[Libreoffice-commits] core.git: Branch 'distro/cib/libreoffice-5-2' - 128 commits - accessibility/source basic/source bin/distro-install-file-lists cppcanvas/source drawinglayer/source editeng/source filter/source hwpfilter/source include/oox include/sfx2 include/xmloff lotuswordpro/source officecfg/Configuration_officecfg.mk officecfg/registry oox/source package/source postprocess/CustomTarget_registry.mk Repository.mk RepositoryModule_host.mk sal/textenc sax/source sc/inc scp2/AutoInstall.mk scp2/InstallModule_python.mk sc/qa sc/source sd/source setup_native/source sfx2/source solenv/bin starmath/source svl/source svx/source sw/inc sw/qa sw/source vcl/headless vcl/inc vcl/source vcl/win writerfilter/source xmloff/source xmlsecurity/source

Michael Stahl (via logerrit) logerrit at kemper.freedesktop.org
Tue Aug 6 16:07:55 UTC 2019


 Repository.mk                                                          |    4 
 RepositoryModule_host.mk                                               |    1 
 accessibility/source/extended/accessibletabbarbase.cxx                 |    2 
 basic/source/comp/scanner.cxx                                          |    2 
 bin/distro-install-file-lists                                          |    3 
 cppcanvas/source/mtfrenderer/emfplus.cxx                               |    5 
 drawinglayer/source/texture/texture3d.cxx                              |   11 
 editeng/source/editeng/impedit2.cxx                                    |    9 
 filter/source/graphicfilter/icgm/class4.cxx                            |    6 
 filter/source/graphicfilter/idxf/dxftblrd.cxx                          |    9 
 filter/source/graphicfilter/ieps/ieps.cxx                              |    8 
 filter/source/graphicfilter/itiff/itiff.cxx                            |    2 
 filter/source/msfilter/msdffimp.cxx                                    |   59 
 filter/source/msfilter/svdfppt.cxx                                     |   28 
 filter/source/xsltfilter/OleHandler.cxx                                |    2 
 hwpfilter/source/drawing.h                                             |    2 
 hwpfilter/source/hiodev.cxx                                            |    3 
 hwpfilter/source/hwpread.cxx                                           |    7 
 include/oox/vml/vmlshapecontainer.hxx                                  |    8 
 include/oox/vml/vmlshapecontext.hxx                                    |    9 
 include/sfx2/objsh.hxx                                                 |    2 
 include/xmloff/xmltoken.hxx                                            |    2 
 lotuswordpro/source/filter/lwpfrib.cxx                                 |    2 
 lotuswordpro/source/filter/lwpsilverbullet.hxx                         |    4 
 officecfg/Configuration_officecfg.mk                                   |    3 
 officecfg/registry/data/org/openoffice/Office/UI/WriterWindowState.xcu |   14 
 oox/source/crypto/AgileEngine.cxx                                      |    2 
 oox/source/crypto/CryptTools.cxx                                       |    2 
 oox/source/drawingml/fillproperties.cxx                                |    2 
 oox/source/drawingml/shapecontext.cxx                                  |    4 
 oox/source/drawingml/table/tableproperties.cxx                         |    6 
 oox/source/drawingml/textbody.cxx                                      |    3 
 oox/source/shape/WpsContext.cxx                                        |   13 
 oox/source/vml/vmlformatting.cxx                                       |   22 
 oox/source/vml/vmlshape.cxx                                            |    3 
 oox/source/vml/vmlshapecontainer.cxx                                   |    4 
 oox/source/vml/vmlshapecontext.cxx                                     |   30 
 package/source/zipapi/ZipFile.cxx                                      |    8 
 postprocess/CustomTarget_registry.mk                                   |    6 
 sal/textenc/tcvtkr6.tab                                                |   12 
 sax/source/expatwrap/xml2utf.cxx                                       |    8 
 sc/inc/dbdata.hxx                                                      |    9 
 sc/qa/unit/data/slk/pass/numfmt-2.slk                                  |    1 
 sc/qa/unit/data/slk/pass/numfmt.slk                                    |    2 
 sc/qa/unit/data/xls/forcepoint-pivot-1.xls                             |binary
 sc/qa/unit/ucalc_sharedformula.cxx                                     |    4 
 sc/source/core/data/column3.cxx                                        |    2 
 sc/source/core/data/document.cxx                                       |    2 
 sc/source/core/data/dptabres.cxx                                       |    8 
 sc/source/core/tool/compiler.cxx                                       |    8 
 sc/source/filter/excel/xipivot.cxx                                     |    8 
 sc/source/filter/inc/formel.hxx                                        |   30 
 sc/source/filter/rtf/eeimpars.cxx                                      |    2 
 sc/source/filter/rtf/rtfparse.cxx                                      |    2 
 sc/source/filter/xml/XMLTableShapeImportHelper.cxx                     |    2 
 sc/source/filter/xml/xmldrani.cxx                                      |    5 
 sc/source/ui/docshell/dbdocfun.cxx                                     |    1 
 sc/source/ui/docshell/impex.cxx                                        |   34 
 scp2/AutoInstall.mk                                                    |    1 
 scp2/InstallModule_python.mk                                           |    6 
 sd/source/filter/ppt/pptin.cxx                                         |    2 
 setup_native/source/packinfo/packinfo_office.txt                       |   17 
 sfx2/source/doc/objmisc.cxx                                            |   33 
 sfx2/source/notify/eventsupplier.cxx                                   |   18 
 solenv/bin/modules/installer/epmfile.pm                                |   12 
 starmath/source/mathmlimport.cxx                                       |   17 
 starmath/source/mathtype.cxx                                           |    4 
 svl/source/numbers/zformat.cxx                                         |    4 
 svl/source/numbers/zforscan.cxx                                        |    4 
 svx/source/svdraw/svdopath.cxx                                         |    3 
 svx/source/unodraw/unoshape.cxx                                        |    3 
 sw/inc/anchoredobject.hxx                                              |    1 
 sw/inc/docary.hxx                                                      |    8 
 sw/qa/core/data/odt/pass/tdf112017.odt                                 |binary
 sw/qa/core/data/odt/pass/tdf112101.odt                                 |binary
 sw/qa/core/data/rtf/fail/forcepoint-4.rtf                              | 1779 ++++++++++
 sw/qa/core/data/ww8/fail/forcepoint-44.doc                             |binary
 sw/qa/core/data/ww8/indeterminate/ofz7322-1.doc                        |binary
 sw/qa/core/data/ww8/pass/forcepoint-layout-1.doc                       |binary
 sw/qa/extras/odfexport/data/sender-initials.fodt                       |   71 
 sw/qa/extras/odfexport/odfexport.cxx                                   |   20 
 sw/qa/extras/uiwriter/data/tdf114536.odt                               |binary
 sw/qa/extras/uiwriter/uiwriter.cxx                                     |   45 
 sw/source/core/doc/DocumentContentOperationsManager.cxx                |    2 
 sw/source/core/doc/DocumentRedlineManager.cxx                          |   49 
 sw/source/core/doc/docbm.cxx                                           |    9 
 sw/source/core/doc/docredln.cxx                                        |    6 
 sw/source/core/inc/frame.hxx                                           |    2 
 sw/source/core/inc/ftnfrm.hxx                                          |    1 
 sw/source/core/inc/layouter.hxx                                        |    4 
 sw/source/core/layout/anchoredobject.cxx                               |    9 
 sw/source/core/layout/calcmove.cxx                                     |    1 
 sw/source/core/layout/flowfrm.cxx                                      |   18 
 sw/source/core/layout/fly.cxx                                          |    3 
 sw/source/core/layout/frmtool.cxx                                      |    7 
 sw/source/core/layout/ftnfrm.cxx                                       |   29 
 sw/source/core/layout/layouter.cxx                                     |   15 
 sw/source/core/layout/newfrm.cxx                                       |   24 
 sw/source/core/layout/objectformattertxtfrm.cxx                        |   27 
 sw/source/core/layout/objstmpconsiderwrapinfl.cxx                      |   27 
 sw/source/core/layout/objstmpconsiderwrapinfl.hxx                      |    1 
 sw/source/core/layout/pagechg.cxx                                      |    2 
 sw/source/core/layout/ssfrm.cxx                                        |    5 
 sw/source/core/layout/tabfrm.cxx                                       |    5 
 sw/source/core/layout/trvlfrm.cxx                                      |    8 
 sw/source/core/text/frmform.cxx                                        |   15 
 sw/source/core/text/itrform2.cxx                                       |   13 
 sw/source/core/unocore/unostyle.cxx                                    |    3 
 sw/source/filter/html/htmlctxt.cxx                                     |    1 
 sw/source/filter/ww8/ww8graf.cxx                                       |   15 
 sw/source/filter/ww8/ww8par.cxx                                        |   41 
 sw/source/filter/ww8/ww8par.hxx                                        |   16 
 sw/source/filter/ww8/ww8par2.cxx                                       |   39 
 sw/source/filter/ww8/ww8par3.cxx                                       |    8 
 sw/source/filter/ww8/ww8par4.cxx                                       |    4 
 sw/source/filter/ww8/ww8par5.cxx                                       |    9 
 sw/source/filter/ww8/ww8par6.cxx                                       |   31 
 sw/source/filter/ww8/ww8scan.cxx                                       |   63 
 sw/source/filter/ww8/ww8scan.hxx                                       |   11 
 vcl/headless/svpgdi.cxx                                                |   15 
 vcl/inc/regionband.hxx                                                 |    3 
 vcl/source/gdi/pngread.cxx                                             |    8 
 vcl/source/gdi/region.cxx                                              |    8 
 vcl/source/gdi/regionband.cxx                                          |   27 
 vcl/win/gdi/salfont.cxx                                                |    6 
 writerfilter/source/dmapper/DomainMapperTableHandler.cxx               |    7 
 writerfilter/source/dmapper/DomainMapper_Impl.cxx                      |   28 
 writerfilter/source/dmapper/PropertyMap.cxx                            |   12 
 writerfilter/source/ooxml/OOXMLDocumentImpl.cxx                        |    6 
 writerfilter/source/ooxml/OOXMLStreamImpl.cxx                          |   20 
 writerfilter/source/rtftok/rtfsdrimport.cxx                            |    2 
 xmloff/source/core/xmlexp.cxx                                          |    2 
 xmloff/source/core/xmltoken.cxx                                        |    2 
 xmloff/source/draw/XMLNumberStyles.cxx                                 |    5 
 xmloff/source/draw/ximppage.cxx                                        |    6 
 xmloff/source/text/txtflde.cxx                                         |    1 
 xmloff/source/text/txtfldi.cxx                                         |   10 
 xmloff/source/text/txtimp.cxx                                          |    1 
 xmloff/source/text/txtparai.cxx                                        |    5 
 xmlsecurity/source/helper/xmlsignaturehelper.cxx                       |   30 
 140 files changed, 2785 insertions(+), 442 deletions(-)

