[Libreoffice-commits] core.git: Branch 'distro/lhm/libreoffice-5-2+backports' - 123 commits - basic/source cppcanvas/source drawinglayer/source editeng/source filter/source hwpfilter/source include/oox include/xmloff lotuswordpro/source oox/source package/source sal/textenc sax/source sc/inc sc/qa sc/source sd/source starmath/source svl/source svx/source sw/inc sw/qa sw/source vcl/headless vcl/inc vcl/source vcl/win writerfilter/source xmloff/source xmlsecurity/source
Caolán McNamara (via logerrit)
logerrit at kemper.freedesktop.org
Mon Aug 5 15:38:12 UTC 2019
basic/source/comp/scanner.cxx | 2
cppcanvas/source/mtfrenderer/emfplus.cxx | 5
drawinglayer/source/texture/texture3d.cxx | 11
editeng/source/editeng/impedit2.cxx | 9
filter/source/graphicfilter/icgm/class4.cxx | 6
filter/source/graphicfilter/idxf/dxftblrd.cxx | 9
filter/source/graphicfilter/ieps/ieps.cxx | 8
filter/source/graphicfilter/itiff/itiff.cxx | 2
filter/source/msfilter/msdffimp.cxx | 59
filter/source/msfilter/svdfppt.cxx | 28
filter/source/xsltfilter/OleHandler.cxx | 2
hwpfilter/source/drawing.h | 2
hwpfilter/source/hiodev.cxx | 3
hwpfilter/source/hwpread.cxx | 7
include/oox/vml/vmlshapecontainer.hxx | 8
include/oox/vml/vmlshapecontext.hxx | 9
include/xmloff/xmltoken.hxx | 2
lotuswordpro/source/filter/lwpfrib.cxx | 2
lotuswordpro/source/filter/lwpsilverbullet.hxx | 4
oox/source/crypto/AgileEngine.cxx | 2
oox/source/crypto/CryptTools.cxx | 2
oox/source/drawingml/fillproperties.cxx | 2
oox/source/drawingml/shapecontext.cxx | 4
oox/source/drawingml/table/tableproperties.cxx | 6
oox/source/drawingml/textbody.cxx | 3
oox/source/shape/WpsContext.cxx | 13
oox/source/vml/vmlformatting.cxx | 22
oox/source/vml/vmlshape.cxx | 3
oox/source/vml/vmlshapecontainer.cxx | 4
oox/source/vml/vmlshapecontext.cxx | 30
package/source/zipapi/ZipFile.cxx | 8
sal/textenc/tcvtkr6.tab | 12
sax/source/expatwrap/xml2utf.cxx | 8
sc/inc/dbdata.hxx | 9
sc/qa/unit/data/slk/pass/numfmt-2.slk | 1
sc/qa/unit/data/slk/pass/numfmt.slk | 2
sc/qa/unit/data/xls/forcepoint-pivot-1.xls |binary
sc/qa/unit/ucalc_sharedformula.cxx | 4
sc/source/core/data/column3.cxx | 2
sc/source/core/data/document.cxx | 2
sc/source/core/data/dptabres.cxx | 8
sc/source/core/tool/compiler.cxx | 8
sc/source/filter/excel/xipivot.cxx | 8
sc/source/filter/inc/formel.hxx | 30
sc/source/filter/rtf/eeimpars.cxx | 2
sc/source/filter/rtf/rtfparse.cxx | 2
sc/source/filter/xml/XMLTableShapeImportHelper.cxx | 2
sc/source/filter/xml/xmldrani.cxx | 5
sc/source/ui/docshell/dbdocfun.cxx | 1
sc/source/ui/docshell/impex.cxx | 34
sd/source/filter/ppt/pptin.cxx | 2
starmath/source/mathmlimport.cxx | 17
starmath/source/mathtype.cxx | 4
svl/source/numbers/zformat.cxx | 4
svl/source/numbers/zforscan.cxx | 4
svx/source/svdraw/svdopath.cxx | 3
svx/source/unodraw/unoshape.cxx | 3
sw/inc/anchoredobject.hxx | 1
sw/inc/docary.hxx | 8
sw/qa/core/data/odt/pass/tdf112017.odt |binary
sw/qa/core/data/odt/pass/tdf112101.odt |binary
sw/qa/core/data/rtf/fail/forcepoint-4.rtf | 1779 +++++++++++++++
sw/qa/core/data/ww8/fail/forcepoint-44.doc |binary
sw/qa/core/data/ww8/indeterminate/ofz7322-1.doc |binary
sw/qa/core/data/ww8/pass/forcepoint-layout-1.doc |binary
sw/qa/extras/odfexport/data/sender-initials.fodt | 71
sw/qa/extras/odfexport/odfexport.cxx | 20
sw/qa/extras/uiwriter/data/tdf114536.odt |binary
sw/qa/extras/uiwriter/uiwriter.cxx | 45
sw/source/core/doc/DocumentContentOperationsManager.cxx | 2
sw/source/core/doc/DocumentRedlineManager.cxx | 49
sw/source/core/doc/docbm.cxx | 9
sw/source/core/doc/docredln.cxx | 6
sw/source/core/inc/frame.hxx | 2
sw/source/core/inc/ftnfrm.hxx | 1
sw/source/core/inc/layouter.hxx | 4
sw/source/core/layout/anchoredobject.cxx | 9
sw/source/core/layout/calcmove.cxx | 1
sw/source/core/layout/flowfrm.cxx | 18
sw/source/core/layout/fly.cxx | 3
sw/source/core/layout/frmtool.cxx | 7
sw/source/core/layout/ftnfrm.cxx | 29
sw/source/core/layout/layouter.cxx | 15
sw/source/core/layout/newfrm.cxx | 24
sw/source/core/layout/objectformattertxtfrm.cxx | 27
sw/source/core/layout/objstmpconsiderwrapinfl.cxx | 27
sw/source/core/layout/objstmpconsiderwrapinfl.hxx | 1
sw/source/core/layout/pagechg.cxx | 2
sw/source/core/layout/ssfrm.cxx | 5
sw/source/core/layout/tabfrm.cxx | 5
sw/source/core/layout/trvlfrm.cxx | 8
sw/source/core/text/frmform.cxx | 15
sw/source/core/text/itrform2.cxx | 13
sw/source/core/unocore/unostyle.cxx | 3
sw/source/filter/html/htmlctxt.cxx | 1
sw/source/filter/ww8/ww8graf.cxx | 15
sw/source/filter/ww8/ww8par.cxx | 41
sw/source/filter/ww8/ww8par.hxx | 16
sw/source/filter/ww8/ww8par2.cxx | 39
sw/source/filter/ww8/ww8par3.cxx | 8
sw/source/filter/ww8/ww8par4.cxx | 4
sw/source/filter/ww8/ww8par5.cxx | 9
sw/source/filter/ww8/ww8par6.cxx | 31
sw/source/filter/ww8/ww8scan.cxx | 63
sw/source/filter/ww8/ww8scan.hxx | 11
vcl/headless/svpgdi.cxx | 15
vcl/inc/regionband.hxx | 3
vcl/source/gdi/pngread.cxx | 8
vcl/source/gdi/region.cxx | 8
vcl/source/gdi/regionband.cxx | 27
vcl/win/gdi/salfont.cxx | 6
writerfilter/source/dmapper/DomainMapperTableHandler.cxx | 7
writerfilter/source/dmapper/DomainMapper_Impl.cxx | 28
writerfilter/source/dmapper/PropertyMap.cxx | 12
writerfilter/source/ooxml/OOXMLDocumentImpl.cxx | 6
writerfilter/source/ooxml/OOXMLStreamImpl.cxx | 20
writerfilter/source/rtftok/rtfsdrimport.cxx | 2
xmloff/source/core/xmlexp.cxx | 2
xmloff/source/core/xmltoken.cxx | 2
xmloff/source/draw/XMLNumberStyles.cxx | 5
xmloff/source/draw/ximppage.cxx | 6
xmloff/source/text/txtflde.cxx | 1
xmloff/source/text/txtfldi.cxx | 10
xmloff/source/text/txtimp.cxx | 1
xmloff/source/text/txtparai.cxx | 5
xmlsecurity/source/helper/xmlsignaturehelper.cxx | 30
126 files changed, 2734 insertions(+), 371 deletions(-)
New commits:
commit 2cd3d0bc6e8644b14b8f022d66f430e4dacf805f
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Sep 3 17:20:21 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:49 2019 +0200
ofz#10198 reset uncommitted fly stuff & pams before applying redlining
Change-Id: I2a2587ec4590926f7cffc2a4d58a22d9d5f19c99
Reviewed-on: https://gerrit.libreoffice.org/59947
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
Tested-by: Jenkins
(cherry picked from commit 887ee9111f42847406c5ffc85a0ba635080de3de)
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index b8bc89d44274..aa5f49804d72 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -5417,6 +5417,9 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss)
UpdateFields();
+ DELETEZ(m_pWFlyPara);
+ DELETEZ(m_pSFlyPara);
+
// delete the pam before the call for hide all redlines (Bug 73683)
if (m_bNewDoc)
m_rDoc.getIDocumentRedlineAccess().SetRedlineMode((RedlineMode_t)( eMode ));
commit 3feff0f0f5796d7b7a70441fdd91302ba4bc5b98
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 15 10:27:22 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:49 2019 +0200
ofz#9908 validate no negative editengine selection positions
Change-Id: I37dace2051518224c55756362facd3edba4a9571
Reviewed-on: https://gerrit.libreoffice.org/59059
Tested-by: Jenkins
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
(cherry picked from commit ca3038a05188084b012dd3c799494f30bc5c47ef)
diff --git a/sw/source/filter/ww8/ww8graf.cxx b/sw/source/filter/ww8/ww8graf.cxx
index 7fe4fd5c612b..960e11a9ea02 100644
--- a/sw/source/filter/ww8/ww8graf.cxx
+++ b/sw/source/filter/ww8/ww8graf.cxx
@@ -568,7 +568,9 @@ namespace
bool IsValidSel(const EditEngine& rEngine, const ESelection& rSel)
{
const auto nParaCount = rEngine.GetParagraphCount();
- return rSel.nStartPara < nParaCount && rSel.nEndPara < nParaCount;
+ if (rSel.nStartPara < nParaCount && rSel.nEndPara < nParaCount)
+ return rSel.nStartPos >= 0 && rSel.nEndPos >= 0;
+ return false;
}
}
commit 4acac2672081af28c4419ef793f6416bd71fcf6e
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Dec 30 13:57:38 2017 +0000
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:49 2019 +0200
ofz#4837 Null-dereference READ
Change-Id: I7e4cb934aeac32fa1170beb116e4600b5eb9389a
Reviewed-on: https://gerrit.libreoffice.org/47197
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit 9f8dd17b1e6ab5d5d07b61e0f85edea233f03d71)
diff --git a/sw/source/filter/ww8/ww8graf.cxx b/sw/source/filter/ww8/ww8graf.cxx
index 0094fad04510..7fe4fd5c612b 100644
--- a/sw/source/filter/ww8/ww8graf.cxx
+++ b/sw/source/filter/ww8/ww8graf.cxx
@@ -563,6 +563,15 @@ public:
}
};
+namespace
+{
+ bool IsValidSel(const EditEngine& rEngine, const ESelection& rSel)
+ {
+ const auto nParaCount = rEngine.GetParagraphCount();
+ return rSel.nStartPara < nParaCount && rSel.nEndPara < nParaCount;
+ }
+}
+
// InsertAttrsAsDrawingAttrs() setzt zwischen StartCp und EndCp die Attribute.
// Dabei werden Style-Attribute als harte Attribute, Absatz- und Zeichen-
// attribute gesetzt.
@@ -738,6 +747,8 @@ void SwWW8ImplReader::InsertAttrsAsDrawingAttrs(long nStartCp, long nEndCp,
{
ESelection aSel(GetESelection(*m_pDrawEditEngine, aIter->GetStartPos()-nStartCp,
aIter->GetEndPos()-nStartCp));
+ if (!IsValidSel(*m_pDrawEditEngine, aSel))
+ continue;
OUString aString(m_pDrawEditEngine->GetText(aSel));
const sal_Int32 nOrigLen = aString.getLength();
long nDummy(0);
commit 811386b3f4d290b9ce7b33ae560ee209fd2f1ca5
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 21:34:20 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:49 2019 +0200
forcepoint#67 detect cairo surface creation failure
if e.g. too large
Change-Id: I7de8748a5ed695c1b3ddc8c1358414f3acd68c94
Reviewed-on: https://gerrit.libreoffice.org/58454
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 36bee88834f90818c5475b460c729186ef6c9229)
diff --git a/vcl/headless/svpgdi.cxx b/vcl/headless/svpgdi.cxx
index c0b8c699dc68..c2c7f7fc6ecb 100644
--- a/vcl/headless/svpgdi.cxx
+++ b/vcl/headless/svpgdi.cxx
@@ -1251,6 +1251,11 @@ void SvpSalGraphics::drawMask( const SalTwoRect& rTR,
/** creates an image from the given rectangle, replacing all black pixels
* with nMaskColor and make all other full transparent */
SourceHelper aSurface(rSalBitmap);
+ if (!aSurface.getSurface())
+ {
+ SAL_WARN("vcl.gdi", "unsupported SvpSalGraphics::drawMask case");
+ return;
+ }
cairo_surface_t* mask = aSurface.getSurface();
cairo_surface_flush(mask);
@@ -1474,6 +1479,11 @@ cairo_surface_t* SvpSalGraphics::createCairoSurface(const BitmapBuffer *pBuffer)
nFormat,
pBuffer->mnWidth, pBuffer->mnHeight,
pBuffer->mnScanlineSize);
+ if (cairo_surface_status(target) != CAIRO_STATUS_SUCCESS)
+ {
+ cairo_surface_destroy(target);
+ return nullptr;
+ }
return target;
}
commit 080424b88118855ae2be7606fce0aa1775b79c5e
Author: Michael Stahl <Michael.Stahl at cib.de>
AuthorDate: Thu Jul 18 14:07:06 2019 +0200
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:49 2019 +0200
sw: fix use after free on tdf117215-1.odt
Move the fix from 6d0ea082889c89eb8b408779f2de08da7441ff54 to
SwFlyFrame::DestroyImpl() so we unregister every SwFlyFrame.
