (nStart + nOffset + sizeof(sal_uInt32) <= static_cast<sal_uInt32>(t->fsize))
+ tag = GetUInt32(t->ptr + nStart, nOffset, 1);
+ else
+ tag = static_cast<sal_uInt32>(-1);
switch( tag ) {
case T_maxp: nIndex = O_maxp; break;
case T_glyf: nIndex = O_glyf; break;
commit d50431b28e5bd5cda4d4a410eb80f9d9becb278e
Author: Caolán McNamara <caolanm at redhat.com>
Date: Wed Feb 7 16:51:32 2018 +0000
what matters is the availability of the last element, not the first
Change-Id: I23d3abdbe62b735d66261fb337613da88cc4206b
Reviewed-on: https://gerrit.libreoffice.org/49380
Reviewed-by: Michael Stahl <mstahl at redhat.com>
Tested-by: Michael Stahl <mstahl at redhat.com>
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 3378b35344e8..dfe66eb5d58c 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -2553,7 +2553,8 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, TTGlobalFontInfo *info)
info->symbolEncoded = (ttf->cmapType == CMAP_MS_Symbol);
const sal_uInt8* table = getTable(ttf, O_OS2);
- if (table) {
+ sal_uInt32 table_size = getTableSize(ttf, O_OS2);
+ if (table && table_size >= 42) {
info->weight = GetUInt16(table, 4, 1);
info->width = GetUInt16(table, 6, 1);
@@ -2561,12 +2562,13 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, TTGlobalFontInfo *info)
* Microsoft old (78 bytes long) and Microsoft new (86 bytes long,)
* Apple's documentation recommends looking at the table length.
*/
- if (getTableSize(ttf, O_OS2) > 68) {
+ if (table_size >= 78) {
info->typoAscender = XUnits(UPEm,GetInt16(table, 68, 1));
info->typoDescender = XUnits(UPEm, GetInt16(table, 70, 1));
info->typoLineGap = XUnits(UPEm, GetInt16(table, 72, 1));
info->winAscent = XUnits(UPEm, GetUInt16(table, 74, 1));
info->winDescent = XUnits(UPEm, GetUInt16(table, 76, 1));
+
/* sanity check; some fonts treat winDescent as signed
* violating the standard */
if( info->winDescent > 5*UPEm )
commit 54e8adbaaaaca4a34ed2bf42895d2f2491e699f8
Author: Caolán McNamara <caolanm at redhat.com>
Date: Wed Feb 7 16:57:27 2018 +0000
check kern table size
Change-Id: I65b5f0a8950d54c00d6fd7c385ca1c5dca2ef2c8
Reviewed-on: https://gerrit.libreoffice.org/49384
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <mstahl at redhat.com>
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 0d24beaf4428..3378b35344e8 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1368,7 +1368,7 @@ static void GetKern(TrueTypeFont *ttf)
if( !table )
goto badtable;
- if (GetUInt16(table, 0, 1) == 0) { /* Traditional Microsoft style table with sal_uInt16 version and nTables fields */
+ if (nTableSize >= 4 && GetUInt16(table, 0, 1) == 0) { /* Traditional Microsoft style table with sal_uInt16 version and nTables fields */
ttf->nkern = GetUInt16(table, 2, 1);
ttf->kerntype = KT_MICROSOFT;
ptr = table + 4;
@@ -1400,7 +1400,7 @@ static void GetKern(TrueTypeFont *ttf)
return;
}
- if (GetUInt32(table, 0, 1) == 0x00010000) { /* MacOS style kern tables: fixed32 version and sal_uInt32 nTables fields */
+ if (nTableSize >= 8 && GetUInt32(table, 0, 1) == 0x00010000) { /* MacOS style kern tables: fixed32 version and sal_uInt32 nTables fields */
ttf->nkern = GetUInt32(table, 4, 1);
ttf->kerntype = KT_APPLE_NEW;
ptr = table + 8;
commit 6115d5ae1e58471e8925565b99d1c00971098103
Author: Caolán McNamara <caolanm at redhat.com>
Date: Wed Feb 7 12:29:32 2018 +0000
sanity check cmap table size
Change-Id: I010c2fd221bcd86a62efd9996a0c34930828cb6d
Reviewed-on: https://gerrit.libreoffice.org/49350
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <mstahl at redhat.com>
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 2385d2676033..0d24beaf4428 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1245,6 +1245,12 @@ static void FindCmap(TrueTypeFont *ttf)
{
const sal_uInt8* table = getTable(ttf, O_cmap);
sal_uInt32 table_size = getTableSize(ttf, O_cmap);
+ if (table_size < 4)
+ {
+ SAL_WARN("vcl.fonts", "Parsing error in " << OUString::createFromAscii(ttf->fname) <<
+ "cmap table size too short");
+ return;
+ }
sal_uInt16 ncmaps = GetUInt16(table, 2, 1);