New commits:
commit 5a43955e1296b135b90dfcd3f9697d8669a4f742
Author:     Michael Stahl <Michael.Stahl at cib.de>
AuthorDate: Wed Jul 31 12:30:26 2019 +0200
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:37:09 2019 +0200

    solenv installer: don't let RPM generate config(...) Requires
    
    Fedora 30's rpm 4.14.2.1 will generate this Requires:
    config(lodevbasis6.1-core) = 6.1.7.0.0-1
    
    ... but no corresponding Provides because that's disabled, so the
    package cannot be installed.
    
    The reason is that there is one %config file in the -core rpm:
    %attr(0644,root,root) %config(noreplace) "/opt/libreofficedev6.1/./share/psprint/psprint.conf"
    
    Old RPM from CentOS6 does not generate these config requires.
    
    Unfortunately there doesn't appear to be a way to disable this
    config(...) without disabling AutoReq, so do that, and invoke the shell
    script find-requires-x11.sh manually from epmfile.pm.
    
    Change-Id: I7fee0d9cd1b9e79f81bd4c611500e84736564881
    Reviewed-on: https://gerrit.libreoffice.org/76736
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit b1d555ed42a035e0489accc19903c1ed8897bcee)
    (cherry picked from commit fa58f27bb421b449134e79c03a4fb8762ab18679)
    (cherry picked from commit fe51efc58dc04746282aaf641b5e4bd240d20da5)
    (cherry picked from commit 859d04d6d9d17b803686063a4b78ca105353dec8)

diff --git a/solenv/bin/modules/installer/epmfile.pm b/solenv/bin/modules/installer/epmfile.pm
index 3ee2ca0db107..dc3e665dddd3 100644
--- a/solenv/bin/modules/installer/epmfile.pm
+++ b/solenv/bin/modules/installer/epmfile.pm
@@ -1193,15 +1193,15 @@ sub set_autoprovreq_in_specfile
 {
     my ($changefile, $findrequires, $bindir) = @_;
 
-    my $autoreqprovline;
+    my $autoreqprovline = "AutoReqProv\: no\n";
 
     if ( $findrequires )
     {
-        $autoreqprovline = "AutoProv\: no\n%define _use_internal_dependency_generator 0\n%define __find_requires $bindir/$findrequires\n";
-    }
-    else
-    {
-        $autoreqprovline = "AutoReqProv\: no\n";
+        # don't let rpm invoke it, we never want to use AutoReq because
+        # rpm will generate Requires: config(packagename)
+        open (FINDREQUIRES, "echo | $bindir/$findrequires |");
+        while (<FINDREQUIRES>) { $autoreqprovline .= "Requires: $_\n"; }
+        close (FINDREQUIRES);
     }
 
     $autoreqprovline .= "%define _binary_filedigest_algorithm 1\n%define _binary_payload w9.gzdio\n";
commit a26a0fd2675103341ba42ce59f4275ba76b6c506
Author:     Michael Stahl <Michael.Stahl at cib.de>
AuthorDate: Mon Jul 29 12:28:26 2019 +0200
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:36:58 2019 +0200

    remove LibreLogo from build
    
    (cherry picked from commit e9d6950387a6e41f8f7b7d91921a2686defe136b)
    (cherry picked from commit 7d205ea105c9009a48f82b0732cf8f3a0a4167f6)
    
    Change-Id: I62b45ea4890f5693e7d12f2b8c4ae43a9a03d16e
    (cherry picked from commit c903537810c68e8b41bf74b0ed8b058b6c6dee5e)

diff --git a/Repository.mk b/Repository.mk
index 14a1c07e59c7..0204b9138f02 100644
--- a/Repository.mk
+++ b/Repository.mk
@@ -892,10 +892,6 @@ $(eval $(call gb_Helper_register_packages_for_install,python_scriptprovider, \
     scriptproviderforpython \
 ))
 
-$(eval $(call gb_Helper_register_packages_for_install,python_librelogo, \
-	librelogo \
-	librelogo_properties \
-))
 endif # DISABLE_PYTHON
 