==1550==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000383f56 at pc 0x7efcd70d5ab9 bp 0x7ffeb7ac7c40 sp 0x7ffeb7ac7c38
WRITE of size 1 at 0x615000383f56 thread T0
0 SwAnchoredObject::SetTmpConsiderWrapInfluence(bool) sw/source/core/layout/anchoredobject.cxx:743:32
1 SwObjsMarkedAsTmpConsiderWrapInfluence::Clear() sw/source/core/layout/objstmpconsiderwrapinfl.cxx:53:23
2 SwLayouter::ClearObjsTmpConsiderWrapInfluence(SwDoc const&) sw/source/core/layout/layouter.cxx:387:84
3 sw::DocumentLayoutManager::ClearSwLayouterEntries() sw/source/core/doc/DocumentLayoutManager.cxx:497:5
4 sw::DocumentStateManager::SetModified() sw/source/core/doc/DocumentStateManager.cxx:45:39
5 sw::DocumentContentOperationsManager::DeleteRangeImplImpl(SwPaM&) sw/source/core/doc/DocumentContentOperationsManager.cxx:3942:36
0x615000383f56 is located 342 bytes inside of 504-byte region [0x615000383e00,0x615000383ff8)
freed by thread T0 here:
1 SwFlyAtContentFrame::~SwFlyAtContentFrame() sw/source/core/inc/flyfrms.hxx:159:7
2 SwFrame::DestroyFrame(SwFrame*) sw/source/core/layout/ssfrm.cxx:389:9
3 SwFrameFormat::DelFrames() sw/source/core/layout/atrfrm.cxx:2624:17
4 SwUndoFlyBase::DelFly(SwDoc*) sw/source/core/undo/undobj1.cxx:161:19
5 SwUndoDelLayFormat::SwUndoDelLayFormat(SwFrameFormat*) sw/source/core/undo/undobj1.cxx:403:5
6 SwHistoryTextFlyCnt::SwHistoryTextFlyCnt(SwFrameFormat*) sw/source/core/undo/rolbck.cxx:538:20
7 SwHistory::Add(SwFlyFrameFormat&, unsigned short&) sw/source/core/undo/rolbck.cxx:1083:50
8 SwUndoSaveContent::DelContentIndex(SwPosition const&, SwPosition const&, DelContentType) sw/source/core/undo/undobj.cxx:1020:39
9 SwUndoDelete::SwUndoDelete(SwPaM&, bool, bool) sw/source/core/undo/undel.cxx:229:9
11 sw::DocumentContentOperationsManager::DeleteRangeImplImpl(SwPaM&) sw/source/core/doc/DocumentContentOperationsManager.cxx:3939:55
Change-Id: Ia0c28c9d5792615cbb566e502374efd0f4056daf
Reviewed-on: https://gerrit.libreoffice.org/75857
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit dea72ef111ee8a0b1b178f8cd48757514d5ca831)
Reviewed-on: https://gerrit.libreoffice.org/75941
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit 4b9324b93dcbd72c8c8949309d45790dd8f7d5fd)
diff --git a/sw/source/core/layout/fly.cxx b/sw/source/core/layout/fly.cxx
index 3ffbcc3ab2b0..1213cbedf8c6 100644
--- a/sw/source/core/layout/fly.cxx
+++ b/sw/source/core/layout/fly.cxx
@@ -256,6 +256,8 @@ void SwFlyFrame::DestroyImpl()
if( GetFormat() && !GetFormat()->GetDoc()->IsInDtor() )
{
+ ClearTmpConsiderWrapInfluence(); // remove this from SwLayouter
+
// OD 2004-01-19 #110582#
Unchain();
diff --git a/sw/source/core/layout/ssfrm.cxx b/sw/source/core/layout/ssfrm.cxx
index 6adadd54890f..a9fd17b6ebba 100644
--- a/sw/source/core/layout/ssfrm.cxx
+++ b/sw/source/core/layout/ssfrm.cxx
@@ -471,7 +471,6 @@ void SwLayoutFrame::DestroyImpl()
const size_t nCnt = pFrame->GetDrawObjs()->size();
// #i28701#
SwAnchoredObject* pAnchoredObj = (*pFrame->GetDrawObjs())[0];
- pAnchoredObj->ClearTmpConsiderWrapInfluence();
if (SwFlyFrame* pFlyFrame = dynamic_cast<SwFlyFrame*>(pAnchoredObj))
{
SwFrame::DestroyFrame(pFlyFrame);
@@ -479,6 +478,7 @@ void SwLayoutFrame::DestroyImpl()
}
else
{
+ pAnchoredObj->ClearTmpConsiderWrapInfluence();
SdrObject* pSdrObj = pAnchoredObj->DrawObj();
SwDrawContact* pContact =
static_cast<SwDrawContact*>(pSdrObj->GetUserCall());
commit d86cf3493f12ff12163c3e61b255b38c0c7d9f2b
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Aug 9 12:32:01 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:49 2019 +0200
forcepoint73 deleted SwAnchoredObject still referenced in TmpConsiderWrapInfl
Reviewed-on: https://gerrit.libreoffice.org/58760
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit 6d0ea082889c89eb8b408779f2de08da7441ff54)
Change-Id: If255723834d049865fcf6fd0eac7768dfcbad2a1
Reviewed-on: https://gerrit.libreoffice.org/58768
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit de765158b372d5f7bbb1b37c7d6be695ab6104ac)
diff --git a/sw/inc/anchoredobject.hxx b/sw/inc/anchoredobject.hxx
index 024b55550034..9301c898385f 100644
--- a/sw/inc/anchoredobject.hxx
+++ b/sw/inc/anchoredobject.hxx
@@ -467,6 +467,7 @@ class SW_DLLPUBLIC SwAnchoredObject
// accessors to member <mbTmpConsiderWrapInfluence>
void SetTmpConsiderWrapInfluence( const bool _bTmpConsiderWrapInfluence );
bool IsTmpConsiderWrapInfluence() const { return mbTmpConsiderWrapInfluence;}
+ void ClearTmpConsiderWrapInfluence();
/** method to determine, if the anchored object is overlapping with a
previous column
diff --git a/sw/source/core/inc/layouter.hxx b/sw/source/core/inc/layouter.hxx
index 862aafef5da5..d67b44a1faff 100644
--- a/sw/source/core/inc/layouter.hxx
+++ b/sw/source/core/inc/layouter.hxx
@@ -127,6 +127,10 @@ public:
static void InsertObjForTmpConsiderWrapInfluence(
const SwDoc& _rDoc,
SwAnchoredObject& _rAnchoredObj );
+ static void RemoveObjForTmpConsiderWrapInfluence(
+ const SwDoc& _rDoc,
+ SwAnchoredObject& _rAnchoredObj );
+
// --> #i65250#
static bool MoveBwdSuppressed( const SwDoc& p_rDoc,
const SwFlowFrame& p_rFlowFrame,
diff --git a/sw/source/core/layout/anchoredobject.cxx b/sw/source/core/layout/anchoredobject.cxx
index 36d24d31a0b7..be13b3cd86f8 100644
--- a/sw/source/core/layout/anchoredobject.cxx
+++ b/sw/source/core/layout/anchoredobject.cxx
@@ -749,7 +749,14 @@ void SwAnchoredObject::SetTmpConsiderWrapInfluence( const bool _bTmpConsiderWrap
}
}
-
+void SwAnchoredObject::ClearTmpConsiderWrapInfluence()
+{
+ mbTmpConsiderWrapInfluence = false;
+ mbClearedEnvironment = false;
+ SetClearedEnvironment( false );
+ SwLayouter::RemoveObjForTmpConsiderWrapInfluence( *(GetFrameFormat().GetDoc()),
+ *this );
+}
void SwAnchoredObject::SetTmpConsiderWrapInfluenceOfOtherObjs()
{
const SwSortedObjs* pObjs = GetAnchorFrame()->GetDrawObjs();
diff --git a/sw/source/core/layout/layouter.cxx b/sw/source/core/layout/layouter.cxx
index 18efbe1ac51f..41fefd385021 100644
--- a/sw/source/core/layout/layouter.cxx
+++ b/sw/source/core/layout/layouter.cxx
@@ -402,6 +402,7 @@ void SwLayouter::ClearObjsTmpConsiderWrapInfluence( const SwDoc& _rDoc )
_rDoc.getIDocumentLayoutAccess().GetLayouter()->mpObjsTmpConsiderWrapInfl->Clear();
}
}
+
void SwLayouter::InsertObjForTmpConsiderWrapInfluence(
const SwDoc& _rDoc,
SwAnchoredObject& _rAnchoredObj )
@@ -420,6 +421,20 @@ void SwLayouter::InsertObjForTmpConsiderWrapInfluence(
_rDoc.getIDocumentLayoutAccess().GetLayouter()->mpObjsTmpConsiderWrapInfl->Insert( _rAnchoredObj );
}
+void SwLayouter::RemoveObjForTmpConsiderWrapInfluence(
+ const SwDoc& _rDoc,
+ SwAnchoredObject& _rAnchoredObj )
+{
+ if ( !_rDoc.getIDocumentLayoutAccess().GetLayouter() )
+ return;
+
+ if ( !_rDoc.getIDocumentLayoutAccess().GetLayouter()->mpObjsTmpConsiderWrapInfl )
+ return;
+
+ _rDoc.getIDocumentLayoutAccess().GetLayouter()->mpObjsTmpConsiderWrapInfl->Remove( _rAnchoredObj );
+}
+
+
void LOOPING_LOUIE_LIGHT( bool bCondition, const SwTextFrame& rTextFrame )
{
if ( bCondition )
diff --git a/sw/source/core/layout/objstmpconsiderwrapinfl.cxx b/sw/source/core/layout/objstmpconsiderwrapinfl.cxx
index 214fe5693e3b..83d1a183c3c4 100644
--- a/sw/source/core/layout/objstmpconsiderwrapinfl.cxx
+++ b/sw/source/core/layout/objstmpconsiderwrapinfl.cxx
@@ -31,23 +31,18 @@ SwObjsMarkedAsTmpConsiderWrapInfluence::~SwObjsMarkedAsTmpConsiderWrapInfluence(
void SwObjsMarkedAsTmpConsiderWrapInfluence::Insert( SwAnchoredObject& _rAnchoredObj )
{
+ auto it = std::find(maObjsTmpConsiderWrapInfl.begin(), maObjsTmpConsiderWrapInfl.end(), &_rAnchoredObj);
+ if (it != maObjsTmpConsiderWrapInfl.end())
+ return;
+ maObjsTmpConsiderWrapInfl.push_back( &_rAnchoredObj );
+}
- bool bAlreadyInserted( false );
- std::vector< SwAnchoredObject* >::const_iterator aIter = maObjsTmpConsiderWrapInfl.begin();
- for ( ; aIter != maObjsTmpConsiderWrapInfl.end(); ++aIter )
- {
- const SwAnchoredObject* pAnchoredObj = *(aIter);
- if ( pAnchoredObj == &_rAnchoredObj )
- {
- bAlreadyInserted = true;
- break;
- }
- }
-
- if ( !bAlreadyInserted )
- {
- maObjsTmpConsiderWrapInfl.push_back( &_rAnchoredObj );
- }
+void SwObjsMarkedAsTmpConsiderWrapInfluence::Remove( SwAnchoredObject& _rAnchoredObj )
+{
+ auto it = std::find(maObjsTmpConsiderWrapInfl.begin(), maObjsTmpConsiderWrapInfl.end(), &_rAnchoredObj);
+ if (it == maObjsTmpConsiderWrapInfl.end())
+ return;
+ maObjsTmpConsiderWrapInfl.erase(it);
}
void SwObjsMarkedAsTmpConsiderWrapInfluence::Clear()
diff --git a/sw/source/core/layout/objstmpconsiderwrapinfl.hxx b/sw/source/core/layout/objstmpconsiderwrapinfl.hxx
index fcf495e72a50..28b6acf9de1c 100644
--- a/sw/source/core/layout/objstmpconsiderwrapinfl.hxx
+++ b/sw/source/core/layout/objstmpconsiderwrapinfl.hxx
@@ -33,6 +33,7 @@ class SwObjsMarkedAsTmpConsiderWrapInfluence
~SwObjsMarkedAsTmpConsiderWrapInfluence();
void Insert( SwAnchoredObject& _rAnchoredObj );
+ void Remove( SwAnchoredObject& _rAnchoredObj );
void Clear();
};
diff --git a/sw/source/core/layout/ssfrm.cxx b/sw/source/core/layout/ssfrm.cxx
index 58ea1e491a8a..6adadd54890f 100644
--- a/sw/source/core/layout/ssfrm.cxx
+++ b/sw/source/core/layout/ssfrm.cxx
@@ -471,9 +471,10 @@ void SwLayoutFrame::DestroyImpl()
const size_t nCnt = pFrame->GetDrawObjs()->size();
// #i28701#
SwAnchoredObject* pAnchoredObj = (*pFrame->GetDrawObjs())[0];
- if ( dynamic_cast< const SwFlyFrame *>( pAnchoredObj ) != nullptr )
+ pAnchoredObj->ClearTmpConsiderWrapInfluence();
+ if (SwFlyFrame* pFlyFrame = dynamic_cast<SwFlyFrame*>(pAnchoredObj))
{
- SwFrame::DestroyFrame(static_cast<SwFlyFrame*>(pAnchoredObj));
+ SwFrame::DestroyFrame(pFlyFrame);
assert(!pFrame->GetDrawObjs() || nCnt > pFrame->GetDrawObjs()->size());
}
else
commit 792b5cdd1ab08419621b9b82187801b82a9bcd63
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Mar 25 12:06:20 2019 +0000
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:48 2019 +0200
Resolves: tdf#124142 don't deref nullptr
Change-Id: Ie14600e9f9a1e1c4e99c7a872f5d677453481888
Reviewed-on: https://gerrit.libreoffice.org/69666
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit ac7ce7a64ef903bad1476f5635a7b2a1e951a7a3)
Reviewed-on: https://gerrit.libreoffice.org/69694
Reviewed-by: Xisco Faulí <xiscofauli at libreoffice.org>
(cherry picked from commit cdef6e5f4053adf5413781a9282285eab3923373)
diff --git a/sw/source/core/unocore/unostyle.cxx b/sw/source/core/unocore/unostyle.cxx
index 7ec6ecbdb537..fb0ee2564e07 100644
--- a/sw/source/core/unocore/unostyle.cxx
+++ b/sw/source/core/unocore/unostyle.cxx
@@ -191,7 +191,8 @@ namespace sw
, m_pBasePool(pDocShell->GetStyleSheetPool())
, m_pDocShell(pDocShell)
{
- StartListening(*m_pBasePool);
+ if (m_pBasePool) //tdf#124142 html docs can have no styles
+ StartListening(*m_pBasePool);
}
virtual ~XStyleFamily() {};
commit ecd277318e90e3d3a431007ffd3dc135cf646a46
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Feb 6 12:09:27 2019 +0000
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:48 2019 +0200
fix assert seen on opening attachment from tdf#123163
I imagine it should have been seqPos-(idPos+2)
seems to be like this since the initial commit of
commit 091fe76b6329b4bb974987554369cbfadd8f2401
Date: Tue Jun 30 12:55:18 2015 +0300
tdf#87348 implement mso-next-textbox vml-style textbox chaining import
Change-Id: Ic2f527ede2102c01c8589d58d8c705d59b0a6ffe
Reviewed-on: https://gerrit.libreoffice.org/67454
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 45510866fedac63014a3120a1130dbea9fd803ee)
diff --git a/oox/source/vml/vmlshape.cxx b/oox/source/vml/vmlshape.cxx
index 32fe1cb8751d..40480a2b7392 100644
--- a/oox/source/vml/vmlshape.cxx
+++ b/oox/source/vml/vmlshape.cxx
@@ -345,7 +345,8 @@ Reference< XShape > ShapeBase::convertAndInsert( const Reference< XShapes >& rxS
sal_Int32 seqPos = sLinkChainName.indexOf("_s",idPos);
if (idPos < seqPos)
{
- id = sLinkChainName.copy(idPos+2,seqPos-idPos+2).toInt32();
+ auto idPosEnd = idPos+2;
+ id = sLinkChainName.copy(idPosEnd, seqPos - idPosEnd).toInt32();
seq = sLinkChainName.copy(seqPos+2).toInt32();
}
}
commit f4a3fa5392d147864b111459870ffde975efbd1d
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Feb 6 12:34:26 2019 +0000
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:48 2019 +0200
Resolves: tdf#123163 avoid null deref
one RemoveDrawObjFromPage is already null-deref protected,
do the same for the other
Change-Id: Ica5bb2df4a8dbffd8397df76b673adab75bb7aef
Reviewed-on: https://gerrit.libreoffice.org/67457
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit e6e8f02407ea781a3634fd2669ad6467e9587db4)
diff --git a/sw/source/core/layout/frmtool.cxx b/sw/source/core/layout/frmtool.cxx
index 61a9162ff5b8..aa745e6fc204 100644
--- a/sw/source/core/layout/frmtool.cxx
+++ b/sw/source/core/layout/frmtool.cxx
@@ -2397,7 +2397,8 @@ static void lcl_RemoveObjsFromPage( SwFrame* _pFrame )
{
if (pObj->GetFrameFormat().GetAnchor().GetAnchorId() != FLY_AS_CHAR)
{
- pObj->GetPageFrame()->RemoveDrawObjFromPage(
+ if (SwPageFrame *pPg = pObj->GetPageFrame())
+ pPg->RemoveDrawObjFromPage(
*(static_cast<SwAnchoredDrawObject*>(pObj)) );
}
}
@@ -2737,8 +2738,8 @@ static void lcl_Regist( SwPageFrame *pPage, const SwFrame *pAnch )
if ( pPage != pObj->GetPageFrame() )
{
// #i28701#
- if ( pObj->GetPageFrame() )
- pObj->GetPageFrame()->RemoveDrawObjFromPage( *pObj );
+ if (SwPageFrame *pPg = pObj->GetPageFrame())
+ pPg->RemoveDrawObjFromPage( *pObj );
pPage->AppendDrawObjToPage( *pObj );
}
}
commit caefe6ede9cefa7a8f523a2347474554588edd17
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Dec 5 13:22:44 2018 +0000
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:48 2019 +0200
tdf#119126 forcepoint#76 avoid deleting footnote that would delete ...