sal_uInt32 AppleUni = 0; // Apple Unicode
sal_uInt32 ThreeZero = 0; /* MS Symbol */
commit d7e4f63c0d030f5fbdbbbe569c7e396985fce609
Author: Caolán McNamara <caolanm at redhat.com>
Date: Tue May 1 12:57:02 2018 +0100
set Referer on link mediadescriptor
to allow determining if the source document is from a trusted/untrusted
location
Reviewed-on: https://gerrit.libreoffice.org/53693
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Stephan Bergmann <sbergman at redhat.com>
(cherry picked from commit cd25a97bbadc0a5c1fd6b0e8603c8b6ebd051926)
Reviewed-on: https://gerrit.libreoffice.org/53803
Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
Reviewed-by: Mike Kaganski <mike.kaganski at collabora.com>
Tested-by: Mike Kaganski <mike.kaganski at collabora.com>
(cherry picked from commit 2d87c267267530077a94c894bc619831b01d1c04)
Conflicts:
sw/source/filter/xml/xmltexti.cxx
Change-Id: I780568652d2ef0cc8543c27ba26289277b5d9d0c
diff --git a/sw/source/filter/xml/xmltexti.cxx b/sw/source/filter/xml/xmltexti.cxx
index 710f010b1cdc..943db05c75bf 100644
--- a/sw/source/filter/xml/xmltexti.cxx
+++ b/sw/source/filter/xml/xmltexti.cxx
@@ -577,16 +577,21 @@ uno::Reference< XPropertySet > SwXMLTextImportHelper::createAndInsertOOoLink(
uno::Sequence< beans::PropertyValue > aMediaDescriptor( 1 );
aMediaDescriptor[0].Name = "URL";
aMediaDescriptor[0].Value <<= OUString( aURLObj.GetMainURL( INetURLObject::NO_DECODE ) );
- if ( pDoc->GetDocShell() && pDoc->GetDocShell()->GetMedium() )
+
+ if (SfxMedium* pMedium = pDoc->GetDocShell() ? pDoc->GetDocShell()->GetMedium() : nullptr)
{
- uno::Reference< task::XInteractionHandler > xInteraction =
- pDoc->GetDocShell()->GetMedium()->GetInteractionHandler();
+ uno::Reference< task::XInteractionHandler > xInteraction = pMedium->GetInteractionHandler();
if ( xInteraction.is() )
{
aMediaDescriptor.realloc( 2 );
aMediaDescriptor[1].Name = "InteractionHandler";
aMediaDescriptor[1].Value <<= xInteraction;
}
+
+ const auto nLen = aMediaDescriptor.getLength() + 1;
+ aMediaDescriptor.realloc(nLen);
+ aMediaDescriptor[nLen - 1].Name = "Referer";
+ aMediaDescriptor[nLen - 1].Value <<= pMedium->GetName();
}
uno::Reference < embed::XEmbeddedObject > xObj(
commit 97e72057157da0afd579730c45cc64cf0f8b660a
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Nov 27 16:29:37 2017 +0000
keep track of available data
Change-Id: Idc54cdef0f3a4355a7e26f25cdc5b50d65d9d583
Reviewed-on: https://gerrit.libreoffice.org/45354
Reviewed-by: Michael Stahl <mstahl at redhat.com>
Tested-by: Jenkins <ci at libreoffice.org>
(cherry picked from commit 35376a21e6bd3d7eede07b1e8f359f728b5c54c9)
diff --git a/package/source/zipapi/MemoryByteGrabber.hxx b/package/source/zipapi/MemoryByteGrabber.hxx
index 2beb8f5eccb7..e3326e2b9d33 100644
--- a/package/source/zipapi/MemoryByteGrabber.hxx
+++ b/package/source/zipapi/MemoryByteGrabber.hxx
@@ -39,6 +39,8 @@ public:
}
const sal_Int8 * getCurrentPos () { return mpBuffer + mnCurrent; }
+ sal_Int32 remainingSize() const { return mnEnd - mnCurrent; }
+
// XInputStream chained
void SAL_CALL skipBytes( sal_Int32 nBytesToSkip )
diff --git a/package/source/zipapi/ZipFile.cxx b/package/source/zipapi/ZipFile.cxx
index 8153aee7e0fd..037e08e2eaad 100644
--- a/package/source/zipapi/ZipFile.cxx
+++ b/package/source/zipapi/ZipFile.cxx
@@ -946,6 +946,9 @@ sal_Int32 ZipFile::readCEN()
if ( aEntry.nExtraLen < 0 )
throw ZipException("unexpected extra header info length" );
+ if (aEntry.nPathLen > aMemGrabber.remainingSize())
+ throw ZipException("name too long");
+
// read always in UTF8, some tools seem not to set UTF8 bit
aEntry.sPath = OUString::intern ( reinterpret_cast<char const *>(aMemGrabber.getCurrentPos()),
aEntry.nPathLen,
commit d58d138b03b63d34e844049cc0017f980fdc55c7
Author: Caolán McNamara <caolanm at redhat.com>
Date: Fri Feb 9 10:49:39 2018 +0000
ofz#6173 check index before use
Change-Id: I09d15ab324af0a8b3566f11868eb3266a68c4afe
Reviewed-on: https://gerrit.libreoffice.org/49500
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <mstahl at redhat.com>