 # External executables
diff --git a/RepositoryModule_host.mk b/RepositoryModule_host.mk
index d2f1d849b7fa..da121a6ddbbe 100644
--- a/RepositoryModule_host.mk
+++ b/RepositoryModule_host.mk
@@ -75,7 +75,6 @@ $(eval $(call gb_Module_add_moduledirs,libreoffice,\
 	jurt \
 	jvmaccess \
 	jvmfwk \
-	librelogo \
 	libreofficekit \
 	lingucomponent \
 	linguistic \
diff --git a/bin/distro-install-file-lists b/bin/distro-install-file-lists
index 2960f5fe0410..0bb77170d16b 100755
--- a/bin/distro-install-file-lists
+++ b/bin/distro-install-file-lists
@@ -142,14 +142,12 @@ if test "z$OOO_VENDOR" != "zDebian" ; then
             merge_flists gid_Module_Optional_Pymailmerge       $FILELISTSDIR/pyuno_list.txt
             merge_flists gid_Module_Pyuno                      $FILELISTSDIR/pyuno_list.txt
             merge_flists gid_Module_Script_Provider_For_Python $FILELISTSDIR/pyuno_list.txt
-            merge_flists gid_Module_Optional_Pyuno_LibreLogo   $FILELISTSDIR/pyuno_list.txt
             merge_flists gid_Module_Optional_Xsltfiltersamples $FILELISTSDIR/common_list.txt
         else
             merge_flists gid_Module_Optional_Grfflt            $FILELISTSDIR/common_list.txt
             merge_flists gid_Module_Optional_Headless          $FILELISTSDIR/common_list.txt
             merge_flists gid_Module_Optional_Pymailmerge       $FILELISTSDIR/mailmerge_list.txt
             merge_flists gid_Module_Pyuno                      $FILELISTSDIR/pyuno_list.txt
-            merge_flists gid_Module_Optional_Pyuno_LibreLogo   $FILELISTSDIR/pyuno_list.txt
             merge_flists gid_Module_Script_Provider_For_Python $FILELISTSDIR/pyuno_list.txt
             merge_flists gid_Module_Optional_Xsltfiltersamples $FILELISTSDIR/filters_list.txt
         fi
@@ -158,7 +156,6 @@ if test "z$OOO_VENDOR" != "zDebian" ; then
         merge_flists gid_Module_Optional_Headless          $FILELISTSDIR/common_list.txt
         merge_flists gid_Module_Optional_Pymailmerge       $FILELISTSDIR/common_list.txt
         merge_flists gid_Module_Pyuno                      $FILELISTSDIR/common_list.txt
-        merge_flists gid_Module_Optional_Pyuno_LibreLogo   $FILELISTSDIR/common_list.txt
         merge_flists gid_Module_Script_Provider_For_Python $FILELISTSDIR/common_list.txt
         merge_flists gid_Module_Optional_Xsltfiltersamples $FILELISTSDIR/common_list.txt
     fi
diff --git a/officecfg/Configuration_officecfg.mk b/officecfg/Configuration_officecfg.mk
index 1768f4e425a8..adf801fa6f64 100644
--- a/officecfg/Configuration_officecfg.mk
+++ b/officecfg/Configuration_officecfg.mk
@@ -73,7 +73,6 @@ $(eval $(call gb_Configuration_add_spool_modules,registry,officecfg/registry/dat
 	org/openoffice/Office/Accelerators-macosx.xcu \
 	org/openoffice/Office/Accelerators-reportbuilder.xcu \
 	org/openoffice/Office/Accelerators-unxwnt.xcu \
-	org/openoffice/Office/Addons-librelogo.xcu \
 	org/openoffice/Office/Common-writer.xcu \
 	org/openoffice/Office/Common-calc.xcu \
 	org/openoffice/Office/Common-draw.xcu \
@@ -109,7 +108,6 @@ $(eval $(call gb_Configuration_add_spool_modules,registry,officecfg/registry/dat
 	org/openoffice/Office/Embedding-base.xcu \
 	org/openoffice/Office/Embedding-reportbuilder.xcu \
 	org/openoffice/Office/Embedding-writer.xcu \
-	org/openoffice/Office/UI/WriterWindowState-librelogo.xcu \
 	org/openoffice/Office/UI/Controller-reportbuilder.xcu \
 	org/openoffice/TypeDetection/UISort-writer.xcu \
 	org/openoffice/TypeDetection/UISort-calc.xcu \
@@ -129,7 +127,6 @@ $(eval $(call gb_Configuration_add_spool_langpack,registry,officecfg/registry/da
 $(eval $(call gb_Configuration_add_localized_datas,registry,officecfg/registry/data,\
 	org/openoffice/Setup.xcu \
 	org/openoffice/Office/Accelerators.xcu \
-	org/openoffice/Office/Addons.xcu \
 	org/openoffice/Office/Common.xcu \
 	org/openoffice/Office/DataAccess.xcu \
 	org/openoffice/Office/PresentationMinimizer.xcu \
diff --git a/officecfg/registry/data/org/openoffice/Office/UI/WriterWindowState.xcu b/officecfg/registry/data/org/openoffice/Office/UI/WriterWindowState.xcu
index 57a59d2e12c7..803cae4abbf2 100644
--- a/officecfg/registry/data/org/openoffice/Office/UI/WriterWindowState.xcu
+++ b/officecfg/registry/data/org/openoffice/Office/UI/WriterWindowState.xcu
@@ -831,20 +831,6 @@
           <value>true</value>
         </prop>
       </node>
-      <node oor:name="private:resource/toolbar/addon_LibreLogo.OfficeToolBar" oor:op="replace" install:module="librelogo">
-        <prop oor:name="UIName" oor:type="xs:string">
-          <value xml:lang="en-US">Logo</value>
-        </prop>
-        <prop oor:name="Visible" oor:type="xs:boolean">
-          <value>false</value>
-        </prop>
-        <prop oor:name="Locked" oor:type="xs:boolean">
-          <value>false</value>
-        </prop>
-        <prop oor:name="HideFromToolbarMenu" oor:type="xs:boolean">
-          <value>false</value>
-        </prop>
-      </node>
       <node oor:name="private:resource/toolbar/changes" oor:op="replace">
         <prop oor:name="DockPos" oor:type="xs:string">
           <value>1,2</value>
diff --git a/postprocess/CustomTarget_registry.mk b/postprocess/CustomTarget_registry.mk
index 8675d528b1e5..e64f8e1018ed 100644
--- a/postprocess/CustomTarget_registry.mk
+++ b/postprocess/CustomTarget_registry.mk
@@ -27,7 +27,6 @@ postprocess_XCDS := \
 	draw.xcd \
 	graphicfilter.xcd \
 	impress.xcd \
-	librelogo.xcd \
 	lingucomponent.xcd \
 	main.xcd \
 	math.xcd \
@@ -110,11 +109,6 @@ postprocess_FILES_impress := \
 	$(postprocess_MOD)/org/openoffice/Office/ProtocolHandler-impress.xcu \
 	$(postprocess_MOD)/org/openoffice/Setup-impress.xcu
 