... undeletable page
(cherry picked from commit 0005b330eaed0b5559042d2597fb45e0c9125d7e)
Conflicts:
sw/qa/extras/layout/layout.cxx
Change-Id: I4622569eb9c757c6dcbdda32081ddc94e53db919
Reviewed-on: https://gerrit.libreoffice.org/66393
Tested-by: Xisco Faulí <xiscofauli at libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos at collabora.com>
(cherry picked from commit 558f01a29cb640760e73724f6efdc0a1be20c8e3)
diff --git a/sw/source/core/inc/frame.hxx b/sw/source/core/inc/frame.hxx
index 7e19619752fc..87ac5663fb12 100644
--- a/sw/source/core/inc/frame.hxx
+++ b/sw/source/core/inc/frame.hxx
@@ -709,7 +709,7 @@ public:
bool IsProtected() const;
bool IsColLocked() const { return mbColLocked; }
- bool IsDeleteForbidden() const { return mbForbidDelete; }
+ virtual bool IsDeleteForbidden() const { return mbForbidDelete; }
/// this is the only way to delete a SwFrame instance
static void DestroyFrame(SwFrame *const pFrame);
diff --git a/sw/source/core/inc/ftnfrm.hxx b/sw/source/core/inc/ftnfrm.hxx
index 2fe526dba873..3fc5fc063e8b 100644
--- a/sw/source/core/inc/ftnfrm.hxx
+++ b/sw/source/core/inc/ftnfrm.hxx
@@ -75,6 +75,7 @@ protected:
public:
SwFootnoteFrame( SwFrameFormat*, SwFrame*, SwContentFrame*, SwTextFootnote* );
+ virtual bool IsDeleteForbidden() const override;
virtual void Cut() override;
virtual void Paste( SwFrame* pParent, SwFrame* pSibling = nullptr ) override;
diff --git a/sw/source/core/layout/calcmove.cxx b/sw/source/core/layout/calcmove.cxx
index 3feed0d31eef..03430ce3b7a2 100644
--- a/sw/source/core/layout/calcmove.cxx
+++ b/sw/source/core/layout/calcmove.cxx
@@ -244,6 +244,7 @@ void SwFrame::PrepareMake(vcl::RenderContext* pRenderContext)
StackHack aHack;
if ( GetUpper() )
{
+ SwFrameDeleteGuard aDeleteGuard(this);
if ( lcl_IsCalcUpperAllowed( *this ) )
GetUpper()->Calc(pRenderContext);
OSL_ENSURE( GetUpper(), ":-( Layout unstable (Upper gone)." );
diff --git a/sw/source/core/layout/ftnfrm.cxx b/sw/source/core/layout/ftnfrm.cxx
index 4126288523b1..40a461b85b0a 100644
--- a/sw/source/core/layout/ftnfrm.cxx
+++ b/sw/source/core/layout/ftnfrm.cxx
@@ -484,6 +484,27 @@ SwTwips SwFootnoteFrame::ShrinkFrame( SwTwips nDist, bool bTst, bool bInfo )
}
#endif
+bool SwFootnoteFrame::IsDeleteForbidden() const
+{
+ if (SwLayoutFrame::IsDeleteForbidden())
+ return true;
+ // needs to be in sync with the ::Cut logic
+ const SwLayoutFrame *pUp = GetUpper();
+ if (pUp)
+ {
+ if (GetPrev())
+ return false;
+
+ // The last footnote takes its container along if it
+ // is deleted. Cut would put pUp->Lower() to the value
+ // of GetNext(), so if there is no GetNext then
+ // Cut would delete pUp. If that condition is true
+ // here then check if the container is delete-forbidden
+ return !GetNext() && pUp->IsDeleteForbidden();
+ }
+ return false;
+}
+
void SwFootnoteFrame::Cut()
{
if ( GetNext() )
@@ -509,7 +530,7 @@ void SwFootnoteFrame::Cut()
if ( pUp )
{
// The last footnote takes its container along
- if ( !pUp->Lower() )
+ if (!pUp->Lower())
{
SwPageFrame *pPage = pUp->FindPageFrame();
if ( pPage )
@@ -1599,7 +1620,8 @@ void SwFootnoteBossFrame::AppendFootnote( SwContentFrame *pRef, SwTextFootnote *
pNew->Calc(getRootFrame()->GetCurrShell()->GetOut());
// #i57914# - adjust fix #i49383#
if ( !bOldFootnoteFrameLocked && !pNew->GetLower() &&
- !pNew->IsColLocked() && !pNew->IsBackMoveLocked() )
+ !pNew->IsColLocked() && !pNew->IsBackMoveLocked() &&
+ !pNew->IsDeleteForbidden() )
{
pNew->Cut();
SwFrame::DestroyFrame(pNew);
@@ -2182,7 +2204,8 @@ void SwFootnoteBossFrame::RearrangeFootnotes( const SwTwips nDeadLine, const boo
if ( !bLock && bUnlockLastFootnoteFrame &&
!pLastFootnoteFrame->GetLower() &&
!pLastFootnoteFrame->IsColLocked() &&
- !pLastFootnoteFrame->IsBackMoveLocked() )
+ !pLastFootnoteFrame->IsBackMoveLocked() &&
+ !pLastFootnoteFrame->IsDeleteForbidden() )
{
pLastFootnoteFrame->Cut();
SwFrame::DestroyFrame(pLastFootnoteFrame);
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 846c5af90585..7e1c23071c32 100755
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -836,6 +836,11 @@ bool SwTabFrame::RemoveFollowFlowLine()
// #140081# Make code robust.
if ( !pFollowFlowLine || !pLastLine )
return true;
+ if (pFollowFlowLine->IsDeleteForbidden())
+ {
+ SAL_WARN("sw.layout", "Cannot remove in-use Follow Flow Line");
+ return true;
+ }
// Move content
lcl_MoveRowContent( *pFollowFlowLine, *static_cast<SwRowFrame*>(pLastLine) );
commit 81a1e3f84fc554632ac3cdadd91e0b7709030b50
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Aug 4 15:30:46 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:48 2019 +0200
crashtesting: bubble surface creation failure notification upwards
e.g. on converting moz858095-2.svg to odg
Change-Id: I1a222f1745cff9c4cb225f6c0c216072fb17b4f7
Reviewed-on: https://gerrit.libreoffice.org/58587
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit dbf34be458a2b5723084d1ed99390b744cee6053)
diff --git a/vcl/headless/svpgdi.cxx b/vcl/headless/svpgdi.cxx
index 825d5b1ebf21..c0b8c699dc68 100644
--- a/vcl/headless/svpgdi.cxx
+++ b/vcl/headless/svpgdi.cxx
@@ -1312,6 +1312,11 @@ SalBitmap* SvpSalGraphics::getBitmap( long nX, long nY, long nWidth, long nHeigh
pBitmap->Create(Size(nWidth, nHeight), 32, BitmapPalette());
cairo_surface_t* target = SvpSalGraphics::createCairoSurface(pBitmap->GetBuffer());
+ if (!target)
+ {
+ SAL_WARN("vcl.gdi", "SvpSalGraphics::getBitmap, cannot create cairo surface");
+ return nullptr;
+ }
cairo_t* cr = cairo_create(target);
SalTwoRect aTR(nX, nY, nWidth, nHeight, 0, 0, nWidth, nHeight);
commit 6165d24297dbae823057b0846d6a36af4f0a6794
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Jun 5 21:37:00 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:48 2019 +0200
tdf#121005 forcepoint#44 merge into isDeleteForbidden
Reviewed-on: https://gerrit.libreoffice.org/55355
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit c6222fb6b8b429fa2e767c73ad616147f95ab1b9)
Change-Id: If7ce44786975c5f9bdc9e64d16274728b03bed32
Reviewed-on: https://gerrit.libreoffice.org/62629
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
(cherry picked from commit ba4861a0dfdf97448925130995d69b4c516f0644)
diff --git a/sw/qa/core/data/ww8/fail/forcepoint-44.doc b/sw/qa/core/data/ww8/fail/forcepoint-44.doc
new file mode 100644
index 000000000000..100422a2249c
Binary files /dev/null and b/sw/qa/core/data/ww8/fail/forcepoint-44.doc differ
diff --git a/sw/source/core/layout/pagechg.cxx b/sw/source/core/layout/pagechg.cxx
index aac2ab98461d..9d346931ebfc 100644
--- a/sw/source/core/layout/pagechg.cxx
+++ b/sw/source/core/layout/pagechg.cxx
@@ -1161,6 +1161,8 @@ namespace
{
bool isDeleteForbidden(const SwPageFrame *pDel)
{
+ if (pDel->IsDeleteForbidden())
+ return true;
const SwLayoutFrame* pBody = pDel->FindBodyCont();
const SwFrame* pBodyContent = pBody ? pBody->Lower() : nullptr;
return pBodyContent && pBodyContent->IsDeleteForbidden();
commit 2796560f22d6e67f518b37078ca9cad5a019a998
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Apr 16 16:45:14 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:54:48 2019 +0200
forcepoint#39 bad layout
reproducible with ./instdir/program/soffice.bin --headless --convert-to pdf sw/qa/core/data/ww8/pass/forcepoint-layout-1.doc
Change-Id: I93bd8a75196ddb2a1a242752bb1e06164bf7148e
Reviewed-on: https://gerrit.libreoffice.org/53002
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit 2a957e408530cd16526d793c87f0e6fd4bed1548)
diff --git a/sw/qa/core/data/ww8/pass/forcepoint-layout-1.doc b/sw/qa/core/data/ww8/pass/forcepoint-layout-1.doc
new file mode 100755
index 000000000000..37801a9b14e2
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/forcepoint-layout-1.doc differ
diff --git a/sw/source/core/layout/fly.cxx b/sw/source/core/layout/fly.cxx
index fa98ceaf5c4c..3ffbcc3ab2b0 100644
--- a/sw/source/core/layout/fly.cxx
+++ b/sw/source/core/layout/fly.cxx
@@ -1460,6 +1460,7 @@ void CalcContent( SwLayoutFrame *pLay,
static_cast<SwTextFrame*>(pFrame)->ForbidFollowFormat();
{
+ SwFrameDeleteGuard aDeletePageGuard(pSect->FindPageFrame());
SwFrameDeleteGuard aDeleteGuard(pSect);
pFrame->Calc(pRenderContext);
}
commit bbb5a6aa2b0c1d9eb7fce7f4a08784635e44d354
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Oct 10 09:42:36 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:28:52 2019 +0200
ofz#10879 stay inside sSecStr bounds
Change-Id: I0ca70cdb9b80305c5339668d65d2c4c9977e7160
Reviewed-on: https://gerrit.libreoffice.org/61605
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit b3b52643983ec28838eeeed9f841b0918dc745be)
diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx
index 6e740b3f4df0..5552fd983d33 100644
--- a/svl/source/numbers/zformat.cxx
+++ b/svl/source/numbers/zformat.cxx
@@ -2899,7 +2899,7 @@ bool SvNumberformat::ImpGetTimeOutput(double fNumber,
(rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_STRING ||
rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_TIME100SECSEP) ?