(cherry picked from commit e355d7d691cfe9719b06e15129d86ec22a2bd7a4)
diff --git a/sw/source/filter/ww8/ww8toolbar.cxx b/sw/source/filter/ww8/ww8toolbar.cxx
index 056839aae6e9..abdc9458f212 100644
--- a/sw/source/filter/ww8/ww8toolbar.cxx
+++ b/sw/source/filter/ww8/ww8toolbar.cxx
@@ -166,7 +166,9 @@ bool SwCTBWrapper::Read( SvStream& rS )
std::vector< sal_Int16 >::iterator it_end = dropDownMenuIndices.end();
for ( std::vector< sal_Int16 >::iterator it = dropDownMenuIndices.begin(); it != it_end; ++it )
{
- rCustomizations[ *it ].bIsDroppedMenuTB = true;
+ if (*it < 0 || static_cast<size_t>(*it) >= rCustomizations.size())
+ continue;
+ rCustomizations[*it].bIsDroppedMenuTB = true;
}
return rS.good();
}
commit ff24333bf964d37e025410a240826c33ff41c38c
Author: Caolán McNamara <caolanm at redhat.com>
Date: Sat Jan 27 19:38:12 2018 +0000
ofz#5747 short->sal_Int32 like in StgDataStrm
Change-Id: I254c00b1142d7187beabe5d18532efec036de494
Reviewed-on: https://gerrit.libreoffice.org/48757
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <mstahl at redhat.com>
(cherry picked from commit 59cf6c6128f67d807de58fae2d7fae2b4909ad68)
diff --git a/sot/source/sdstor/stgstrms.cxx b/sot/source/sdstor/stgstrms.cxx
index 4f749486c1cc..212949d546d2 100644
--- a/sot/source/sdstor/stgstrms.cxx
+++ b/sot/source/sdstor/stgstrms.cxx
@@ -1047,7 +1047,7 @@ sal_Int32 StgSmallStrm::Read( void* pBuf, sal_Int32 n )
// small stream is likely to be < 64 KBytes.
if( ( m_nPos + n ) > m_nSize )
n = m_nSize - m_nPos;
- short nDone = 0;
+ sal_Int32 nDone = 0;
while( n )
{
short nBytes = m_nPageSize - m_nOffset;
@@ -1078,7 +1078,7 @@ sal_Int32 StgSmallStrm::Write( const void* pBuf, sal_Int32 n )
{
// you can safely assume that reads are not huge, since the
// small stream is likely to be < 64 KBytes.
- short nDone = 0;
+ sal_Int32 nDone = 0;
if( ( m_nPos + n ) > m_nSize )
{
sal_Int32 nOld = m_nPos;
commit 8e60f4d5635460a520559824ea34e1ae4e496abb
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Mar 26 12:49:54 2018 +0100
forcepoint #33 ensure payload is a EMFPPath
Change-Id: I0a9f332cc66e43caa4e1611006fa765cad063539
Reviewed-on: https://gerrit.libreoffice.org/51916
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
diff --git a/cppcanvas/source/mtfrenderer/emfplus.cxx b/cppcanvas/source/mtfrenderer/emfplus.cxx
index 4a7bf06e631a..3e041557ee96 100644
--- a/cppcanvas/source/mtfrenderer/emfplus.cxx
+++ b/cppcanvas/source/mtfrenderer/emfplus.cxx
@@ -1986,7 +1986,7 @@ namespace cppcanvas
SAL_INFO("cppcanvas.emf", "EMF+ FillPath slot: " << index);
- EMFPPath* path = static_cast<EMFPPath*>(aObjects[index]);
+ EMFPPath* path = dynamic_cast<EMFPPath*>(aObjects[index]);
if (path)
EMFPPlusFillPolygon(path->GetPolygon (*this), rFactoryParms, rState, rCanvas, flags & 0x8000, brushIndexOrColor);
else
@@ -2113,7 +2113,7 @@ namespace cppcanvas
SAL_INFO("cppcanvas.emf", "EMF+ DrawPath");
SAL_INFO("cppcanvas.emf", "EMF+\tpen: " << penIndex);
- EMFPPath* path = static_cast<EMFPPath*>( aObjects [flags & 0xff] );
+ EMFPPath* path = dynamic_cast<EMFPPath*>( aObjects [flags & 0xff] );
if (path)
EMFPPlusDrawPolygon(path->GetPolygon (*this), rFactoryParms, rState, rCanvas, penIndex);
else
commit 7d612363a3f7f89067c9c34d676a1716d393d42f
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Mar 26 13:44:31 2018 +0100
forcepoint #34 survive missing autostyles
Change-Id: I742816297659d614e836a8d5e8965b1c55154719
Reviewed-on: https://gerrit.libreoffice.org/51892
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
diff --git a/sc/source/filter/xml/xmlcelli.cxx b/sc/source/filter/xml/xmlcelli.cxx
index 4670aed7b050..3d7c2eb15a87 100644
--- a/sc/source/filter/xml/xmlcelli.cxx
+++ b/sc/source/filter/xml/xmlcelli.cxx
@@ -389,6 +389,8 @@ void ScXMLTableRowCellContext::PushFormat(sal_Int32 nBegin, sal_Int32 nEnd, cons
sal_Int32 nEntryCount = xMapper->GetEntryCount();
SvXMLStylesContext* pAutoStyles = GetImport().GetAutoStyles();
+ if (!pAutoStyles)
+ return;
// Style name for text span corresponds with the name of an automatic style.