-postprocess_DEPS_librelogo := main writer
-postprocess_FILES_librelogo := \
-	$(postprocess_MOD)/org/openoffice/Office/Addons-librelogo.xcu \
-	$(postprocess_MOD)/org/openoffice/Office/UI/WriterWindowState-librelogo.xcu
-
 postprocess_DEPS_lingucomponent := main
 postprocess_FILES_lingucomponent := \
 	$(SRCDIR)/lingucomponent/config/Linguistic-lingucomponent-hyphenator.xcu \
diff --git a/scp2/AutoInstall.mk b/scp2/AutoInstall.mk
index 3f6de8c6f8da..0aea89f48b00 100644
--- a/scp2/AutoInstall.mk
+++ b/scp2/AutoInstall.mk
@@ -36,7 +36,6 @@ $(eval $(call gb_AutoInstall_add_module,ooo,LIBO_LIB_FILE,LIBO_EXECUTABLE,LIBO_J
 $(eval $(call gb_AutoInstall_add_module,ooobinarytable,LIBO_LIB_FILE_BINARYTABLE))
 $(eval $(call gb_AutoInstall_add_module,python,LIBO_LIB_FILE,LIBO_EXECUTABLE))
 $(eval $(call gb_AutoInstall_add_module,python_scriptprovider,))
-$(eval $(call gb_AutoInstall_add_module,python_librelogo,))
 $(eval $(call gb_AutoInstall_add_module,postgresqlsdbc,LIBO_LIB_FILE))
 $(eval $(call gb_AutoInstall_add_module,pdfimport,LIBO_LIB_FILE,LIBO_EXECUTABLE))
 $(eval $(call gb_AutoInstall_add_module,quickstart,,LIBO_EXECUTABLE))
diff --git a/scp2/InstallModule_python.mk b/scp2/InstallModule_python.mk
index 965781cc771e..c879713bd600 100644
--- a/scp2/InstallModule_python.mk
+++ b/scp2/InstallModule_python.mk
@@ -12,7 +12,6 @@ $(eval $(call gb_InstallModule_InstallModule,scp2/python))
 $(eval $(call gb_InstallModule_use_auto_install_libs,scp2/python,\
 	python \
 	python_scriptprovider \
-	python_librelogo \
 ))
 
 ifeq ($(DISABLE_PYTHON),TRUE)
@@ -45,12 +44,7 @@ endif
 
 $(eval $(call gb_InstallModule_add_scpfiles,scp2/python,\
     scp2/source/python/file_python \
-    scp2/source/python/file_python_librelogo \
     scp2/source/python/module_python \
 ))
 
-$(eval $(call gb_InstallModule_add_localized_scpfiles,scp2/python,\
-    scp2/source/python/module_python_librelogo \
-))
-
 # vim: set shiftwidth=4 tabstop=4 noexpandtab:
diff --git a/setup_native/source/packinfo/packinfo_office.txt b/setup_native/source/packinfo/packinfo_office.txt
index 8c1eaf187796..c423661bd2d5 100644
--- a/setup_native/source/packinfo/packinfo_office.txt
+++ b/setup_native/source/packinfo/packinfo_office.txt
@@ -266,6 +266,8 @@ module = "gid_Module_Pyuno"
 solarispackagename = "%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-pyuno"
 solarisrequires = "%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-core, SUNWPython"
 packagename = "%BASISPACKAGEPREFIX%PRODUCTVERSION-pyuno"
+linuxreplaces = "%BASISPACKAGEPREFIX%PRODUCTVERSION-librelogo"
+linuxincompat = "%BASISPACKAGEPREFIX%PRODUCTVERSION-librelogo"
 freebsdrequires = "%BASISPACKAGEPREFIX%PRODUCTVERSION-core"
 requires = "%BASISPACKAGEPREFIX%PRODUCTVERSION-core %PACKAGEVERSION %PACKAGEVERSION-%PACKAGEREVISION"
 copyright = "2017 The Document Foundation"
@@ -277,21 +279,6 @@ packageversion = "%PACKAGEVERSION"
 End
 
 Start
-module = "gid_Module_Optional_Pyuno_LibreLogo"
-solarispackagename = "%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-librelogo"
-solarisrequires = "%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-pyuno,%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-writer,SUNWPython"
-packagename = "%BASISPACKAGEPREFIX%PRODUCTVERSION-librelogo"
-freebsdrequires = "%BASISPACKAGEPREFIX%PRODUCTVERSION-pyuno,%BASISPACKAGEPREFIX%PRODUCTVERSION-writer"
-requires = "%BASISPACKAGEPREFIX%PRODUCTVERSION-pyuno %PACKAGEVERSION %PACKAGEVERSION-%PACKAGEREVISION,%BASISPACKAGEPREFIX%PRODUCTVERSION-writer %PACKAGEVERSION %PACKAGEVERSION-%PACKAGEREVISION"
-copyright = "2017 The Document Foundation"
-solariscopyright = "solariscopyrightfile"
-vendor = "The Document Foundation"
-description = "LibreLogo toolbar for %PRODUCTNAME %PRODUCTVERSION Writer"
-destpath = "/opt"
-packageversion = "%PACKAGEVERSION"
-End
-
-Start
 module = "gid_Module_Script_Provider_For_Python"
 solarispackagename = "%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-python-script-provider"
 solarisrequires =  "%BASISPACKAGEPREFIX%WITHOUTDOTPRODUCTVERSION-core (Name="Core module for %PRODUCTNAME %PRODUCTVERSION")"
commit c70464a2b1c57e2e8cb43c0ddec570ee31181bbb
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Sep 3 17:20:21 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:43 2019 +0200

    ofz#10198 reset uncommitted fly stuff & pams before applying redlining
    
    Change-Id: I2a2587ec4590926f7cffc2a4d58a22d9d5f19c99
    Reviewed-on: https://gerrit.libreoffice.org/59947
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    Tested-by: Jenkins
    (cherry picked from commit 887ee9111f42847406c5ffc85a0ba635080de3de)

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index b8bc89d44274..aa5f49804d72 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -5417,6 +5417,9 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss)
 
     UpdateFields();
 
+    DELETEZ(m_pWFlyPara);
+    DELETEZ(m_pSFlyPara);
+
     // delete the pam before the call for hide all redlines (Bug 73683)
     if (m_bNewDoc)
       m_rDoc.getIDocumentRedlineAccess().SetRedlineMode((RedlineMode_t)( eMode ));
commit 8e3c950c9506593d800bf125fc9d7605c1bd72b7
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 15 10:27:22 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:43 2019 +0200

    ofz#9908 validate no negative editengine selection positions
    
    Change-Id: I37dace2051518224c55756362facd3edba4a9571
    Reviewed-on: https://gerrit.libreoffice.org/59059
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
    (cherry picked from commit ca3038a05188084b012dd3c799494f30bc5c47ef)

diff --git a/sw/source/filter/ww8/ww8graf.cxx b/sw/source/filter/ww8/ww8graf.cxx
index 7fe4fd5c612b..960e11a9ea02 100644
--- a/sw/source/filter/ww8/ww8graf.cxx
+++ b/sw/source/filter/ww8/ww8graf.cxx
@@ -568,7 +568,9 @@ namespace
     bool IsValidSel(const EditEngine& rEngine, const ESelection& rSel)
     {
         const auto nParaCount = rEngine.GetParagraphCount();
-        return rSel.nStartPara < nParaCount && rSel.nEndPara < nParaCount;
+        if (rSel.nStartPara < nParaCount && rSel.nEndPara < nParaCount)
+            return rSel.nStartPos >= 0 && rSel.nEndPos >= 0;
+        return false;
     }
 }
 
commit d6e4a1f9d69e7d6dc605136c468faf36bba84e26
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Dec 30 13:57:38 2017 +0000
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:42 2019 +0200

    ofz#4837 Null-dereference READ
    
    Change-Id: I7e4cb934aeac32fa1170beb116e4600b5eb9389a
    Reviewed-on: https://gerrit.libreoffice.org/47197
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 9f8dd17b1e6ab5d5d07b61e0f85edea233f03d71)

diff --git a/sw/source/filter/ww8/ww8graf.cxx b/sw/source/filter/ww8/ww8graf.cxx
index 0094fad04510..7fe4fd5c612b 100644
--- a/sw/source/filter/ww8/ww8graf.cxx
+++ b/sw/source/filter/ww8/ww8graf.cxx
@@ -563,6 +563,15 @@ public:
     }
 };
 