nCntPost : rInfo.sStrArray[i].getLength() );
- for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost; j++)
+ for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost && nSecPos < sSecStr.getLength(); ++j)
{
sBuff.append(sSecStr[nSecPos]);
nSecPos++;
@@ -3689,7 +3689,7 @@ bool SvNumberformat::ImpGetDateTimeOutput(double fNumber,
(rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_STRING ||
rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_TIME100SECSEP) ?
nCntPost : rInfo.sStrArray[i].getLength() );
- for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost; j++)
+ for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost && nSecPos < sSecStr.getLength(); ++j)
{
sBuff.append(sSecStr[ nSecPos ]);
nSecPos++;
commit 81d247ddd61e061ff495c289ece376741324afc9
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Sep 20 16:03:24 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:28:52 2019 +0200
ofz#10523 guard aginst 0 pF->nLCode
Change-Id: I8ef476e06f54ddd57be907488a8a65314abda3ee
Reviewed-on: https://gerrit.libreoffice.org/60827
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit b8525055c6734baa36c1da0aaf33654a865e2021)
diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index b8828a15d67c..481a07b4114a 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -102,7 +102,7 @@ eF_ResT SwWW8ImplReader::Read_F_FormTextBox( WW8FieldDesc* pF, OUString& rStr )
{
WW8FormulaEditBox aFormula(*this);
- if (rStr[pF->nLCode-1]==0x01) {
+ if (pF->nLCode && rStr[pF->nLCode-1]==0x01) {
ImportFormulaControl(aFormula,pF->nSCode+pF->nLCode-1, WW8_CT_EDIT);
}
commit e41738edf5d57fbbe0748f7106c8c0b4a4c30ad7
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Sep 17 09:01:59 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:28:51 2019 +0200
ofz#10395 Null-dereference
Change-Id: I7bde5987a51949d60174335327652186e0ad8998
Reviewed-on: https://gerrit.libreoffice.org/60559
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit 07b3bfb125fae70e0ab796a929a4f2abe4937912)
Reviewed-on: https://gerrit.libreoffice.org/60564
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit fde33870d6989efeb59355aad1209a7f50e7ecf6)
diff --git a/oox/source/shape/WpsContext.cxx b/oox/source/shape/WpsContext.cxx
index 15a102200ae3..16352fd33398 100644
--- a/oox/source/shape/WpsContext.cxx
+++ b/oox/source/shape/WpsContext.cxx
@@ -180,11 +180,14 @@ oox::core::ContextHandlerRef WpsContext::onCreateContext(sal_Int32 nElementToken
if (rAttribs.hasAttribute(XML_prst))
{
uno::Reference<beans::XPropertySet> xPropertySet(mxShape, uno::UNO_QUERY);
- oox::OptValue<OUString> presetShapeName = rAttribs.getString(XML_prst);
- OUString preset = presetShapeName.get();
- comphelper::SequenceAsHashMap aCustomShapeGeometry(xPropertySet->getPropertyValue("CustomShapeGeometry"));
- aCustomShapeGeometry["PresetTextWarp"] = uno::makeAny(preset);
- xPropertySet->setPropertyValue("CustomShapeGeometry", uno::makeAny(aCustomShapeGeometry.getAsConstPropertyValueList()));
+ if (xPropertySet.is())
+ {
+ oox::OptValue<OUString> presetShapeName = rAttribs.getString(XML_prst);
+ OUString preset = presetShapeName.get();
+ comphelper::SequenceAsHashMap aCustomShapeGeometry(xPropertySet->getPropertyValue("CustomShapeGeometry"));
+ aCustomShapeGeometry["PresetTextWarp"] = uno::makeAny(preset);
+ xPropertySet->setPropertyValue("CustomShapeGeometry", uno::makeAny(aCustomShapeGeometry.getAsConstPropertyValueList()));
+ }
}
break;
case XML_txbx:
commit ed232a7a12702151ce93b38194b1cc5de7a18400
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sun Sep 2 21:20:40 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:28:51 2019 +0200
ofz#10189 check container size
Change-Id: Ie99e3b082795989290799d057a99b1bcff94b161
Reviewed-on: https://gerrit.libreoffice.org/59912
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
Tested-by: Jenkins
(cherry picked from commit 8767161e056b5d7fc8cf168d0541db86635d1041)
diff --git a/sc/source/core/data/dptabres.cxx b/sc/source/core/data/dptabres.cxx
index 136a5b69779c..b27da087ae64 100644
--- a/sc/source/core/data/dptabres.cxx
+++ b/sc/source/core/data/dptabres.cxx
@@ -2839,10 +2839,14 @@ void ScDPResultDimension::LateInitFrom(
{
if ( rParams.IsEnd( nPos ) )
return;
- OSL_ENSURE( nPos <= pItemData.size(), OString::number(pItemData.size()).getStr() );
+ if (nPos >= pItemData.size())
+ {
+ SAL_WARN("sc.core", "pos " << nPos << ", but vector size is " << pItemData.size());
+ return;
+ }
+ SCROW rThisData = pItemData[nPos];
ScDPDimension* pThisDim = rParams.GetDim( nPos );
ScDPLevel* pThisLevel = rParams.GetLevel( nPos );
- SCROW rThisData = pItemData[nPos];
if (!pThisDim || !pThisLevel)
return;
commit 947eadb9a2a9ace960ef34ea38899838cd962981
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Aug 25 19:08:35 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:28:51 2019 +0200
ofz#10056 Null deref
Change-Id: I9ea0f272d0a8b13fb51fec55ac57adca47cafc77
Reviewed-on: https://gerrit.libreoffice.org/59601
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 48c677d55330ac6caf0065fa1776c985b876eead)
diff --git a/writerfilter/source/ooxml/OOXMLStreamImpl.cxx b/writerfilter/source/ooxml/OOXMLStreamImpl.cxx
index 2b7bff9f0abe..a815db220592 100644
--- a/writerfilter/source/ooxml/OOXMLStreamImpl.cxx
+++ b/writerfilter/source/ooxml/OOXMLStreamImpl.cxx
@@ -325,12 +325,20 @@ bool OOXMLStreamImpl::lcl_getTarget(const uno::Reference<embed::XRelationshipAcc
// simple string concatination here to handle that.
uno::Reference<uri::XUriReference> xPart = xFac->parse(sMyTarget);
uno::Reference<uri::XUriReference> xAbs = xFac->makeAbsolute(xBase, xPart, true, uri::RelativeUriExcessParentSegments_RETAIN);
- rDocumentTarget = xAbs->getPath();
- // path will start with the fragment separator. need to
- // remove that
- rDocumentTarget = rDocumentTarget.copy( 1 );
- if(sStreamType == sEmbeddingsType)
- embeddingsTarget = rDocumentTarget;
+ if (!xAbs.is())
+ {
+ //it was invalid gibberish
+ bFound = false;
+ }
+ else
+ {
+ rDocumentTarget = xAbs->getPath();
+ // path will start with the fragment separator. need to
+ // remove that
+ rDocumentTarget = rDocumentTarget.copy( 1 );
+ if(sStreamType == sEmbeddingsType)
+ embeddingsTarget = rDocumentTarget;
+ }
}
break;
commit 604934ba95bee584f7afaca544710e7992fe1d9d
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Aug 24 15:01:23 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:28:51 2019 +0200
ofz#10045 Null deref
Change-Id: If9c8edd94b02240510325d6c9c0fc7584ba89b5f
Reviewed-on: https://gerrit.libreoffice.org/59574
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit fabac301a2c431a51bcae435e7ad87c843331877)
diff --git a/writerfilter/source/dmapper/DomainMapperTableHandler.cxx b/writerfilter/source/dmapper/DomainMapperTableHandler.cxx
index 12d22f321151..bb038d4c7f27 100644
--- a/writerfilter/source/dmapper/DomainMapperTableHandler.cxx
+++ b/writerfilter/source/dmapper/DomainMapperTableHandler.cxx
@@ -1015,8 +1015,11 @@ void DomainMapperTableHandler::endTable(unsigned int nestedTableLevel, bool bTab
{
xStart = m_aTableRanges[0][0][0];
uno::Sequence< uno::Sequence< uno::Reference<text::XTextRange> > >& rLastRow = m_aTableRanges[m_aTableRanges.size() - 1];
- uno::Sequence< uno::Reference<text::XTextRange> >& rLastCell = rLastRow[rLastRow.getLength() - 1];
- xEnd = rLastCell[1];
+ if (rLastRow.getLength())
+ {
+ uno::Sequence< uno::Reference<text::XTextRange> >& rLastCell = rLastRow[rLastRow.getLength() - 1];
+ xEnd = rLastCell[1];
+ }
}
uno::Reference<text::XTextTable> xTable;
try
commit 3bc1879990a381879dc249f3cb7cce3671d0fe7a
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Aug 14 15:22:58 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:28:51 2019 +0200
tdf#117086 crash on deleted SwFootnoteBossFrame
use SwFrameDeleteGuard to lock pOldBoss to exist over the range
its directly accessed
Change-Id: I68af80114a380f68b86cbc78278fb9e5e87cccce
Reviewed-on: https://gerrit.libreoffice.org/59113
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit d1b9cbe749fc3329bda1e8ddaee6d8a6f783ad82)
diff --git a/sw/source/core/layout/flowfrm.cxx b/sw/source/core/layout/flowfrm.cxx
index 6d4ffb471853..ca28f9eb78d2 100644
--- a/sw/source/core/layout/flowfrm.cxx
+++ b/sw/source/core/layout/flowfrm.cxx
@@ -1850,6 +1850,8 @@ bool SwFlowFrame::MoveFwd( bool bMakePage, bool bPageBreak, bool bMoveAlways )
}
}
+ std::unique_ptr<SwFrameDeleteGuard> xDeleteGuard(bMakePage ? new SwFrameDeleteGuard(pOldBoss) : nullptr);
+
bool bSamePage = true;
SwLayoutFrame *pNewUpper =
m_rThis.GetLeaf( bMakePage ? MAKEPAGE_INSERT : MAKEPAGE_NONE, true );
@@ -1888,6 +1890,8 @@ bool SwFlowFrame::MoveFwd( bool bMakePage, bool bPageBreak, bool bMoveAlways )
pOldBoss = pOldBoss->FindFootnoteBossFrame( true );
SwPageFrame* pNewPage = pOldPage;
+ xDeleteGuard.reset();
+
// First, we move the footnotes.
bool bFootnoteMoved = false;
commit ba988b5d66f3e0a8605706f09cf840e528e0f373
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Aug 17 08:47:19 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:28:51 2019 +0200
ofz#9934 null deref
Change-Id: I6833ad8a556b561a37e468da8845914cabfac4c5
Reviewed-on: https://gerrit.libreoffice.org/59249
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 4fb7390956a193e00c1b599129b89933c41f98ae)
diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index 36aea5291757..9fa147683033 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -1400,8 +1400,9 @@ void DomainMapper_Impl::appendOLE( const OUString& rStreamName, const OLEHandler
if (!m_aAnchoredStack.empty())
m_aAnchoredStack.top( ).bToRemove = true;
RemoveLastParagraph();
- m_aTextAppendStack.pop();
-
+ SAL_WARN_IF(m_aTextAppendStack.empty(), "writerfilter.dmapper", "no text stack");
+ if (!m_aTextAppendStack.empty())
+ m_aTextAppendStack.pop();
appendTextContent( xOLE, uno::Sequence< beans::PropertyValue >() );
commit 41734dab6098510709dd84fe62aa378021d5b97a
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Aug 16 14:24:46 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:28:51 2019 +0200
tdf#119224 start and end are expected to exist for the scope of this function
Change-Id: I771bce68a2ac923af6a7d54646a2c59ce6f10f7e
Reviewed-on: https://gerrit.libreoffice.org/59179
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 81818670fe90fca438dfb0c22903474745112cfe)
diff --git a/sw/source/core/layout/trvlfrm.cxx b/sw/source/core/layout/trvlfrm.cxx
index c5e9885b4d9b..c33afb6c30ff 100644
--- a/sw/source/core/layout/trvlfrm.cxx
+++ b/sw/source/core/layout/trvlfrm.cxx
@@ -2029,13 +2029,15 @@ void SwRootFrame::CalcFrameRects(SwShellCursor &rCursor)
//First obtain the ContentFrames for the start and the end - those are needed
//anyway.
- SwContentFrame const* pStartFrame = pStartPos->nNode.GetNode().
+ SwContentFrame* pStartFrame = pStartPos->nNode.GetNode().
GetContentNode()->getLayoutFrame( this, &rCursor.GetSttPos(), pStartPos );
- SwContentFrame const* pEndFrame = pEndPos->nNode.GetNode().
+ SwContentFrame* pEndFrame = pEndPos->nNode.GetNode().
GetContentNode()->getLayoutFrame( this, &rCursor.GetEndPos(), pEndPos );
- OSL_ENSURE( (pStartFrame && pEndFrame), "Keine ContentFrames gefunden." );
+ assert(pStartFrame && pEndFrame && "No ContentFrames found.");
+ //tdf#119224 start and end are expected to exist for the scope of this function
+ SwFrameDeleteGuard aStartFrameGuard(pStartFrame), aEndFrameGuard(pEndFrame);
//Do not subtract the FlyFrames in which selected Frames lie.