const XMLPropStyleContext* pStyle = dynamic_cast<const XMLPropStyleContext*>(
commit 8e3ed2aa430b563f67dac91057aae111f79200f6
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Mar 26 12:59:14 2018 +0100
forcepoint #32 survive missing value range
Change-Id: I90315f0481bf73c4d9071959bf5408f4a2690257
Reviewed-on: https://gerrit.libreoffice.org/51886
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
diff --git a/sc/source/filter/excel/xichart.cxx b/sc/source/filter/excel/xichart.cxx
index adff4074cf62..1ab405d0524a 100644
--- a/sc/source/filter/excel/xichart.cxx
+++ b/sc/source/filter/excel/xichart.cxx
@@ -3363,15 +3363,19 @@ Reference< XAxis > XclImpChAxis::CreateAxis( const XclImpChTypeGroup& rTypeGroup
{
case cssc2::AxisType::CATEGORY:
case cssc2::AxisType::SERIES:
- OSL_ENSURE( mxLabelRange, "Missing Label Range" );
// #i71684# radar charts have reversed rotation direction
if (mxLabelRange)
mxLabelRange->Convert( aAxisProp, aScaleData, rTypeInfo.meTypeCateg == EXC_CHTYPECATEG_RADAR );
+ else
+ SAL_WARN("sc.filter", "missing LabelRange");
break;
case cssc2::AxisType::REALNUMBER:
case cssc2::AxisType::PERCENT:
// #i85167# pie/donut charts have reversed rotation direction (at Y axis!)
- mxValueRange->Convert( aScaleData, rTypeInfo.meTypeCateg == EXC_CHTYPECATEG_PIE );
+ if (mxValueRange)
+ mxValueRange->Convert( aScaleData, rTypeInfo.meTypeCateg == EXC_CHTYPECATEG_PIE );
+ else
+ SAL_WARN("sc.filter", "missing ValueRange");
break;
default:
OSL_FAIL( "XclImpChAxis::CreateAxis - unknown axis type" );
@@ -3420,12 +3424,18 @@ void XclImpChAxis::ConvertAxisPosition( ScfPropertySet& rPropSet, const XclImpCh
{
if( ((GetAxisType() == EXC_CHAXIS_X) && rTypeGroup.GetTypeInfo().mbCategoryAxis) || (GetAxisType() == EXC_CHAXIS_Z) )
{
- OSL_ENSURE( mxLabelRange, "Missing Label Range" );
if (mxLabelRange)
mxLabelRange->ConvertAxisPosition( rPropSet, rTypeGroup.Is3dChart() );
+ else
+ SAL_WARN("sc.filter", "missing LabelRange");
}
else
- mxValueRange->ConvertAxisPosition( rPropSet );
+ {
+ if (mxValueRange)
+ mxValueRange->ConvertAxisPosition( rPropSet );
+ else
+ SAL_WARN("sc.filter", "missing ValueRange");
+ }
}
void XclImpChAxis::ReadChAxisLine( XclImpStream& rStrm )
commit f74490d0f004668cba9b72c8444ef3a8d5183165
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Mar 26 12:50:20 2018 +0100
forcepoint #31 check validity of another group range
Change-Id: I82ff3e47a033c91581b108e1685b1ff4d5865895
Reviewed-on: https://gerrit.libreoffice.org/51883
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx
index 47a69052d660..712ca69fbe10 100644
--- a/sc/source/core/data/column3.cxx
+++ b/sc/source/core/data/column3.cxx
@@ -3024,6 +3024,8 @@ public:
{
// Previous cell is a regular cell and current cell is a group.