+namespace
+{
+    bool IsValidSel(const EditEngine& rEngine, const ESelection& rSel)
+    {
+        const auto nParaCount = rEngine.GetParagraphCount();
+        return rSel.nStartPara < nParaCount && rSel.nEndPara < nParaCount;
+    }
+}
+
 // InsertAttrsAsDrawingAttrs() setzt zwischen StartCp und EndCp die Attribute.
 // Dabei werden Style-Attribute als harte Attribute, Absatz- und Zeichen-
 // attribute gesetzt.
@@ -738,6 +747,8 @@ void SwWW8ImplReader::InsertAttrsAsDrawingAttrs(long nStartCp, long nEndCp,
     {
         ESelection aSel(GetESelection(*m_pDrawEditEngine, aIter->GetStartPos()-nStartCp,
             aIter->GetEndPos()-nStartCp));
+        if (!IsValidSel(*m_pDrawEditEngine, aSel))
+            continue;
         OUString aString(m_pDrawEditEngine->GetText(aSel));
         const sal_Int32 nOrigLen = aString.getLength();
         long nDummy(0);
commit 9b347f1cc4262809d4d56e8469a0237f874c7096
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 21:34:20 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:42 2019 +0200

    forcepoint#67 detect cairo surface creation failure
    
    if e.g. too large
    
    Change-Id: I7de8748a5ed695c1b3ddc8c1358414f3acd68c94
    Reviewed-on: https://gerrit.libreoffice.org/58454
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 36bee88834f90818c5475b460c729186ef6c9229)

diff --git a/vcl/headless/svpgdi.cxx b/vcl/headless/svpgdi.cxx
index 1458fc0d209b..d530770ea414 100644
--- a/vcl/headless/svpgdi.cxx
+++ b/vcl/headless/svpgdi.cxx
@@ -1049,6 +1049,11 @@ void SvpSalGraphics::drawMask( const SalTwoRect& rTR,
     /** creates an image from the given rectangle, replacing all black pixels
      *  with nMaskColor and make all other full transparent */
     SourceHelper aSurface(rSalBitmap);
+    if (!aSurface.getSurface())
+    {
+        SAL_WARN("vcl.gdi", "unsupported SvpSalGraphics::drawMask case");
+        return;
+    }
     cairo_surface_t* mask = aSurface.getSurface();
 
     cairo_surface_flush(mask);
@@ -1272,6 +1277,11 @@ cairo_surface_t* SvpSalGraphics::createCairoSurface(const BitmapBuffer *pBuffer)
                                         nFormat,
                                         pBuffer->mnWidth, pBuffer->mnHeight,
                                         pBuffer->mnScanlineSize);
+    if (cairo_surface_status(target) != CAIRO_STATUS_SUCCESS)
+    {
+        cairo_surface_destroy(target);
+        return nullptr;
+    }
     return target;
 }
 
commit 094aa65b8de17aca1870a4f207d5e08c4a494868
Author:     Michael Stahl <Michael.Stahl at cib.de>
AuthorDate: Thu Jul 18 14:07:06 2019 +0200
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:42 2019 +0200

    sw: fix use after free on tdf117215-1.odt
    
    Move the fix from 6d0ea082889c89eb8b408779f2de08da7441ff54 to
    SwFlyFrame::DestroyImpl() so we unregister every SwFlyFrame.
    
    ==1550==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000383f56 at pc 0x7efcd70d5ab9 bp 0x7ffeb7ac7c40 sp 0x7ffeb7ac7c38
    WRITE of size 1 at 0x615000383f56 thread T0
        0 SwAnchoredObject::SetTmpConsiderWrapInfluence(bool) sw/source/core/layout/anchoredobject.cxx:743:32
        1 SwObjsMarkedAsTmpConsiderWrapInfluence::Clear() sw/source/core/layout/objstmpconsiderwrapinfl.cxx:53:23
        2 SwLayouter::ClearObjsTmpConsiderWrapInfluence(SwDoc const&) sw/source/core/layout/layouter.cxx:387:84
        3 sw::DocumentLayoutManager::ClearSwLayouterEntries() sw/source/core/doc/DocumentLayoutManager.cxx:497:5
        4 sw::DocumentStateManager::SetModified() sw/source/core/doc/DocumentStateManager.cxx:45:39
        5 sw::DocumentContentOperationsManager::DeleteRangeImplImpl(SwPaM&) sw/source/core/doc/DocumentContentOperationsManager.cxx:3942:36
    
    0x615000383f56 is located 342 bytes inside of 504-byte region [0x615000383e00,0x615000383ff8)
    freed by thread T0 here:
        1 SwFlyAtContentFrame::~SwFlyAtContentFrame() sw/source/core/inc/flyfrms.hxx:159:7
        2 SwFrame::DestroyFrame(SwFrame*) sw/source/core/layout/ssfrm.cxx:389:9
        3 SwFrameFormat::DelFrames() sw/source/core/layout/atrfrm.cxx:2624:17
        4 SwUndoFlyBase::DelFly(SwDoc*) sw/source/core/undo/undobj1.cxx:161:19
        5 SwUndoDelLayFormat::SwUndoDelLayFormat(SwFrameFormat*) sw/source/core/undo/undobj1.cxx:403:5
        6 SwHistoryTextFlyCnt::SwHistoryTextFlyCnt(SwFrameFormat*) sw/source/core/undo/rolbck.cxx:538:20
        7 SwHistory::Add(SwFlyFrameFormat&, unsigned short&) sw/source/core/undo/rolbck.cxx:1083:50
        8 SwUndoSaveContent::DelContentIndex(SwPosition const&, SwPosition const&, DelContentType) sw/source/core/undo/undobj.cxx:1020:39
        9 SwUndoDelete::SwUndoDelete(SwPaM&, bool, bool) sw/source/core/undo/undel.cxx:229:9
        11 sw::DocumentContentOperationsManager::DeleteRangeImplImpl(SwPaM&) sw/source/core/doc/DocumentContentOperationsManager.cxx:3939:55
    