SwSortedObjs aSortObjs;
commit a0d95debe37e900620a1ffb507bee75d40cd6377
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 15 09:16:54 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:28:50 2019 +0200
ofz#9892 Null-dereference
Change-Id: I8ab1948e5760da365bdddaf45955912a18b20ead
Reviewed-on: https://gerrit.libreoffice.org/59056
Tested-by: Jenkins
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
(cherry picked from commit a0aea0b22a5ceb31b69407be6b74506194d44134)
diff --git a/oox/source/drawingml/shapecontext.cxx b/oox/source/drawingml/shapecontext.cxx
index fe011c94f944..471d95727919 100644
--- a/oox/source/drawingml/shapecontext.cxx
+++ b/oox/source/drawingml/shapecontext.cxx
@@ -100,7 +100,9 @@ ContextHandlerRef ShapeContext::onCreateContext( sal_Int32 aElementToken, const
}
case XML_txXfrm:
{
- mpShapePtr->getTextBody()->getTextProperties().moRotation = rAttribs.getInteger( XML_rot );
+ const TextBodyPtr& rShapePtr = mpShapePtr->getTextBody();
+ if (rShapePtr)
+ rShapePtr->getTextProperties().moRotation = rAttribs.getInteger( XML_rot );
return nullptr;
}
case XML_cNvSpPr:
commit 92293ac26393958c8d9069970836775c4c249a98
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Aug 13 09:20:19 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:28:50 2019 +0200
crashtesting: empty B2DRange range turned into oversized Rectangle
with document ooo47086-1.xls
Change-Id: Ia43b6b3e3951875280892138c7068348f1b56a7c
Reviewed-on: https://gerrit.libreoffice.org/58921
Tested-by: Jenkins
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
(cherry picked from commit eabb2bf06aba0de81a6d1e7715859fa63379325b)
diff --git a/svx/source/svdraw/svdopath.cxx b/svx/source/svdraw/svdopath.cxx
index c148e5bf1989..17713e3a1f24 100644
--- a/svx/source/svdraw/svdopath.cxx
+++ b/svx/source/svdraw/svdopath.cxx
@@ -1690,6 +1690,9 @@ static Rectangle lcl_ImpGetBoundRect(const basegfx::B2DPolyPolygon& rPolyPolygon
{
basegfx::B2DRange aRange(basegfx::tools::getRange(rPolyPolygon));
+ if (aRange.isEmpty())
+ return Rectangle();
+
return Rectangle(
FRound(aRange.getMinX()), FRound(aRange.getMinY()),
FRound(aRange.getMaxX()), FRound(aRange.getMaxY()));
commit 9b4e1c6303d1238257ea201bbf5b5ac2ab10bc46
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Aug 13 16:41:31 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Mon Aug 5 14:28:45 2019 +0200
ofz#9870: check sequence length before use
Change-Id: I137a9de49c5a73eb5f277dc1519e5e036abba31c
Reviewed-on: https://gerrit.libreoffice.org/58946
Tested-by: Jenkins
Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
(cherry picked from commit 148b3cfd0b948163416f1d19ee6876d3459f1d9f)
diff --git a/writerfilter/source/ooxml/OOXMLDocumentImpl.cxx b/writerfilter/source/ooxml/OOXMLDocumentImpl.cxx
index 9ede7431bf6c..86ba0026c60d 100644
--- a/writerfilter/source/ooxml/OOXMLDocumentImpl.cxx
+++ b/writerfilter/source/ooxml/OOXMLDocumentImpl.cxx
@@ -634,6 +634,12 @@ void OOXMLDocumentImpl::resolveGlossaryStream(Stream & /*rStream*/)
OOXMLStream::Pointer_t gStream;
uno::Sequence< beans::StringPair > aSeq = aSeqs[j];
//Follows following aSeq[0] is Id, aSeq[1] is Type, aSeq[2] is Target
+ if (aSeq.getLength() < 3)
+ {
+ SAL_WARN("writerfilter.ooxml", "too short sequence");
+ continue;
+ }
+
OUString gId(aSeq[0].Second);
OUString gType(aSeq[1].Second);
OUString gTarget(aSeq[2].Second);
commit 87949b8e6e9527d88b7d1f297a662aae8252f057
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 08:55:23 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 18:11:33 2019 +0200
forcepoint#55 invalid iterator increment
Change-Id: I151602f645a48404d93e0ae64a9e1d2a6ba2bc4b
Reviewed-on: https://gerrit.libreoffice.org/58386
Tested-by: Jenkins
Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
(cherry picked from commit 26300f5d4c4e6241baf8cadcfea094e7969814a5)
diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx
index 712ca69fbe10..950d72a8192b 100644
--- a/sc/source/core/data/column3.cxx
+++ b/sc/source/core/data/column3.cxx
@@ -2978,6 +2978,8 @@ public:
if (xCurGrp)
{
// Move to the cell after the last cell of the current group.
+ if (xCurGrp->mnLength > std::distance(it, itEnd))
+ throw css::lang::IllegalArgumentException();
std::advance(it, xCurGrp->mnLength);
nRow += xCurGrp->mnLength;
}
commit 098cfd80b31d849ee2f6a1f7be170dc4c868bf4c
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 09:18:16 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 18:11:33 2019 +0200
forcepoint#57 sanity check stream signature size
Change-Id: I5ae459e159a64f32c62278a87e37deb08ab9d6ac
Reviewed-on: https://gerrit.libreoffice.org/58448
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 8ed224599ae7985b577f0bf737b2b9b2e8dd47b7)
diff --git a/xmlsecurity/source/helper/xmlsignaturehelper.cxx b/xmlsecurity/source/helper/xmlsignaturehelper.cxx
index e7e8e05cdb06..b794c666c1fb 100644
--- a/xmlsecurity/source/helper/xmlsignaturehelper.cxx
+++ b/xmlsecurity/source/helper/xmlsignaturehelper.cxx
@@ -424,21 +424,25 @@ bool XMLSignatureHelper::ReadAndVerifySignatureStorage(const uno::Reference<embe
if (!bCacheLastSignature && i == aRelationsInfo.getLength() - 1)
bCache = false;
- if (bCache)
+ if (!bCache)
+ continue;
+ // Store the contents of the stream as is, in case we need to write it back later.
+ xInputStream.clear();
+ xInputStream.set(xStorage->openStreamElement(it->Second, nOpenMode), uno::UNO_QUERY);
+ uno::Reference<beans::XPropertySet> xPropertySet(xInputStream, uno::UNO_QUERY);
+ if (!xPropertySet.is())
+ continue;
+
+ sal_Int64 nSize = 0;
+ xPropertySet->getPropertyValue("Size") >>= nSize;
+ if (nSize < 0 || nSize > SAL_MAX_INT32)
{
- // Store the contents of the stream as is, in case we need to write it back later.
- xInputStream.clear();
- xInputStream.set(xStorage->openStreamElement(it->Second, nOpenMode), uno::UNO_QUERY);
- uno::Reference<beans::XPropertySet> xPropertySet(xInputStream, uno::UNO_QUERY);
- if (xPropertySet.is())
- {
- sal_Int64 nSize = 0;
- xPropertySet->getPropertyValue("Size") >>= nSize;
- uno::Sequence<sal_Int8> aData;
- xInputStream->readBytes(aData, nSize);
- mpXSecController->setSignatureBytes(aData);
- }
+ SAL_WARN("xmlsecurity.helper", "bogus signature size: " << nSize);
+ continue;
}
+ uno::Sequence<sal_Int8> aData;
+ xInputStream->readBytes(aData, nSize);
+ mpXSecController->setSignatureBytes(aData);
}
}
}
commit 47a7f2d23b394dda918fdeb1d9b67b843af20465
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 11:48:30 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 18:11:33 2019 +0200
forcepoint#64 null deref
Change-Id: I4acf03a7911aa203fc4ef10b6a96b0135d6adbbc
Reviewed-on: https://gerrit.libreoffice.org/58415
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit a5b84a6888deaa406786b350a0adcf9ef9020f48)
diff --git a/sc/source/filter/xml/XMLTableShapeImportHelper.cxx b/sc/source/filter/xml/XMLTableShapeImportHelper.cxx
index 7013cd6eb5b0..03c23a2d2dd5 100644
--- a/sc/source/filter/xml/XMLTableShapeImportHelper.cxx
+++ b/sc/source/filter/xml/XMLTableShapeImportHelper.cxx
@@ -203,7 +203,7 @@ void XMLTableShapeImportHelper::finishShape(
// the group
Point aStartPoint( rShape->getPosition().X,rShape->getPosition().Y );
uno::Reference< drawing::XShape > xChild( rShapes, uno::UNO_QUERY );
- if (SvxShape* pGroupShapeImp = SvxShape::getImplementation( lcl_getTopLevelParent( xChild ) ))
+ if (SvxShape* pGroupShapeImp = xChild.is() ? SvxShape::getImplementation(lcl_getTopLevelParent(xChild)) : nullptr)
{
if (SdrObject *pSdrObj = pGroupShapeImp->GetSdrObject())
{
commit a2490a64b7eb18018dbe2dc09bd07864b5b3ca0d
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 11:36:01 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 18:11:33 2019 +0200
forcepoint#63 null deref
Change-Id: Ib22ff870cd0d8cdd2350b2aa8698f5a2e3866bdc
Reviewed-on: https://gerrit.libreoffice.org/58411
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 9a0e5aeca5a118e748e625f6ecbd49a497b8e232)
diff --git a/filter/source/xsltfilter/OleHandler.cxx b/filter/source/xsltfilter/OleHandler.cxx
index d79cd01713a1..37440f95b6b4 100644
--- a/filter/source/xsltfilter/OleHandler.cxx
+++ b/filter/source/xsltfilter/OleHandler.cxx
@@ -97,7 +97,7 @@ namespace XSLT
OString SAL_CALL
OleHandler::encodeSubStorage(const OUString& streamName)
{
- if (!m_storage->hasByName(streamName))
+ if (!m_storage.is() || !m_storage->hasByName(streamName))
{
return "Not Found:";// + streamName;
}
commit ed48943694c167aa89a3c7f7c9e654cba44c3039
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 11:31:21 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 18:11:33 2019 +0200
forcepoint#62 null deref
Change-Id: I255aeb96c3763aa106128d3463e4fd55395ef8b8
Reviewed-on: https://gerrit.libreoffice.org/58409
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 9e434f2f5ad61092ee685369bce93d90a28db149)
diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index 518be4bad9ca..36aea5291757 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -4564,7 +4564,7 @@ void DomainMapper_Impl::PopFieldContext()
else
{
FormControlHelper::Pointer_t pFormControlHelper(pContext->getFormControlHelper());
- if (pFormControlHelper.get() != nullptr && pFormControlHelper->hasFFDataHandler() )
+ if (pFormControlHelper.get() != nullptr && pFormControlHelper->hasFFDataHandler() && xCrsr.is())
{
uno::Reference< text::XFormField > xFormField( pContext->GetFormField() );
xToInsert.set(xFormField, uno::UNO_QUERY);
@@ -4580,7 +4580,7 @@ void DomainMapper_Impl::PopFieldContext()
pFormControlHelper->insertControl(xTxtRange);
}
}
- else if(!pContext->GetHyperlinkURL().isEmpty())
+ else if (!pContext->GetHyperlinkURL().isEmpty() && xCrsr.is())
{
xCrsr->gotoEnd( true );
commit da9abb54acd2159cc3069959f062a2b4ceb1d955
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 10:19:52 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 18:11:33 2019 +0200
forcepoint#58 null deref
Change-Id: I826890ec85a16bc05fc1e4cd068079b0f8734d07
Reviewed-on: https://gerrit.libreoffice.org/58394
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 8cee73aae9bca3a94aa7a0aa3bfa82b593d4c3c7)
diff --git a/writerfilter/source/rtftok/rtfsdrimport.cxx b/writerfilter/source/rtftok/rtfsdrimport.cxx
index 4a4001337790..d4e492a08e97 100644
--- a/writerfilter/source/rtftok/rtfsdrimport.cxx
+++ b/writerfilter/source/rtftok/rtfsdrimport.cxx
@@ -1004,6 +1004,8 @@ void RTFSdrImport::append(const OUString& aKey, const OUString& aValue)
void RTFSdrImport::appendGroupProperty(const OUString& aKey, const OUString& aValue)
{
+ if (m_aParents.empty())
+ return;
uno::Reference<drawing::XShape> xShape(m_aParents.top(), uno::UNO_QUERY);
if (xShape.is())
applyProperty(xShape, aKey, aValue);
commit 4c9be5081d9ce3eb829ed1999cdc1383cb8fefb3
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 09:04:58 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 18:11:33 2019 +0200
forcepoint#56 null deref
Change-Id: Iaa9c4d6901a340145412fa46eaf5c292c3fb62e8
Reviewed-on: https://gerrit.libreoffice.org/58387
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 0845c1a74aef650b4aebaeea9587b3bfb5b38ffb)
diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index d6305da795ed..518be4bad9ca 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -2676,15 +2676,17 @@ void DomainMapper_Impl::PushFieldContext()
TagLogger::getInstance().element("pushFieldContext");
#endif
- uno::Reference< text::XTextAppend > xTextAppend;
+ uno::Reference<text::XTextCursor> xCrsr;
if (!m_aTextAppendStack.empty())
- xTextAppend = m_aTextAppendStack.top().xTextAppend;
- uno::Reference< text::XTextRange > xStart;
- if (xTextAppend.is())
{
- uno::Reference< text::XTextCursor > xCrsr = xTextAppend->createTextCursorByRange( xTextAppend->getEnd() );
- xStart = xCrsr->getStart();
+ uno::Reference<text::XTextAppend> xTextAppend = m_aTextAppendStack.top().xTextAppend;
+ if (xTextAppend.is())
+ xCrsr = xTextAppend->createTextCursorByRange(xTextAppend->getEnd());
}
+
+ uno::Reference< text::XTextRange > xStart;
+ if (xCrsr.is())
+ xStart = xCrsr->getStart();
m_aFieldStack.push( std::make_shared<FieldContext>( xStart ) );
}
/*-------------------------------------------------------------------------
commit 246c55ae4b5bc6f6ae7166efdd65cba277b8c6ca
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 08:39:03 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 18:11:33 2019 +0200
forcepoint#54 null deref
Change-Id: I9ca04647b16f90bb2d2d4aa0d25b08a09c408fe0
Reviewed-on: https://gerrit.libreoffice.org/58383
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 2c1cf211e830399ef70e1df94976871afc7c6b3e)
diff --git a/oox/source/crypto/CryptTools.cxx b/oox/source/crypto/CryptTools.cxx
index 4bb3ec2f2d28..f46b87828de0 100644
--- a/oox/source/crypto/CryptTools.cxx
+++ b/oox/source/crypto/CryptTools.cxx
@@ -141,6 +141,8 @@ sal_uInt32 Decrypt::update(vector<sal_uInt8>& output, vector<sal_uInt8>& input,
#endif // USE_TLS_OPENSSL
#if USE_TLS_NSS
+ if (!mContext)
+ return 0;
(void)PK11_CipherOp( mContext, &output[0], &outputLength, actualInputLength, &input[0], actualInputLength );
#endif // USE_TLS_NSS
commit a47f101cb280fa14b4d3e785880ee130ff576b27
Author: Eike Rathke <erack at redhat.com>
AuthorDate: Mon Oct 16 22:08:27 2017 +0200
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 18:11:33 2019 +0200
Resolves: tdf#112933 correct number of one decimal in fraction of seconds
Regression from
commit 0ac1e2ad19d4fdb46dcf54f67db2df081f4675bb
Date: Wed Aug 2 09:39:43 2017 +0100
Resolves: ofz#2833 null deref
and similar for date+time
commit 42b894f80a6d0c39bb0f7092eb204a15c22c4f38
Date: Sat Aug 5 19:15:36 2017 +0100
ofz#2867 null deref
Effectively revert the code changes of those, leaving the test
case files intact, and "do the right thing" (switching two lines,
to
nPos = nPos + sStrArray[i].getLength();
i++;
nPos actually had always to be incremented by the length of the
*current* string position but was used after only as an error
position indicator, meaningless if there was no error.