nRow += xCurGrp->mnLength;
+ if (xCurGrp->mnLength > std::distance(it, itEnd))
+ throw css::lang::IllegalArgumentException();
std::advance(it, xCurGrp->mnLength);
pPrev->SetCellGroup(xCurGrp);
xCurGrp->mpTopCell = pPrev;
commit 6e003a905bd69fd5955472490791cb8f17208255
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Mar 26 09:32:14 2018 +0100
forcepoint #31 survive missing control model
Change-Id: I37e4af560b46b4f6d9e0b87fe58493818f366d3c
Reviewed-on: https://gerrit.libreoffice.org/51878
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
diff --git a/oox/source/ole/vbacontrol.cxx b/oox/source/ole/vbacontrol.cxx
index 805bb2d7a504..e6f0d14b99da 100644
--- a/oox/source/ole/vbacontrol.cxx
+++ b/oox/source/ole/vbacontrol.cxx
@@ -431,7 +431,13 @@ void VbaFormControl::importStorage( StorageBase& rStrg, const AxClassTable& rCla
for ( ; it != it_end; ++it )
{
- if ( (*it)->mxCtrlModel->getControlType() == API_CONTROL_PAGE )
+ auto& elem = (*it)->mxCtrlModel;
+ if (!elem)
+ {
+ SAL_WARN("oox", "empty control model");
+ continue;
+ }
+ if (elem->getControlType() == API_CONTROL_PAGE)
{
VbaSiteModelRef xPageSiteRef = (*it)->mxSiteModel;
if ( xPageSiteRef.get() )
@@ -439,7 +445,7 @@ void VbaFormControl::importStorage( StorageBase& rStrg, const AxClassTable& rCla
}
else
{
- AxTabStripModel* pTabStrip = static_cast<AxTabStripModel*> ( (*it)->mxCtrlModel.get() );
+ AxTabStripModel* pTabStrip = static_cast<AxTabStripModel*>(elem.get());
sCaptions = pTabStrip->maItems;
pMultiPage->mnActiveTab = pTabStrip->mnListIndex;
pMultiPage->mnTabStyle = pTabStrip->mnTabStyle;
commit becf51f1c5d11cedac84670d5acf934049f2bdad
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Mar 26 12:14:23 2018 +0100
forcepoint #32 survive missing emf paths
Change-Id: Ic27c3bbac12f66b30ff2f30f558180127cc73a51
Reviewed-on: https://gerrit.libreoffice.org/51876
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
diff --git a/cppcanvas/source/mtfrenderer/emfplus.cxx b/cppcanvas/source/mtfrenderer/emfplus.cxx
index 9154f92b92bf..4a7bf06e631a 100644
--- a/cppcanvas/source/mtfrenderer/emfplus.cxx
+++ b/cppcanvas/source/mtfrenderer/emfplus.cxx
@@ -1986,7 +1986,12 @@ namespace cppcanvas
SAL_INFO("cppcanvas.emf", "EMF+ FillPath slot: " << index);
- EMFPPlusFillPolygon( static_cast<EMFPPath*>( aObjects [index])->GetPolygon (*this), rFactoryParms, rState, rCanvas, flags & 0x8000, brushIndexOrColor);
+ EMFPPath* path = static_cast<EMFPPath*>(aObjects[index]);
+ if (path)
+ EMFPPlusFillPolygon(path->GetPolygon (*this), rFactoryParms, rState, rCanvas, flags & 0x8000, brushIndexOrColor);
+ else
+ SAL_WARN("cppcanvas.emf", "EmfPlusRecordTypeFillPath missing path");
+
}
break;
case EmfPlusRecordTypeDrawEllipse:
@@ -2109,9 +2114,10 @@ namespace cppcanvas
SAL_INFO("cppcanvas.emf", "EMF+\tpen: " << penIndex);
EMFPPath* path = static_cast<EMFPPath*>( aObjects [flags & 0xff] );
- SAL_WARN_IF( !path, "cppcanvas.emf", "EmfPlusRecordTypeDrawPath missing path" );
-
- EMFPPlusDrawPolygon (path->GetPolygon (*this), rFactoryParms, rState, rCanvas, penIndex);
+ if (path)
+ EMFPPlusDrawPolygon(path->GetPolygon (*this), rFactoryParms, rState, rCanvas, penIndex);
+ else
+ SAL_WARN("cppcanvas.emf", "EmfPlusRecordTypeDrawPath missing path");
break;
}
commit eb1a13d954173da44062e18da940047fc502fe72
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Mar 26 09:23:48 2018 +0100
forcepoint #30 check validity of group range
Change-Id: Ie0611f36809b051ce46030e44c137b4e1f8d2fe0
Reviewed-on: https://gerrit.libreoffice.org/51865
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
diff --git a/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls b/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls
new file mode 100755
index 000000000000..1aca9c7f113e
Binary files /dev/null and b/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls differ
diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx
index 27abbbf249fe..47a69052d660 100644
--- a/sc/source/core/data/column3.cxx
+++ b/sc/source/core/data/column3.cxx
@@ -3000,6 +3000,8 @@ public:
xPrevGrp->mnLength += xCurGrp->mnLength;
pCur->SetCellGroup(xPrevGrp);
sc::formula_block::iterator itGrpEnd = it;
+ if (xCurGrp->mnLength > std::distance(itGrpEnd, itEnd))
+ throw css::lang::IllegalArgumentException();
std::advance(itGrpEnd, xCurGrp->mnLength);
for (++it; it != itGrpEnd; ++it)
{
commit aefd8752c18c48d3a783ee9e605d776d82551b3d
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Mar 26 08:57:09 2018 +0100