    Change-Id: Ia0c28c9d5792615cbb566e502374efd0f4056daf
    Reviewed-on: https://gerrit.libreoffice.org/75857
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit dea72ef111ee8a0b1b178f8cd48757514d5ca831)
    Reviewed-on: https://gerrit.libreoffice.org/75941
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 4b9324b93dcbd72c8c8949309d45790dd8f7d5fd)

diff --git a/sw/source/core/layout/fly.cxx b/sw/source/core/layout/fly.cxx
index fd4eec9b266f..c18c62cf0393 100644
--- a/sw/source/core/layout/fly.cxx
+++ b/sw/source/core/layout/fly.cxx
@@ -256,6 +256,8 @@ void SwFlyFrame::DestroyImpl()
 
     if( GetFormat() && !GetFormat()->GetDoc()->IsInDtor() )
     {
+        ClearTmpConsiderWrapInfluence(); // remove this from SwLayouter
+
         // OD 2004-01-19 #110582#
         Unchain();
 
diff --git a/sw/source/core/layout/ssfrm.cxx b/sw/source/core/layout/ssfrm.cxx
index fa60e81200a4..7983ff5e7d83 100644
--- a/sw/source/core/layout/ssfrm.cxx
+++ b/sw/source/core/layout/ssfrm.cxx
@@ -472,7 +472,6 @@ void SwLayoutFrame::DestroyImpl()
                 const size_t nCnt = pFrame->GetDrawObjs()->size();
                 // #i28701#
                 SwAnchoredObject* pAnchoredObj = (*pFrame->GetDrawObjs())[0];
-                pAnchoredObj->ClearTmpConsiderWrapInfluence();
                 if (SwFlyFrame* pFlyFrame = dynamic_cast<SwFlyFrame*>(pAnchoredObj))
                 {
                     SwFrame::DestroyFrame(pFlyFrame);
@@ -480,6 +479,7 @@ void SwLayoutFrame::DestroyImpl()
                 }
                 else
                 {
+                    pAnchoredObj->ClearTmpConsiderWrapInfluence();
                     SdrObject* pSdrObj = pAnchoredObj->DrawObj();
                     SwDrawContact* pContact =
                             static_cast<SwDrawContact*>(pSdrObj->GetUserCall());
commit 3502f02f7e263ed9caf679378669db5a85d6a227
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Aug 9 12:32:01 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:42 2019 +0200

    forcepoint73 deleted SwAnchoredObject still referenced in TmpConsiderWrapInfl
    
    Reviewed-on: https://gerrit.libreoffice.org/58760
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 6d0ea082889c89eb8b408779f2de08da7441ff54)
    
    Change-Id: If255723834d049865fcf6fd0eac7768dfcbad2a1
    Reviewed-on: https://gerrit.libreoffice.org/58768
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit de765158b372d5f7bbb1b37c7d6be695ab6104ac)

diff --git a/sw/inc/anchoredobject.hxx b/sw/inc/anchoredobject.hxx
index 024b55550034..9301c898385f 100644
--- a/sw/inc/anchoredobject.hxx
+++ b/sw/inc/anchoredobject.hxx
@@ -467,6 +467,7 @@ class SW_DLLPUBLIC SwAnchoredObject
         // accessors to member <mbTmpConsiderWrapInfluence>
         void SetTmpConsiderWrapInfluence( const bool _bTmpConsiderWrapInfluence );
         bool IsTmpConsiderWrapInfluence() const { return mbTmpConsiderWrapInfluence;}
+        void ClearTmpConsiderWrapInfluence();
 
         /** method to determine, if the anchored object is overlapping with a
             previous column
diff --git a/sw/source/core/inc/layouter.hxx b/sw/source/core/inc/layouter.hxx
index 862aafef5da5..d67b44a1faff 100644
--- a/sw/source/core/inc/layouter.hxx
+++ b/sw/source/core/inc/layouter.hxx
@@ -127,6 +127,10 @@ public:
     static void InsertObjForTmpConsiderWrapInfluence(
                                         const SwDoc& _rDoc,
                                         SwAnchoredObject& _rAnchoredObj );
+    static void RemoveObjForTmpConsiderWrapInfluence(
+                                        const SwDoc& _rDoc,
+                                        SwAnchoredObject& _rAnchoredObj );
+
     // --> #i65250#
     static bool MoveBwdSuppressed( const SwDoc& p_rDoc,
                                    const SwFlowFrame& p_rFlowFrame,
diff --git a/sw/source/core/layout/anchoredobject.cxx b/sw/source/core/layout/anchoredobject.cxx
index 36d24d31a0b7..be13b3cd86f8 100644
--- a/sw/source/core/layout/anchoredobject.cxx
+++ b/sw/source/core/layout/anchoredobject.cxx
@@ -749,7 +749,14 @@ void SwAnchoredObject::SetTmpConsiderWrapInfluence( const bool _bTmpConsiderWrap
     }
 }
 
-
+void SwAnchoredObject::ClearTmpConsiderWrapInfluence()
+{
+    mbTmpConsiderWrapInfluence = false;
+    mbClearedEnvironment = false;
+    SetClearedEnvironment( false );
+    SwLayouter::RemoveObjForTmpConsiderWrapInfluence( *(GetFrameFormat().GetDoc()),
+                                                      *this );
+}
 void SwAnchoredObject::SetTmpConsiderWrapInfluenceOfOtherObjs()
 {
     const SwSortedObjs* pObjs = GetAnchorFrame()->GetDrawObjs();
diff --git a/sw/source/core/layout/layouter.cxx b/sw/source/core/layout/layouter.cxx
index 18efbe1ac51f..41fefd385021 100644
--- a/sw/source/core/layout/layouter.cxx
+++ b/sw/source/core/layout/layouter.cxx
@@ -402,6 +402,7 @@ void SwLayouter::ClearObjsTmpConsiderWrapInfluence( const SwDoc& _rDoc )
         _rDoc.getIDocumentLayoutAccess().GetLayouter()->mpObjsTmpConsiderWrapInfl->Clear();
     }
 }
+
 void SwLayouter::InsertObjForTmpConsiderWrapInfluence(
                                             const SwDoc& _rDoc,
                                             SwAnchoredObject& _rAnchoredObj )
@@ -420,6 +421,20 @@ void SwLayouter::InsertObjForTmpConsiderWrapInfluence(
     _rDoc.getIDocumentLayoutAccess().GetLayouter()->mpObjsTmpConsiderWrapInfl->Insert( _rAnchoredObj );
 }
 
+void SwLayouter::RemoveObjForTmpConsiderWrapInfluence(
+                                            const SwDoc& _rDoc,
+                                            SwAnchoredObject& _rAnchoredObj )
+{
+    if ( !_rDoc.getIDocumentLayoutAccess().GetLayouter() )
+        return;
+
+    if ( !_rDoc.getIDocumentLayoutAccess().GetLayouter()->mpObjsTmpConsiderWrapInfl )
+        return;
+
+    _rDoc.getIDocumentLayoutAccess().GetLayouter()->mpObjsTmpConsiderWrapInfl->Remove( _rAnchoredObj );
+}
+
+
 void LOOPING_LOUIE_LIGHT( bool bCondition, const SwTextFrame& rTextFrame )
 {
     if ( bCondition )
diff --git a/sw/source/core/layout/objstmpconsiderwrapinfl.cxx b/sw/source/core/layout/objstmpconsiderwrapinfl.cxx
index 214fe5693e3b..83d1a183c3c4 100644
--- a/sw/source/core/layout/objstmpconsiderwrapinfl.cxx
+++ b/sw/source/core/layout/objstmpconsiderwrapinfl.cxx
@@ -31,23 +31,18 @@ SwObjsMarkedAsTmpConsiderWrapInfluence::~SwObjsMarkedAsTmpConsiderWrapInfluence(
 
 void SwObjsMarkedAsTmpConsiderWrapInfluence::Insert( SwAnchoredObject& _rAnchoredObj )
 {
+    auto it = std::find(maObjsTmpConsiderWrapInfl.begin(), maObjsTmpConsiderWrapInfl.end(), &_rAnchoredObj);
+    if (it != maObjsTmpConsiderWrapInfl.end())
+        return;
+    maObjsTmpConsiderWrapInfl.push_back( &_rAnchoredObj );
+}
 