(cherry picked from commit 4f72d2ec6c210232e0abd4965e215611e807c125)
Conflicts:
svl/source/numbers/zforscan.cxx
Backported.
Change-Id: I9bc4e5e56d70a275d26df0b72ed6a19e9297e0fa
Reviewed-on: https://gerrit.libreoffice.org/43440
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm at redhat.com>
Tested-by: Caolán McNamara <caolanm at redhat.com>
(cherry picked from commit 35fcdb14e5d8af2f9770fc1994ad47b0774b9a55)
diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx
index a5f1ada91cdc..11339a43fb59 100644
--- a/svl/source/numbers/zforscan.cxx
+++ b/svl/source/numbers/zforscan.cxx
@@ -2348,21 +2348,18 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
bDecSep = true;
nTypeArray[i] = NF_SYMBOLTYPE_DIGIT;
OUString& rStr = sStrArray[i];
+ nPos = nPos + sStrArray[i].getLength();
+ nCounter++;
i++;
- if (i < nAnzStrings)
+ while (i < nAnzStrings &&
+ sStrArray[i][0] == '0')
{
+ rStr += sStrArray[i];
nPos = nPos + sStrArray[i].getLength();
+ nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
+ nAnzResStrings--;
nCounter++;
- while (i < nAnzStrings &&
- sStrArray[i][0] == '0')
- {
- rStr += sStrArray[i];
- nPos = nPos + sStrArray[i].getLength();
- nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
- nAnzResStrings--;
- nCounter++;
- i++;
- }
+ i++;
}
}
else
@@ -2501,21 +2498,18 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
bDecSep = true;
nTypeArray[i] = NF_SYMBOLTYPE_DIGIT;
OUString& rStr = sStrArray[i];
+ nPos = nPos + sStrArray[i].getLength();
i++;
- if (i < nAnzStrings)
+ nCounter++;
+ while (i < nAnzStrings &&
+ sStrArray[i][0] == '0')
{
+ rStr += sStrArray[i];
nPos = nPos + sStrArray[i].getLength();
+ nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
+ nAnzResStrings--;
nCounter++;
- while (i < nAnzStrings &&
- sStrArray[i][0] == '0')
- {
- rStr += sStrArray[i];
- nPos = nPos + sStrArray[i].getLength();
- nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
- nAnzResStrings--;
- nCounter++;
- i++;
- }
+ i++;
}
}
else
commit 73307219dc530aaa8188c84d044965aee75bccca
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Aug 2 21:18:15 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 17:07:22 2019 +0200
forcepoint#69 ditch any unclosed m_pPosAfterTOC before dropping cursor
Change-Id: I6b56a48f5449b25fe3bdc2e02d3885388b0da74f
Reviewed-on: https://gerrit.libreoffice.org/58498
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 71aae473c9c3cf15f75e2722afc7153a3af76d44)
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index f3ab92e7a9a9..b8bc89d44274 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -5405,6 +5405,7 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss)
SAL_WARN_IF(m_pTableEndPaM, "sw.ww8", "document ended without table ending");
m_pTableEndPaM.reset(); //ensure this is deleted before pPaM
+ m_pPosAfterTOC.reset();
mpCursor.reset();
m_pPaM = nullptr;
m_pLastAnchorPos.reset();//ensure this is deleted before UpdatePageDescs
diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index 5776dd743ffa..05326eee6aa3 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -1358,7 +1358,7 @@ private:
// Indicate that current on loading a hyperlink, which is inside a TOC; Managed by Read_F_Hyperlink() and End_Field()
bool m_bLoadingTOXHyperlink;
// a document position recorded the after-position of TOC section, managed by Read_F_TOX() and End_Field()
- SwPaM* m_pPosAfterTOC;
+ std::unique_ptr<SwPaM> m_pPosAfterTOC;
// used for some dropcap tweaking
SwTextNode* m_pPreviousNode;
diff --git a/sw/source/filter/ww8/ww8par5.cxx b/sw/source/filter/ww8/ww8par5.cxx
index 49d0f5eaaa4b..f08c44b66276 100644
--- a/sw/source/filter/ww8/ww8par5.cxx
+++ b/sw/source/filter/ww8/ww8par5.cxx
@@ -567,8 +567,7 @@ sal_uInt16 SwWW8ImplReader::End_Field()
if (m_pPosAfterTOC)
{
*m_pPaM = *m_pPosAfterTOC;
- delete m_pPosAfterTOC;
- m_pPosAfterTOC = nullptr;
+ m_pPosAfterTOC.reset();
}
}
}
@@ -3394,11 +3393,7 @@ eF_ResT SwWW8ImplReader::Read_F_Tox( WW8FieldDesc* pF, OUString& rStr )
//The TOC field representation contents should be inserted into TOC section, but not after TOC section.
//So we need update the document position when loading TOC representation and after loading TOC;
- if (m_pPosAfterTOC)
- {
- delete m_pPosAfterTOC;
- }
- m_pPosAfterTOC = new SwPaM(*m_pPaM, m_pPaM);
+ m_pPosAfterTOC.reset(new SwPaM(*m_pPaM, m_pPaM));
(*m_pPaM).Move(fnMoveBackward);
SwPaM aRegion(*m_pPaM, m_pPaM);
commit 5567a151fc245d801777339a9d0ecea04e48f50f
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Jul 24 14:20:20 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 14:08:20 2019 +0200
ofz#9431 don't check attribs of Invalid column
Change-Id: I9c5adcadfa2a8593ff90622449d6bdfa4810f2c0
Reviewed-on: https://gerrit.libreoffice.org/57917
Tested-by: Jenkins
Reviewed-by: Eike Rathke <erack at redhat.com>
(cherry picked from commit d909146913c762c2cdb6bed52fbbd817c05681e9)
diff --git a/sc/source/filter/rtf/eeimpars.cxx b/sc/source/filter/rtf/eeimpars.cxx
index 77e0c9bc0d2d..8b7e50886dd1 100644
--- a/sc/source/filter/rtf/eeimpars.cxx
+++ b/sc/source/filter/rtf/eeimpars.cxx
@@ -146,7 +146,7 @@ void ScEEImport::WriteToDocument( bool bSizeColsRows, double nOutputFactor, SvNu
SCCOL nCol = nStartCol + pE->nCol + nMergeColAdd;
// Determine RowMerge
// Pure ColMerge and ColMerge of the first MergeRow already done during parsing
- if ( nRow <= nOverlapRowMax )
+ if (nRow <= nOverlapRowMax && ValidCol(nCol))
{
while ( nCol <= MAXCOL && mpDoc->HasAttrib( nCol, nRow, nTab,
nCol, nRow, nTab, HASATTR_OVERLAPPED ) )
commit 7b9083e76523c25dd9e2006482bc2c253bbf9d59
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Jul 23 09:23:54 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 14:08:20 2019 +0200
ofz#9507 wrong start point for Johab block 59
Change-Id: I011f4cbb10324c4a7d4e1be3ab1355291f79730b
Reviewed-on: https://gerrit.libreoffice.org/57839
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman at redhat.com>
(cherry picked from commit 6582602a126403185294afe9e3c2cd8479f9157b)
diff --git a/sal/textenc/tcvtkr6.tab b/sal/textenc/tcvtkr6.tab
index 776c15dbcf5e..ac9c0d15293d 100644
--- a/sal/textenc/tcvtkr6.tab
+++ b/sal/textenc/tcvtkr6.tab
@@ -1013,7 +1013,7 @@ static ImplUniToDBCSHighTab const aJOHABDBCSHighTab[256] =
{ 0x06, 0xFA, aImplUniToDBCSTab_JOHAB_56 }, /* 0x56 */
{ 0x03, 0xFC, aImplUniToDBCSTab_JOHAB_57 }, /* 0x57 */
{ 0x00, 0xFD, aImplUniToDBCSTab_JOHAB_58 }, /* 0x58 */
- { 0x07, 0xFF, aImplUniToDBCSTab_JOHAB_59 }, /* 0x59 */
+ { 0x0F, 0xFF, aImplUniToDBCSTab_JOHAB_59 }, /* 0x59 */
{ 0x01, 0xE9, aImplUniToDBCSTab_JOHAB_5A }, /* 0x5A */
{ 0x05, 0xFA, aImplUniToDBCSTab_JOHAB_5B }, /* 0x5B */
{ 0x01, 0xFD, aImplUniToDBCSTab_JOHAB_5C }, /* 0x5C */
commit 3e005eef3dbfa0a6630cff6a0d3f01ecaf0c5fc4
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Jun 26 11:58:30 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 14:08:20 2019 +0200
forcepoint#47 bail when we detect the emf is broken
Change-Id: I065635393763af774b45cbba6bd85c4334383b93
Reviewed-on: https://gerrit.libreoffice.org/56458
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
(cherry picked from commit 8e5441469e07e85c5bd278ac5777eb2b550f900a)
diff --git a/cppcanvas/source/mtfrenderer/emfplus.cxx b/cppcanvas/source/mtfrenderer/emfplus.cxx
index b97f6c22fc48..0864c268c4e4 100644
--- a/cppcanvas/source/mtfrenderer/emfplus.cxx
+++ b/cppcanvas/source/mtfrenderer/emfplus.cxx
@@ -1859,11 +1859,14 @@ namespace cppcanvas
if (size < 12) {
SAL_INFO("cppcanvas.emf", "Size field is less than 12 bytes");
+ break;
} else if (size > length) {
SAL_INFO("cppcanvas.emf", "Size field is greater than bytes left");
+ break;
}
if (dataSize > (size-12)) {
SAL_INFO("cppcanvas.emf", "DataSize field is greater than Size-12");
+ break;
}
SAL_INFO("cppcanvas.emf", "EMF+ record size: " << size << " type: " << emfTypeToName(type) << " flags: " << flags << " data size: " << dataSize);
commit 2bc848f226a6387fe42a8008dc2e1a05cc8ae9cd
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Jun 12 12:14:36 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 14:08:20 2019 +0200
forcepoint#45 object may not be a EMFPPen
Change-Id: Ifb5c17e13faf6e9d246e1668ef7916957a5296b6
Reviewed-on: https://gerrit.libreoffice.org/55679
Tested-by: Jenkins
Reviewed-by: Eike Rathke <erack at redhat.com>
(cherry picked from commit d5db9b8a8f99bed76c9a3e195a28049d677610a9)
diff --git a/cppcanvas/source/mtfrenderer/emfplus.cxx b/cppcanvas/source/mtfrenderer/emfplus.cxx
index 3e041557ee96..b97f6c22fc48 100644
--- a/cppcanvas/source/mtfrenderer/emfplus.cxx
+++ b/cppcanvas/source/mtfrenderer/emfplus.cxx
@@ -1615,7 +1615,7 @@ namespace cppcanvas
void ImplRenderer::EMFPPlusDrawPolygon (const ::basegfx::B2DPolyPolygon& polygon, const ActionFactoryParameters& rParms,
OutDevState& rState, const CanvasSharedPtr& rCanvas, sal_uInt32 penIndex)
{
- EMFPPen* pen = static_cast<EMFPPen*>( aObjects [penIndex & 0xff] );
+ EMFPPen* pen = dynamic_cast<EMFPPen*>( aObjects [penIndex & 0xff] );
SAL_WARN_IF( !pen, "cppcanvas.emf", "emf+ missing pen" );
commit 53a483d08a71f2bff6d349eac66b636cb45af40d
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon May 28 21:51:01 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 14:08:20 2019 +0200
forcepoint#42 check available str length
Change-Id: Ie476968ddaa4c3e5475ae9aa6133e7aba38d5975
Reviewed-on: https://gerrit.libreoffice.org/54978
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
(cherry picked from commit 15ea1cda0b3c37ff944ad9a239b7ed453e8b0591)
diff --git a/basic/source/comp/scanner.cxx b/basic/source/comp/scanner.cxx
index 6dfe2c589bbf..784122d6d7c1 100644
--- a/basic/source/comp/scanner.cxx
+++ b/basic/source/comp/scanner.cxx
@@ -543,7 +543,7 @@ bool SbiScanner::NextSym()
case '>': if( *pLine == '=' ) n = 2; break;
case ':': if( *pLine == '=' ) n = 2; break;
}
- aSym = aLine.copy( nCol, n );
+ aSym = aLine.copy(nCol, std::min(n, aLine.getLength() - nCol));
pLine += n-1; nCol = nCol + n;
}
commit b8eb36a333684694f95388a6a57742d3ae1c5fe4
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon May 28 21:36:16 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 14:08:20 2019 +0200
forcepoint#41 null deref
Change-Id: I16e9e083811c6e14861da1ba1df7d46e8c8771d7
Reviewed-on: https://gerrit.libreoffice.org/54974
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
(cherry picked from commit 0a2035492c66bc323d84ad6c2c4cbc0dc3c9d9aa)
diff --git a/drawinglayer/source/texture/texture3d.cxx b/drawinglayer/source/texture/texture3d.cxx
index a3915d5f290d..127cb71b729b 100644
--- a/drawinglayer/source/texture/texture3d.cxx
+++ b/drawinglayer/source/texture/texture3d.cxx
@@ -75,8 +75,6 @@ namespace drawinglayer
mbIsTransparent(maBitmapEx.IsTransparent())
{
// #121194# Todo: use alpha channel, too (for 3d)
- mpReadBitmap = maBitmapEx.GetBitmap().AcquireReadAccess();
- OSL_ENSURE(mpReadBitmap, "GeoTexSvxBitmapEx: Got no read access to Bitmap (!)");
if(mbIsTransparent)
{
@@ -93,8 +91,13 @@ namespace drawinglayer
mpReadTransparence = maTransparence.AcquireReadAccess();
}
- mfMulX = (double)mpReadBitmap->Width() / maSize.getX();
- mfMulY = (double)mpReadBitmap->Height() / maSize.getY();
+ mpReadBitmap = maBitmapEx.GetBitmap().AcquireReadAccess();
+ SAL_WARN_IF(!mpReadBitmap, "drawinglayer", "GeoTexSvxBitmapEx: Got no read access to Bitmap");
+ if (mpReadBitmap)
+ {
+ mfMulX = static_cast<double>(mpReadBitmap->Width()) / maSize.getX();
+ mfMulY = static_cast<double>(mpReadBitmap->Height()) / maSize.getY();
+ }
if(maSize.getX() <= 1.0)
{
commit cd8dda95c1647de8f1f0de092b1e30f2dbced22d
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon May 28 21:22:56 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 14:08:19 2019 +0200
forcepoint#40 null deref
presumably since
commit 0098bee792c3e208ea4f6ef1c676958d3f4cd207
Date: Thu Sep 21 06:48:09 2017 +0200
tdf#112501: Pivot table: popupbuttons are placed on wrong cells
Change-Id: I5413c0ba06fca25cb22256a20ef9640767dd9e50
Reviewed-on: https://gerrit.libreoffice.org/54970
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
(cherry picked from commit 69c5be9b26cf1a45e220d69f65b1bb0fa2aedaf6)
diff --git a/sc/qa/unit/data/xls/forcepoint-pivot-1.xls b/sc/qa/unit/data/xls/forcepoint-pivot-1.xls
new file mode 100644
index 000000000000..12919922666b
Binary files /dev/null and b/sc/qa/unit/data/xls/forcepoint-pivot-1.xls differ
diff --git a/sc/source/filter/excel/xipivot.cxx b/sc/source/filter/excel/xipivot.cxx
index 11fe5a15bde4..85f178379a7c 100644
--- a/sc/source/filter/excel/xipivot.cxx
+++ b/sc/source/filter/excel/xipivot.cxx
@@ -1507,13 +1507,13 @@ void XclImpPivotTable::ApplyMergeFlags(const ScRange& rOutRange, const ScDPSaveD
itr = aFieldBtns.begin();
itrEnd = aFieldBtns.end();
vector<const ScDPSaveDimension*>::const_iterator itDim = aFieldDims.begin();
- for (; itr != itrEnd; ++itr, ++itDim)
+ for (; itr != itrEnd; ++itr)
{
ScMF nMFlag = ScMF::Button;
- const ScDPSaveDimension* pDim = *itDim;
- if (pDim->HasInvisibleMember())
+ const ScDPSaveDimension* pDim = itDim != aFieldDims.end() ? *itDim++ : nullptr;
+ if (pDim && pDim->HasInvisibleMember())
nMFlag |= ScMF::HiddenMember;
- if (!pDim->IsDataLayout())
+ if (!pDim || !pDim->IsDataLayout())
nMFlag |= ScMF::ButtonPopup;
rDoc.ApplyFlagsTab(itr->Col(), itr->Row(), itr->Col(), itr->Row(), itr->Tab(), nMFlag);
}
commit 348359a7573f4e2e13382cc38551926bf1fd6720
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon May 14 16:50:30 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 14:08:19 2019 +0200
ofz#7322 lcl_MarkEqualByStart sort logic differs from that of operator==
when it encounters a SwPosition with a SwIndex nContent whose m_pIndexReg is
null and compares to one whose m_pIndexReg is not null, where both have an
m_nIndex of 0.