forcepoint #29 detect illegal self series add
Change-Id: I3bba0f942780c54951a3a810c05cc3b56ca18a5e
Reviewed-on: https://gerrit.libreoffice.org/51862
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
diff --git a/sc/qa/unit/data/xls/pass/forcepoint-selfseriesadd.xls b/sc/qa/unit/data/xls/pass/forcepoint-selfseriesadd.xls
new file mode 100755
index 000000000000..e5eafd262520
Binary files /dev/null and b/sc/qa/unit/data/xls/pass/forcepoint-selfseriesadd.xls differ
diff --git a/sc/source/filter/excel/xichart.cxx b/sc/source/filter/excel/xichart.cxx
index 09bd891da9c5..adff4074cf62 100644
--- a/sc/source/filter/excel/xichart.cxx
+++ b/sc/source/filter/excel/xichart.cxx
@@ -1873,6 +1873,11 @@ void XclImpChSeries::SetDataLabel( const XclImpChTextRef& xLabel )
void XclImpChSeries::AddChildSeries( const XclImpChSeries& rSeries )
{
OSL_ENSURE( !HasParentSeries(), "XclImpChSeries::AddChildSeries - not allowed for child series" );
+ if (&rSeries == this)
+ {
+ SAL_WARN("sc.filter", "self add attempt");
+ return;
+ }
/* In Excel, trend lines and error bars are stored as own series. In Calc,
these are properties of the parent series. This function adds the
commit 6da3d300eeb4b94320d2bb5e1558f35f152b35ff
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Mar 26 08:45:21 2018 +0100
forcepoint #28 missing cell on abw import
Change-Id: I7633a17afab5aa2eb9e47a552bd5d92c87d383c7
Reviewed-on: https://gerrit.libreoffice.org/51853
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
diff --git a/sw/source/filter/xml/xmltbli.cxx b/sw/source/filter/xml/xmltbli.cxx
index d8f0d8d7ae60..8669290fa20b 100644
--- a/sw/source/filter/xml/xmltbli.cxx
+++ b/sw/source/filter/xml/xmltbli.cxx
@@ -19,6 +19,7 @@
#include "hintids.hxx"
+#include <com/sun/star/lang/IndexOutOfBoundsException.hpp>
#include <com/sun/star/lang/XMultiServiceFactory.hpp>
#include <com/sun/star/text/XTextTable.hpp>
#include <com/sun/star/table/XCellRange.hpp>
@@ -1658,8 +1659,10 @@ void SwXMLTableContext::InsertCell( const OUString& rStyleName,
for( sal_uInt32 j=nRowSpan; j>0UL; --j )
{
const bool bCovered = i != nColSpan || j != nRowSpan;
- GetCell( nRowsReq-j, nColsReq-i )
- ->Set( sStyleName, j, i, pStartNode,
+ SwXMLTableCell_Impl *pCell = GetCell( nRowsReq-j, nColsReq-i );
+ if (!pCell)
+ throw css::lang::IndexOutOfBoundsException();
+ pCell->Set( sStyleName, j, i, pStartNode,
pTable, bProtect, pFormula, bHasValue, bCovered, fValue,
pStringValue, i_rXmlId );
}
commit 181202b4c052f646f3665dd7d12e83cb240ea95c
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Mar 26 14:06:34 2018 +0100
forcepoint #35 handle odd number of dimension fragments
Change-Id: I97e4e1b38d80276077b3427c90ae33023afb5e59
Reviewed-on: https://gerrit.libreoffice.org/51901
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
diff --git a/xmloff/source/draw/ximpcustomshape.cxx b/xmloff/source/draw/ximpcustomshape.cxx
index 9f482d98092e..0fcff9160672 100644
--- a/xmloff/source/draw/ximpcustomshape.cxx
+++ b/xmloff/source/draw/ximpcustomshape.cxx
@@ -481,7 +481,7 @@ void GetSizeSequence( std::vector< css::beans::PropertyValue >& rDest,
if ( !vNum.empty() )
{
- uno::Sequence< awt::Size > aSizeSeq( vNum.size() / 2 );
+ uno::Sequence< awt::Size > aSizeSeq((vNum.size() + 1) / 2);
std::vector< sal_Int32 >::const_iterator aIter = vNum.begin();
std::vector< sal_Int32 >::const_iterator aEnd = vNum.end();
awt::Size* pValues = aSizeSeq.getArray();
commit 6f7c3c91d82ab1003b99d3bd2ae5838bd01d8487
Author: Caolán McNamara <caolanm at redhat.com>
Date: Thu Mar 29 17:42:12 2018 +0100
forcepoint#36 avoid dangling SvTextShapeImportHelper in case of exceptions
Change-Id: Ibdbc047029c31d2b06d2349d68e1cbd9b15fd514
Reviewed-on: https://gerrit.libreoffice.org/52137
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
diff --git a/sw/qa/core/data/odt/fail/forcepoint-dtor-1.odt b/sw/qa/core/data/odt/fail/forcepoint-dtor-1.odt
new file mode 100755
index 000000000000..6442200cdeda
Binary files /dev/null and b/sw/qa/core/data/odt/fail/forcepoint-dtor-1.odt differ
diff --git a/sw/source/filter/xml/xmlimp.cxx b/sw/source/filter/xml/xmlimp.cxx
index 8ee58ceb6bfc..e056f1078047 100644
--- a/sw/source/filter/xml/xmlimp.cxx
+++ b/sw/source/filter/xml/xmlimp.cxx
@@ -420,6 +420,11 @@ SwXMLImport::SwXMLImport(
SwXMLImport::~SwXMLImport() throw ()
{
+ if (HasShapeImport())
+ {
+ SAL_WARN("sw", "endDocument skipped, dropping shapes now to avoid dangling SvTextShapeImportHelper pointing to this");
+ ClearShapeImport();
+ }
delete m_pDocElemTokenMap;