-    bool bAlreadyInserted( false );
-    std::vector< SwAnchoredObject* >::const_iterator aIter = maObjsTmpConsiderWrapInfl.begin();
-    for ( ; aIter != maObjsTmpConsiderWrapInfl.end(); ++aIter )
-    {
-        const SwAnchoredObject* pAnchoredObj = *(aIter);
-        if ( pAnchoredObj == &_rAnchoredObj )
-        {
-            bAlreadyInserted = true;
-            break;
-        }
-    }
-
-    if ( !bAlreadyInserted )
-    {
-        maObjsTmpConsiderWrapInfl.push_back( &_rAnchoredObj );
-    }
+void SwObjsMarkedAsTmpConsiderWrapInfluence::Remove( SwAnchoredObject& _rAnchoredObj )
+{
+    auto it = std::find(maObjsTmpConsiderWrapInfl.begin(), maObjsTmpConsiderWrapInfl.end(), &_rAnchoredObj);
+    if (it == maObjsTmpConsiderWrapInfl.end())
+        return;
+    maObjsTmpConsiderWrapInfl.erase(it);
 }
 
 void SwObjsMarkedAsTmpConsiderWrapInfluence::Clear()
diff --git a/sw/source/core/layout/objstmpconsiderwrapinfl.hxx b/sw/source/core/layout/objstmpconsiderwrapinfl.hxx
index fcf495e72a50..28b6acf9de1c 100644
--- a/sw/source/core/layout/objstmpconsiderwrapinfl.hxx
+++ b/sw/source/core/layout/objstmpconsiderwrapinfl.hxx
@@ -33,6 +33,7 @@ class SwObjsMarkedAsTmpConsiderWrapInfluence
         ~SwObjsMarkedAsTmpConsiderWrapInfluence();
 
         void Insert( SwAnchoredObject& _rAnchoredObj );
+        void Remove( SwAnchoredObject& _rAnchoredObj );
         void Clear();
 };
 
diff --git a/sw/source/core/layout/ssfrm.cxx b/sw/source/core/layout/ssfrm.cxx
index 0465936332ec..fa60e81200a4 100644
--- a/sw/source/core/layout/ssfrm.cxx
+++ b/sw/source/core/layout/ssfrm.cxx
@@ -472,9 +472,10 @@ void SwLayoutFrame::DestroyImpl()
                 const size_t nCnt = pFrame->GetDrawObjs()->size();
                 // #i28701#
                 SwAnchoredObject* pAnchoredObj = (*pFrame->GetDrawObjs())[0];
-                if ( dynamic_cast< const SwFlyFrame *>( pAnchoredObj ) !=  nullptr )
+                pAnchoredObj->ClearTmpConsiderWrapInfluence();
+                if (SwFlyFrame* pFlyFrame = dynamic_cast<SwFlyFrame*>(pAnchoredObj))
                 {
-                    SwFrame::DestroyFrame(static_cast<SwFlyFrame*>(pAnchoredObj));
+                    SwFrame::DestroyFrame(pFlyFrame);
                     assert(!pFrame->GetDrawObjs() || nCnt > pFrame->GetDrawObjs()->size());
                 }
                 else
commit 05187045a38ee17b20634b064a9de1a91cecc78a
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Mar 25 12:06:20 2019 +0000
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:42 2019 +0200

    Resolves: tdf#124142 don't deref nullptr
    
    Change-Id: Ie14600e9f9a1e1c4e99c7a872f5d677453481888
    Reviewed-on: https://gerrit.libreoffice.org/69666
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit ac7ce7a64ef903bad1476f5635a7b2a1e951a7a3)
    Reviewed-on: https://gerrit.libreoffice.org/69694
    Reviewed-by: Xisco Faulí <xiscofauli at libreoffice.org>
    (cherry picked from commit cdef6e5f4053adf5413781a9282285eab3923373)

diff --git a/sw/source/core/unocore/unostyle.cxx b/sw/source/core/unocore/unostyle.cxx
index 7ec6ecbdb537..fb0ee2564e07 100644
--- a/sw/source/core/unocore/unostyle.cxx
+++ b/sw/source/core/unocore/unostyle.cxx
@@ -191,7 +191,8 @@ namespace sw
             , m_pBasePool(pDocShell->GetStyleSheetPool())
             , m_pDocShell(pDocShell)
         {
-            StartListening(*m_pBasePool);
+            if (m_pBasePool) //tdf#124142 html docs can have no styles
+                StartListening(*m_pBasePool);
         }
 
         virtual ~XStyleFamily() {};
commit 5b99fc97a526218c3f7e84563e7a52ddb5bc8f5e
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Feb 6 12:09:27 2019 +0000
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:41 2019 +0200

    fix assert seen on opening attachment from tdf#123163
    
    I imagine it should have been seqPos-(idPos+2)
    
    seems to be like this since the initial commit of
    
    commit 091fe76b6329b4bb974987554369cbfadd8f2401
    Date:   Tue Jun 30 12:55:18 2015 +0300
    
        tdf#87348 implement mso-next-textbox vml-style textbox chaining import
    
    Change-Id: Ic2f527ede2102c01c8589d58d8c705d59b0a6ffe
    Reviewed-on: https://gerrit.libreoffice.org/67454
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 45510866fedac63014a3120a1130dbea9fd803ee)

diff --git a/oox/source/vml/vmlshape.cxx b/oox/source/vml/vmlshape.cxx
index 4c5f54c77df0..50a2519fc7f2 100644
--- a/oox/source/vml/vmlshape.cxx
+++ b/oox/source/vml/vmlshape.cxx
@@ -340,7 +340,8 @@ Reference< XShape > ShapeBase::convertAndInsert( const Reference< XShapes >& rxS
                     sal_Int32 seqPos = sLinkChainName.indexOf("_s",idPos);
                     if (idPos < seqPos)
                     {
-                        id = sLinkChainName.copy(idPos+2,seqPos-idPos+2).toInt32();
+                        auto idPosEnd = idPos+2;
+                        id = sLinkChainName.copy(idPosEnd, seqPos - idPosEnd).toInt32();
                         seq = sLinkChainName.copy(seqPos+2).toInt32();
                     }
                 }
commit 3ae28d937bf6ad011582c764df80b63a73bbbf22
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Feb 6 12:34:26 2019 +0000
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:41 2019 +0200

    Resolves: tdf#123163 avoid null deref
    
    one RemoveDrawObjFromPage is already null-deref protected,
    do the same for the other
    
    Change-Id: Ica5bb2df4a8dbffd8397df76b673adab75bb7aef
    Reviewed-on: https://gerrit.libreoffice.org/67457
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit e6e8f02407ea781a3634fd2669ad6467e9587db4)

diff --git a/sw/source/core/layout/frmtool.cxx b/sw/source/core/layout/frmtool.cxx
index 70c1409a0dc0..314f37f1c383 100644
--- a/sw/source/core/layout/frmtool.cxx
+++ b/sw/source/core/layout/frmtool.cxx
@@ -2390,7 +2390,8 @@ static void lcl_RemoveObjsFromPage( SwFrame* _pFrame )
         {
             if (pObj->GetFrameFormat().GetAnchor().GetAnchorId() != FLY_AS_CHAR)
             {
-                pObj->GetPageFrame()->RemoveDrawObjFromPage(
+                if (SwPageFrame *pPg = pObj->GetPageFrame())
+                    pPg->RemoveDrawObjFromPage(
                                 *(static_cast<SwAnchoredDrawObject*>(pObj)) );
             }
         }
@@ -2730,8 +2731,8 @@ static void lcl_Regist( SwPageFrame *pPage, const SwFrame *pAnch )
             if ( pPage != pObj->GetPageFrame() )
             {
                 // #i28701#
-                if ( pObj->GetPageFrame() )
-                    pObj->GetPageFrame()->RemoveDrawObjFromPage( *pObj );
+                if (SwPageFrame *pPg = pObj->GetPageFrame())
+                    pPg->RemoveDrawObjFromPage( *pObj );
                 pPage->AppendDrawObjToPage( *pObj );
             }
         }
commit 3ab99f3890ec61be25ad179b6d312f9bc266de14
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Dec 5 13:22:44 2018 +0000
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:41 2019 +0200

    tdf#119126 forcepoint#76 avoid deleting footnote that would delete ...
    