operator== considers them different, while lcl_MarkEqualByStart doesn't care
and sorts them as equal
Change-Id: I29920b98c9e6f395487de1b9cafa6b1282b2b1b6
Reviewed-on: https://gerrit.libreoffice.org/54342
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
(cherry picked from commit b3aece104b886618552828c168a1b51b3290f38f)
diff --git a/sw/qa/core/data/ww8/indeterminate/ofz7322-1.doc b/sw/qa/core/data/ww8/indeterminate/ofz7322-1.doc
new file mode 100644
index 000000000000..5f4858849acf
Binary files /dev/null and b/sw/qa/core/data/ww8/indeterminate/ofz7322-1.doc differ
diff --git a/sw/source/core/doc/docbm.cxx b/sw/source/core/doc/docbm.cxx
index 89252fb447cf..59937a578d8d 100644
--- a/sw/source/core/doc/docbm.cxx
+++ b/sw/source/core/doc/docbm.cxx
@@ -206,6 +206,13 @@ namespace
return false;
}
+ bool lcl_MarkEqualByStart(const IDocumentMarkAccess::pMark_t& rpFirst,
+ const IDocumentMarkAccess::pMark_t& rpSecond)
+ {
+ return !lcl_MarkOrderingByStart(rpFirst, rpSecond) &&
+ !lcl_MarkOrderingByStart(rpSecond, rpFirst);
+ }
+
IDocumentMarkAccess::iterator_t lcl_FindMark(
IDocumentMarkAccess::container_t& rMarks,
const IDocumentMarkAccess::pMark_t& rpMarkToFind)
@@ -216,7 +223,7 @@ namespace
// since there are usually not too many marks on the same start
// position, we are not doing a bisect search for the upper bound
// but instead start to iterate from pMarkLow directly
- while(ppCurrentMark != rMarks.end() && **ppCurrentMark == *rpMarkToFind)
+ while (ppCurrentMark != rMarks.end() && lcl_MarkEqualByStart(*ppCurrentMark, rpMarkToFind))
{
if(ppCurrentMark->get() == rpMarkToFind.get())
{
commit 2d6328354c9b83bbdf303ed6e5287e2c99d19b3a
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri May 11 09:27:49 2018 +0100
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 14:08:19 2019 +0200
Related: ofz#8226 + valgrind: uninitialized value
Change-Id: I63dea876dffe2d9e17b506dbd8515da2d97fbf08
Reviewed-on: https://gerrit.libreoffice.org/54114
Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
Tested-by: Jenkins <ci at libreoffice.org>
(cherry picked from commit 0ec74577a97ca51d50e0f3782c289c95c6430641)
diff --git a/starmath/source/mathtype.cxx b/starmath/source/mathtype.cxx
index d18ef6386445..2138c48747a5 100644
--- a/starmath/source/mathtype.cxx
+++ b/starmath/source/mathtype.cxx
@@ -2841,7 +2841,7 @@ void MathType::HandleSetSize()
bool MathType::HandleChar(sal_Int32 &rTextStart, int &rSetSize, int nLevel,
sal_uInt8 nTag, sal_uInt8 nSelector, sal_uInt8 nVariation, bool bSilent)
{
- sal_Unicode nChar;
+ sal_Unicode nChar(0);
bool bRet = true;
if (xfAUTO(nTag))
@@ -2854,7 +2854,7 @@ bool MathType::HandleChar(sal_Int32 &rTextStart, int &rSetSize, int nLevel,
pS->ReadUChar( nTypeFace );
if (nVersion < 3)
{
- sal_uInt8 nChar8;
+ sal_uInt8 nChar8(0);
pS->ReadUChar( nChar8 );
nChar = nChar8;
}
commit 49f56e5b7f94db0269de927c36f649849ea5b99a
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Mar 12 14:13:23 2018 +0000
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 14:08:19 2019 +0200
forcepoint #27 check region bands loaded from stream for consistency
Change-Id: I92376b5fb4208c78fa25a94d4dd394256793161c
Reviewed-on: https://gerrit.libreoffice.org/51145
Tested-by: Jenkins <ci at libreoffice.org>
Reviewed-by: Michael Stahl <mstahl at redhat.com>
(cherry picked from commit 2a63eb8ba642b58814f8a78ba65a2c537aa97cdf)
diff --git a/vcl/inc/regionband.hxx b/vcl/inc/regionband.hxx
index 91a13ebffcbf..11a19314a2f5 100644
--- a/vcl/inc/regionband.hxx
+++ b/vcl/inc/regionband.hxx
@@ -36,6 +36,7 @@ private:
ImplRegionBand* mpLastCheckedBand;
void implReset();
+ SAL_WARN_UNUSED_RESULT bool CheckConsistency() const;
public:
RegionBand();
@@ -46,7 +47,7 @@ public:
bool operator==( const RegionBand& rRegionBand ) const;
- void load(SvStream& rIStrm);
+ SAL_WARN_UNUSED_RESULT bool load(SvStream& rIStrm);
void save(SvStream& rIStrm) const;
bool isSingleRectangle() const;
diff --git a/vcl/source/gdi/region.cxx b/vcl/source/gdi/region.cxx
index 48a5cc026031..1148936f0a3e 100644
--- a/vcl/source/gdi/region.cxx
+++ b/vcl/source/gdi/region.cxx
@@ -1573,7 +1573,7 @@ SvStream& ReadRegion(SvStream& rIStrm, vcl::Region& rRegion)
default:
{
RegionBand* pNewRegionBand = new RegionBand();
- pNewRegionBand->load(rIStrm);
+ bool bSuccess = pNewRegionBand->load(rIStrm);
rRegion.mpRegionBand.reset(pNewRegionBand);
if(aCompat.GetVersion() >= 2)
@@ -1590,6 +1590,12 @@ SvStream& ReadRegion(SvStream& rIStrm, vcl::Region& rRegion)
}
}
+ if (!bSuccess)
+ {
+ SAL_WARN("vcl.gdi", "bad region band");
+ rRegion.SetNull();
+ }
+
break;
}
}
diff --git a/vcl/source/gdi/regionband.cxx b/vcl/source/gdi/regionband.cxx
index 44663759e217..f161d4e8c17f 100644
--- a/vcl/source/gdi/regionband.cxx
+++ b/vcl/source/gdi/regionband.cxx
@@ -190,7 +190,7 @@ bool RegionBand::operator==( const RegionBand& rRegionBand ) const
enum StreamEntryType { STREAMENTRY_BANDHEADER, STREAMENTRY_SEPARATION, STREAMENTRY_END };
-void RegionBand::load(SvStream& rIStrm)
+bool RegionBand::load(SvStream& rIStrm)
{
// clear this instance data
implReset();
@@ -203,14 +203,14 @@ void RegionBand::load(SvStream& rIStrm)
rIStrm.ReadUInt16(nTmp16);
if (STREAMENTRY_END == (StreamEntryType)nTmp16)
- return;
+ return false;
size_t nRecordsPossible = rIStrm.remainingSize() / (2*sizeof(sal_Int32));
if (!nRecordsPossible)
{
OSL_ENSURE(false, "premature end of region stream" );
implReset();
- return;
+ return false;
}
do
@@ -259,13 +259,19 @@ void RegionBand::load(SvStream& rIStrm)
{
OSL_ENSURE(false, "premature end of region stream" );
implReset();
- return;
+ return false;
}
// get next header
rIStrm.ReadUInt16( nTmp16 );
}
while (STREAMENTRY_END != (StreamEntryType)nTmp16 && rIStrm.good());
+ if (!CheckConsistency())
+ {
+ implReset();
+ return false;
+ }
+ return true;
}
void RegionBand::save(SvStream& rOStrm) const
@@ -1155,6 +1161,19 @@ bool RegionBand::Exclude(const RegionBand& rSource)
return true;
}
+bool RegionBand::CheckConsistency() const
+{
+ // look in the band list (don't test first band again!)
+ const ImplRegionBand* pBand = mpFirstBand->mpNextBand;
+ while (pBand)
+ {
+ if (!pBand->mpFirstSep)
+ return false;
+ pBand = pBand->mpNextBand;
+ }
+ return true;
+}
+
Rectangle RegionBand::GetBoundRect() const
{
commit 45dda87917c3dc37b44929a6b0e507a13ea7184d
Author: Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Mar 8 21:25:28 2018 +0000
Commit: Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Fri Aug 2 14:08:19 2019 +0200
forcepoint #21 pop on empty stack
Thanks to Antti Levomäki and Christian Jalio from Forcepoint.