delete m_pTableElemTokenMap;
delete m_pTableCellAttrTokenMap;
commit dba936eb93360609dda9d31de88b7b612613b641
Author: Caolán McNamara <caolanm at redhat.com>
Date: Mon Mar 12 10:24:55 2018 +0000
forcepoint #24 back() on empty vector
Thanks to Antti Levomäki and Christian Jalio from Forcepoint.
Change-Id: Idb6723b53a1ae8aaca80847bfe643bc4abaedd21
Reviewed-on: https://gerrit.libreoffice.org/51123
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <mstahl at redhat.com>
diff --git a/sw/qa/core/data/rtf/fail/forcepoint-7.rtf b/sw/qa/core/data/rtf/fail/forcepoint-7.rtf
new file mode 100755
index 000000000000..e5b227346108
--- /dev/null
+++ b/sw/qa/core/data/rtf/fail/forcepoint-7.rtf
@@ -0,0 +1,517 @@
+{\rtf1\ânsi\ansicpg1252\deflang3081\ftnbj\uc1\deff0
+{\fonttbl{\f0 \fswiss \fcharset1 Arial;}{\f1 \froman \fcharset2 Times New Roman;}{\f2 \froman \fcharset2 Symbol;}{\f3 \fswiss \fcharset0 Times New Roman;}{\f4 \fswiss \fcharset2 Symbol;}{\f5 \froman \fcharset0 Arial;}{\f6 \fswiss \fcharset0 Lucida Sans;}{\f7 \fswiss \fcharset0 Arial;}{\f8 \fswiss \fcharset1 Wingdings;}}
+{\colortbl ;\red0\green0\blue0 ;\red255\green255\blue255 ;\red255\green255\blue128 ;\red0\green64\blue128 ;\red0\green0\blue255 ;\red0\green0\blue160 ;}
+{\stylesheet{\f0\fs20\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Normal;}{\cs1\f0\fs24\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0 Default Paragraph Font;}{\cs2\f6\fs16\b\protect\cf1\cb3\chcbpat3\expnd0\expndtw0\charscalex100\dn0 SSBookmark;}{\s3\snext0\outlinelevel0\f0\fs32\b\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel0 Heading 1;}{\s4\snext0\outlinelevel1\f0\fs24\b\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel1 Heading 2;}{\s5\snext0\outlinelevel2\f0\fs24\b\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel2 Heading 3
+;}{\s6\snext0\outlinelevel3\f0\fs24\b\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel3 Heading 4;}{\s7\snext0\outlinelevel4\f0\fs24\b\i\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel4 Heading 5;}{\s8\snext0\outlinelevel5\f0\fs20\b\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel5 Heading 6;}{\s9\snext0\outlinelevel6\f0\fs24\cf4\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel6 Heading 7;}{\s10\snext0\outlinelevel7\f0\fs24\i\cf4\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel7 Heading 8
+;}{\s11\snext0\outlinelevel8\f0\fs22\cf4\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel8 Heading 9;}{\s12\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 TOC 1;}{\s13\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li180\ri0\sb0\sa0\sl0\shading0 TOC 2;}{\s14\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li360\ri0\sb0\sa0\sl0\shading0 TOC 3;}{\s15\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li540\ri0\sb0\sa0\sl0\shading0 TOC 4;}{\s16\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li720\ri0\sb0\sa0\sl0\shading0 TOC 5
+;}{\s17\snext0\f0\fs24\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li900\ri0\sb0\sa0\sl0\shading0 TOC 6;}{\s18\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li1080\ri0\sb0\sa0\sl0\shading0 TOC 7;}{\s19\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li1260\ri0\sb0\sa0\sl0\shading0 TOC 8;}{\s20\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li1440\ri0\sb0\sa0\sl0\shading0 TOC 9;}{\s21\snext0\f0\fs32\b\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb240\sa60\sl0\shading0\qc Title;}{\s22\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi-360\li360\ri0\sb0\sa0\sl0\shading0 Numbered List
+;}{\s23\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi-360\li360\ri0\sb0\sa0\sl0\shading0 Bulleted List;}{\s24\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa120\sl0\shading0 Body Text;}{\s25\snext0\f0\fs18\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa120\sl0\sl480\slmult1\shading0 Body Text 2;}{\s26\snext0\f0\fs16\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa120\sl0\shading0 Body Text 3;}{\s27\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Note Heading;}{\s28\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Plain Text
+;}{\s29\snext0\f0\fs20\b\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Strong;}{\s30\snext0\f0\fs20\i\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Emphasis;}{\s31\snext0\f0\fs20\ul\cf5\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Hyperlink;}{\s32\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Footer;}{\s33\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Header;}{\s34\snext0\f0\fs18\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Code