Change-Id: I25b1c6361fb0a3ae6b01f2be870c9e1b49bf5b84
Reviewed-on: https://gerrit.libreoffice.org/51115
Reviewed-by: Michael Stahl <mstahl at redhat.com>
Tested-by: Jenkins <ci at libreoffice.org>
(cherry picked from commit 3686a3fc1b2eaee53b1ab32f33455b2b37aa8c6e)
diff --git a/sw/qa/core/data/rtf/fail/forcepoint-4.rtf b/sw/qa/core/data/rtf/fail/forcepoint-4.rtf
new file mode 100755
index 000000000000..ccd04d451b10
--- /dev/null
+++ b/sw/qa/core/data/rtf/fail/forcepoint-4.rtf
@@ -0,0 +1,1779 @@
+{\rtf1\ansi \deff4\deflang1033{\fonttbl{\f0\froman\fcharset0\fprq2 Tms Rmn;}{\f1\froman\fcharset2\fprq2 Symbol;}{\f2\fswiss\fcharset0\fprq2 Helv{\*\falt Arial};}{\f3\fmodern\fcharset0\fprq1 Courier;}
+{\f4\froman\fcharset0\fprq2 Times New Roman;}{\f5\fswiss\fcharset0\fprq2 Arial;}{\f6\froman\fcharset0\fprq2 MS Serif;}{\f7\fswiss\fcharset0\fprq2 MS Sans Serif;}{\f8\froman\fcharset0\fprq2 Times;}{\f9\fswiss\fcharset0\fprq2 Helvetica;}
+{\f10\fswiss\fcharset0\fprq2 System;}{\f11\fmodern\fcharset0\fprq1 Courier New;}{\f12\froman\fcharset0\fprq2 New York;}{\f13\fswiss\fcharset0\fprq2 Geneva;}{\f14\fnil\fcharset2\fprq2 Marlett;}{\f15\fnil\fcharset2\fprq2 Wingdings;}
+{\f16\fswiss\fcharset0\fprq2 Arial Narrow;}{\f17\fswiss\fcharset0\fprq2 Arial Black;}{\f18\froman\fcharset0\fprq2 Book Antiqua;}{\f19\froman\fcharset0\fprq2 Bookman Old Style;}{\f20\froman\fcharset0\fprq2 Century Schoolbook;}
+{\f21\fnil\fcharset2\fprq2 Monotype Sorts;}{\f22\fswiss\fcharset0\fprq2 Haettenschweiler;}{\f23\froman\fcharset0\fprq2 Garamond;}{\f24\fmodern\fcharset2\fprq1 MS LineDraw;}{\f25\fswiss\fcharset0\fprq2 Helvetica-Narrow;}
+{\f26\froman\fcharset255\fprq2 Roman;}{\f27\fscript\fcharset255\fprq2 Script;}{\f28\fmodern\fcharset255\fprq2 Modern;}{\f29\fswiss\fcharset0\fprq1 MS Dialog;}{\f30\froman\fcharset0\fprq2 Bookman{\*\falt Bookman Old Style};}
+{\f31\fnil\fcharset0\fprq0 Times New Roman Monotype{\*\falt Times New Roman};}{\f32\fnil\fcharset0\fprq0 Stone Sans{\*\falt Times New Roman};}{\f33\froman\fcharset0\fprq2 Palatino;}{\f34\fnil\fcharset0\fprq0 Arial Monotype;}}{\colortbl;\red0\green0\blue0;
+\red0\green0\blue255;\red0\green255\blue255;\red0\green255\blue0;\red255\green0\blue255;\red255\green0\blue0;\red255\green255\blue0;\red255\green255\blue255;\red0\green0\blue128;\red0\green128\blue128;\red0\green128\blue0;\red128\green0\blue128;
+\red128\green0\blue0;\red128\green128\blue0;\red128\green128\blue128;\red192\green192\blue192;}{\stylesheet{\widctlpar \f4\fs20 \snext0 Normal;}{\s1\sb240\sa60\keepn\widctlpar{\*\pn \pnlvl1\pndec\pnprev1\pnstart1\pnsp144 {\pntxta .}}\b\f5\fs28\kerning28
+\sbasedon0\snext0 heading 1,H1;}{\s2\sb380\sa160\sl-320\slmult0\keepn\nowidctlpar\tqr\tx432\tx864{\*\pn \pnlvl2\pndec\pnprev1\pnstart1\pnsp144 }\b\f9\fs28\cf1 \sbasedon15\snext0 heading 2,H2;}{\s3\sb280\sa140\sl-280\slmult0
+\keepn\nowidctlpar\tqr\tx432\tx864{\*\pn \pnlvl3\pndec\pnprev1\pnstart1\pnsp144 {\pntxtb .}}\b\f9\cf1\kerning28 \sbasedon2\snext16 heading 3,H3;}{\s4\sb120\sa80\keep\keepn\widctlpar{\*\pn \pnlvl4\pndec\pnprev1\pnstart1\pnsp144 {\pntxtb .}}
+\b\i\f9\fs20\kerning28 \sbasedon0\snext16 heading 4,H4;}{\s5\sb240\sa60\widctlpar{\*\pn \pnlvl5\pndec\pnprev1\pnstart1\pnsp144 {\pntxtb .}}\f5\fs22 \sbasedon0\snext0 heading 5,H5;}{\s6\sb240\sa60\widctlpar{\*\pn \pnlvl6\pndec\pnprev1\pnstart1\pnsp144
+{\pntxtb .}}\i\f5\fs22 \sbasedon0\snext0 heading 6,H6;}{\s7\sb240\sa60\widctlpar{\*\pn \pnlvl7\pndec\pnprev1\pnstart1\pnsp144 {\pntxtb .}}\f5\fs20 \sbasedon0\snext0 heading 7;}{\s8\sb240\sa60\widctlpar{\*\pn \pnlvl8\pndec\pnprev1\pnstart1\pnsp144
+{\pntxtb .}}\i\f5\fs20 \sbasedon0\snext0 heading 8;}{\s9\sb240\sa60\widctlpar{\*\pn \pnlvl9\pndec\pnprev1\pnstart1\pnsp144 {\pntxtb .}}\i\f5\fs18 \sbasedon0\snext0 heading 9;}{\*\cs10 \additive Default Paragraph Font;}{\s15\li864\sb100\sl-260\slmult0
+\nowidctlpar \f8\fs20\cf1 \snext15 T1.Text1;}{\s16\sa120\widctlpar \f4\fs20 \sbasedon0\snext16 Body Text;}{\s17\fi-288\li1655\sb100\sa100\sl-260\slmult0\keepn\nowidctlpar\tx1655 \f8\fs20\cf1 \snext17 A.A+List;}{
+\s18\fi-288\li1655\sb100\sa100\sl-260\slmult0\nowidctlpar\tx1655\tx1958 \f8\fs20\cf1 \snext18 A.AList;}{\s19\li1655\sb100\sa100\sl-260\slmult0\keepn\nowidctlpar\tx1655 \f31\fs20\cf1 \snext19 A.AList_nonum;}{\s20\qc\nowidctlpar \f8\fs4\cf1 \snext20
+anchorhldr;}{\s21\fi-792\li2015\sb100\sa100\sl-260\slmult0\nowidctlpar\tx2015 \f8\fs20\cf1 \snext21 b1.Bul_list;}{\s22\fi-289\li1224\sb100\sa100\sl-260\slmult0\nowidctlpar\tx1224\tldot\tx3685 \f8\fs20\cf1 \snext22 b1.Bullet1;}{
+\s23\fi-289\li1584\sb100\sa100\sl-260\slmult0\nowidctlpar\tx1584\tldot\tx3685 \f8\fs20\cf1 \snext23 b2.Bullet2;}{\s24\li864\sb100\sa140\sl-380\slmult0\keepn\nowidctlpar\tqr\tx432\tx864 \b\f9\fs36\cf1 \snext24 chptr_title;}{\s25\li1224\sb100\sl-200\slmult0
+\nowidctlpar\tx1440\tx1800\tx2160\tx2520\tx2880\tx3240\tx3600\tx3960\tx4320\tx4680\tx5040\tx5400\tx5760\tx6120\tx6480\tx6840\tx7200\tx7560\tx7920\tx8280\tx8640 \f3\fs16\cf1 \snext25 Code;}{\s26\fi-1008\li1007\sb100\sl-200\slmult0\nowidctlpar\tx1007
+\f3\fs18\cf1 \snext26 EN.EdNote;}{\s27\fi-1008\li1871\sb120\sa100\sl-200\slmult0\nowidctlpar\brdrb\brdrs\brdrw15 \tx1871 \f9\fs18\cf1 \snext27 Fg.Figure;}{\s28\fi-288\li1007\sa60\sl-180\slmult0\nowidctlpar\brdrt\brdrs\brdrw15 \tx1007 \f8\fs16\cf1
+\snext28 FN.Footnote;}{\s29\widctlpar\tqc\tx4320\tqr\tx8640 \f4\fs20 \sbasedon0\snext29 footer;}{\s30\fi-288\li1152\ri1152\sa60\sl200\slmult0\nowidctlpar\tx1152 \f8\fs16\cf1 \snext30 Footnote;}{\s31\li1295\sb100\sa100\sl-260\slmult0\nowidctlpar
+\f8\fs20\cf1 \snext31 glosry_nxt;}{\s32\fi-432\li1295\sb100\sa100\sl-260\slmult0\nowidctlpar \f8\fs20\cf1 \snext32 glossary;}{\s33\sb120\sa120\sl-220\slmult0\keepn\nowidctlpar\tqr\tx432\tx864 \b\f9\fs20\cf1 \snext33 H1.Heading1;}{
+\s34\fi-865\li864\sb380\sa160\sl-320\slmult0\keepn\nowidctlpar\tqr\tx432\tx864 \b\f9\fs28\cf1 \snext34 H2.Heading2;}{\s35\fi-865\li864\sb280\sa140\sl-280\slmult0\keepn\nowidctlpar\tqr\tx432\tx864 \b\f9\cf1 \snext35 H3.Heading3;}{
+\s36\fi-865\li864\sb320\sa160\sl-320\slmult0\keepn\nowidctlpar\tqr\tx432\tx864 \b\f9\fs28\cf1 \snext36 H3.Heading3_top;}{\s37\fi-865\li864\sb240\sa160\sl-200\slmult0\keepn\nowidctlpar\tqr\tx432\tx864\tqr\tx8567 \b\f9\fs20\cf1 \snext37 H4.Heading4;}{
+\s38\li864\sb160\sa100\sl-180\slmult0\keepn\nowidctlpar\tqr\tx432\tx864 \b\f9\fs18\cf1 \snext38 H5.Heading5;}{\s39\li1440\sb100\sa100\sl-260\slmult0\nowidctlpar\tx1224\tldot\tx3685 \f8\fs20\cf1 \snext39 indent1;}{\s40\li864\sb100\sl-260\slmult0
+\nowidctlpar\brdrt\brdrs\brdrw15 \f8\fs20\cf1 \snext40 IR.Impl_Rec;}{\s41\fi-289\li1224\sb100\sa100\sl-260\slmult0\nowidctlpar\tx1224 \f8\fs20\cf1 \snext41 N.NList;}{\s42\li1224\sb100\sa100\sl-260\slmult0\nowidctlpar\tx1440 \f31\fs20\cf1 \snext42
+N.NList_nonum;}{\s43\fi-289\li1224\sb100\sa100\sl-260\slmult0\nowidctlpar\tx1224 \f8\fs20\cf1 \snext43 N/.NList=1;}{\s44\li576\sb120\sa200\sl-479\slmult0\keepn\nowidctlpar\tx576 \f31\fs43\cf1 \snext44 PrT.PrfcTitle;}{
+\s45\fi-288\li1152\ri1152\sa80\sl-200\slmult0\nowidctlpar\tx1152\tx1871 \f8\fs16\cf1 \snext45 TableFootnote;}{\s46\fi-1008\li1871\sb200\sa200\sl-200\slmult0\nowidctlpar\tx1871 \f9\fs18\cf1 \snext46 Tb.Table;}{\s47\qc\sb120\sl-180\slmult0
+\keepn\nowidctlpar \b\f9\fs16\cf1 \snext47 TbH.TblHdctr;}{\s48\sb140\sl-200\slmult0\keepn\nowidctlpar \b\f9\fs18\cf1 \snext48 TbH.TblHdLft;}{\s49\qr\sb140\sl-200\slmult0\keepn\nowidctlpar \b\f9\fs18\cf1 \snext49 TbH.TblHdRt;}{
+\s50\qc\sb180\sa120\sl-220\slmult0\nowidctlpar \f8\fs16\cf1 \snext50 TbT.TblTxtCtr;}{\s51\sb180\sa120\sl-220\slmult0\nowidctlpar\tx144 \f8\fs16\cf1 \snext51 TbT.TblTxtLft;}{\s52\qr\sb180\sa120\sl-220\slmult0\nowidctlpar \f8\fs16\cf1 \snext52
+TbT.TblTxtRt;}{\s53\fi-289\li288\sb180\sa120\sl-220\slmult0\nowidctlpar\tx288 \f8\fs16\cf1 \snext53 TbTxt.N+;}{\s54\fi-289\li288\sb180\sa120\sl-220\slmult0\nowidctlpar\tx288 \f8\fs16\cf1 \snext54 TbTxt.N=1;}{\s55\sl-240\slmult0\nowidctlpar \f32\fs20\cf1
+\snext55 temp;}{\s56\fi-1081\li3120\sl-240\slmult0\nowidctlpar\tx3240\tqr\tldot\tx9119\tqr\tx9551 \f31\fs20 \snext56 Table1LOT;}{\s57\fi-360\li540\sl-200\slmult0\nowidctlpar \f31\fs18 \snext57 Level2IX;}{\s58\sb80\sa140\sl-220\slmult0
+\nowidctlpar\tx2520\tx4200\tx6480 \f33\fs20\cf1 \snext58 ML.ColsList;}{\s59\qj\sl-220\slmult0\nowidctlpar \f31\fs18\cf1 \snext59 IndexIX;}{\s60\fi-1081\li3120\sl-240\slmult0\nowidctlpar\tx3240\tqr\tldot\tx9119\tqr\tx9551 \f31\fs20\cf1 \snext60
+Table-pageLOT;}{\s61\fi-1200\li3240\sl-240\slmult0\nowidctlpar\tx3240\tqr\tldot\tx9119\tqr\tx9551 \f31\fs20 \snext61 Figure1-pageLOF;}{\s62\qj\sl-240\slmult0\nowidctlpar\tqr\tx9240 \f32\fs20\cf8 \snext62 HeaderRight;}{\s63\qj\sl-220\slmult0\nowidctlpar
+\f31\fs18 \snext63 SortOrderIX;}{\s64\fi-720\li2700\sb120\sl-320\slmult0\nowidctlpar\tqr\tx2520\tx2700 \f31\fs28\cf1 \snext64 1HeadingTOC;}{\s65\fi-1081\li3120\sl-240\slmult0\nowidctlpar\tx3240\tqr\tldot\tx9119\tqr\tx9551 \f31\fs20 \snext65
+Table-page1LOT;}{\s66\qj\sl-100\slmult0\nowidctlpar\tx540\tqr\tx9240 \f33\fs8\cf1 \snext66 spacer;}{\s67\sb180\sl-180\slmult0\keepn\nowidctlpar \f34\fs18\cf1 \snext67 GroupTitlesIX;}{\s68\fi-1200\li3240\sl-240\slmult0
+\nowidctlpar\tx3240\tqr\tldot\tx9119\tqr\tx9551 \f31\fs20\cf1 \snext68 FigureLOF;}{\s69\sb259\sl-200\slmult0\keepn\nowidctlpar\tx2520\tx4200\tx6480 \b\f9\fs18\cf1 \snext69 MH.ColsHd;}{\s70\sb80\sa80\sl-200\slmult0\nowidctlpar \f31\fs18 \snext70
+TbT2.TblText2;}{\s71\fi-1200\li3240\sl-240\slmult0\nowidctlpar\tx3240\tqr\tldot\tx9119\tqr\tx9551 \f31\fs20 \snext71 Figure-pageLOF;}{\s72\sb140\sl-200\slmult0\keepn\nowidctlpar \f31\fs18\cf1 \snext72 TbH.TblHd;}{\s73\li1320\sl-240\slmult0\nowidctlpar
... etc. - the rest is truncated
More information about the Libreoffice-commits
mailing list