+;}{\cs35\f0\fs20\i\cf4\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0 Field Label;}{\cs36\f0\fs22\b\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0 Table Heading;}{\cs37\f0\fs20\b\ul\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0 Object type;}{\s38\snext0\f0\fs20\b\i\cf6\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 List Header;}{\s39\snext24\f0\fs20\i\cf5\fi0\li0\ri0\sb0\sa120\sl240 InfoBlue;}}
+{\*\revtbl{Unknown;}}
+{\*\listtable
+{\list\listtemplateid1
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}}
+{\listname List1;}\listid1
+}
+{\list\listtemplateid2
+{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}}
+{\listname List2;}\listid2
+}
+{\list\listtemplateid3
+{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f1\fs24}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}}
+{\listname List3;}\listid3
+}
+{\list\listtemplateid4
+{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f1\fs24}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}}
+{\listname List4;}\listid4
+}
+{\list\listtemplateid5
+{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2\fs24}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}}
+{\listname List5;}\listid5
+}
+{\list\listtemplateid6
+{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2\fs24}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}}
+{\listname List6;}\listid6
+}
+{\list\listtemplateid7
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}\f3\fs24}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}}
+{\listname List7;}\listid7
+}
+{\list\listtemplateid8
+{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2\fs24}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}}
+{\listname List8;}\listid8
+}
+{\list\listtemplateid9
+{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2\fs24}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}}
+{\listname List9;}\listid9
+}
+{\list\listtemplateid10
+{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2\fs24}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}}
+{\listname List10;}\listid10
+}
+{\list\listtemplateid11
+{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2\fs24}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}}
+{\listname List11;}\listid11
+}
+{\list\listtemplateid12
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}\b}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}}
+{\listname List477861859_1;}\listid477861859
+}
+{\list\listtemplateid13
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}\b}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}}
+{\listname List735301812_1;}\listid735301812
+}
+{\list\listtemplateid14
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}\b}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}}
+{\listname List735310515_1;}\listid735310515
+}
+{\list\listtemplateid15
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}\b}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}}
+{\listname List735674015_1;}\listid735674015
+}
+{\list\listtemplateid16
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}}
+{\listname List366130062_1;}\listid735674016
+}
+{\list\listtemplateid17
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}}
+{\listname List366148531_1;}\listid735674017
+}
+{\list\listtemplateid18
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'03\'05\'07\'09\'b\'d\'f\'11}}
+{\listname List366155203_1;}\listid735674018
+}
+{\list\listtemplateid19
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}}
+{\listname ;}\listid735674019
+}
+{\list\listtemplateid20
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}\b}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}}
+{\listname List434687953_1;}\listid735674020
+}
+{\list\listtemplateid21
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}}
+{\listname List435828312_1;}\listid735674021
+}
+{\list\listtemplateid22
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}ô {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}}
+{\listname List435835406_1;}\listid735674022
+}
+{\list\listtemplateid23
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}}
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}}
+{\listname List435856328_1;}\listid735674023
+}
+{\list\listtemplateid24
+{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}}
... etc. - the rest is truncated
More information about the Libreoffice-commits
mailing list