    ... undeletable page
    
    (cherry picked from commit 0005b330eaed0b5559042d2597fb45e0c9125d7e)
    
    Conflicts:
            sw/qa/extras/layout/layout.cxx
    
    Change-Id: I4622569eb9c757c6dcbdda32081ddc94e53db919
    Reviewed-on: https://gerrit.libreoffice.org/66393
    Tested-by: Xisco Faulí <xiscofauli at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.com>
    (cherry picked from commit 558f01a29cb640760e73724f6efdc0a1be20c8e3)

diff --git a/sw/source/core/inc/frame.hxx b/sw/source/core/inc/frame.hxx
index 331e47e71baf..892aa5e1b474 100644
--- a/sw/source/core/inc/frame.hxx
+++ b/sw/source/core/inc/frame.hxx
@@ -710,7 +710,7 @@ public:
     bool IsProtected() const;
 
     bool IsColLocked()  const { return mbColLocked; }
-    bool IsDeleteForbidden()  const { return mbForbidDelete; }
+    virtual bool IsDeleteForbidden() const { return mbForbidDelete; }
 
     /// this is the only way to delete a SwFrame instance
     static void DestroyFrame(SwFrame *const pFrame);
diff --git a/sw/source/core/inc/ftnfrm.hxx b/sw/source/core/inc/ftnfrm.hxx
index 974ad841783f..08f35836abd8 100644
--- a/sw/source/core/inc/ftnfrm.hxx
+++ b/sw/source/core/inc/ftnfrm.hxx
@@ -73,6 +73,7 @@ protected:
 public:
     SwFootnoteFrame( SwFrameFormat*, SwFrame*, SwContentFrame*, SwTextFootnote* );
 
+    virtual bool IsDeleteForbidden() const override;
     virtual void Cut() override;
     virtual void Paste( SwFrame* pParent, SwFrame* pSibling = nullptr ) override;
 
diff --git a/sw/source/core/layout/calcmove.cxx b/sw/source/core/layout/calcmove.cxx
index 8afb53c748e1..fe2f38d779fb 100644
--- a/sw/source/core/layout/calcmove.cxx
+++ b/sw/source/core/layout/calcmove.cxx
@@ -244,6 +244,7 @@ void SwFrame::PrepareMake(vcl::RenderContext* pRenderContext)
     StackHack aHack;
     if ( GetUpper() )
     {
+        SwFrameDeleteGuard aDeleteGuard(this);
         if ( lcl_IsCalcUpperAllowed( *this ) )
             GetUpper()->Calc(pRenderContext);
         OSL_ENSURE( GetUpper(), ":-( Layout unstable (Upper gone)." );
diff --git a/sw/source/core/layout/ftnfrm.cxx b/sw/source/core/layout/ftnfrm.cxx
index 38290c844fbb..442d00e5f87a 100644
--- a/sw/source/core/layout/ftnfrm.cxx
+++ b/sw/source/core/layout/ftnfrm.cxx
@@ -484,6 +484,27 @@ SwTwips SwFootnoteFrame::ShrinkFrame( SwTwips nDist, bool bTst, bool bInfo )
 }
 #endif
 
+bool SwFootnoteFrame::IsDeleteForbidden() const
+{
+    if (SwLayoutFrame::IsDeleteForbidden())
+        return true;
+    // needs to be in sync with the ::Cut logic
+    const SwLayoutFrame *pUp = GetUpper();
+    if (pUp)
+    {
+        if (GetPrev())
+            return false;
+
+        // The last footnote takes its container along if it
+        // is deleted. Cut would put pUp->Lower() to the value
+        // of GetNext(), so if there is no GetNext then
+        // Cut would delete pUp. If that condition is true
+        // here then check if the container is delete-forbidden
+        return !GetNext() && pUp->IsDeleteForbidden();
+    }
+    return false;
+}
+
 void SwFootnoteFrame::Cut()
 {
     if ( GetNext() )
@@ -509,7 +530,7 @@ void SwFootnoteFrame::Cut()
     if ( pUp )
     {
         // The last footnote takes its container along
-        if ( !pUp->Lower() )
+        if (!pUp->Lower())
         {
             SwPageFrame *pPage = pUp->FindPageFrame();
             if ( pPage )
@@ -1599,7 +1620,8 @@ void SwFootnoteBossFrame::AppendFootnote( SwContentFrame *pRef, SwTextFootnote *
             pNew->Calc(getRootFrame()->GetCurrShell()->GetOut());
             // #i57914# - adjust fix #i49383#
             if ( !bOldFootnoteFrameLocked && !pNew->GetLower() &&
-                 !pNew->IsColLocked() && !pNew->IsBackMoveLocked() )
+                 !pNew->IsColLocked() && !pNew->IsBackMoveLocked() &&
+                 !pNew->IsDeleteForbidden() )
             {
                 pNew->Cut();
                 SwFrame::DestroyFrame(pNew);
@@ -2182,7 +2204,8 @@ void SwFootnoteBossFrame::RearrangeFootnotes( const SwTwips nDeadLine, const boo
                         if ( !bLock && bUnlockLastFootnoteFrame &&
                              !pLastFootnoteFrame->GetLower() &&
                              !pLastFootnoteFrame->IsColLocked() &&
-                             !pLastFootnoteFrame->IsBackMoveLocked() )
+                             !pLastFootnoteFrame->IsBackMoveLocked() &&
+                             !pLastFootnoteFrame->IsDeleteForbidden() )
                         {
                             pLastFootnoteFrame->Cut();
                             SwFrame::DestroyFrame(pLastFootnoteFrame);
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index 138fa1a2ff95..e1735909869e 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -836,6 +836,11 @@ bool SwTabFrame::RemoveFollowFlowLine()
     // #140081# Make code robust.
     if ( !pFollowFlowLine || !pLastLine )
         return true;
+    if (pFollowFlowLine->IsDeleteForbidden())
+    {
+        SAL_WARN("sw.layout", "Cannot remove in-use Follow Flow Line");
+        return true;
+    }
 
     // Move content
     lcl_MoveRowContent( *pFollowFlowLine, *static_cast<SwRowFrame*>(pLastLine) );
commit 12764b578e8a42c55b8c5d932c3ae54646a5ff7c
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Aug 4 15:30:46 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:41 2019 +0200

    crashtesting: bubble surface creation failure notification upwards
    
    e.g. on converting moz858095-2.svg to odg
    
    Change-Id: I1a222f1745cff9c4cb225f6c0c216072fb17b4f7
    Reviewed-on: https://gerrit.libreoffice.org/58587
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit dbf34be458a2b5723084d1ed99390b744cee6053)

diff --git a/vcl/headless/svpgdi.cxx b/vcl/headless/svpgdi.cxx
index 11f408aaf773..1458fc0d209b 100644
--- a/vcl/headless/svpgdi.cxx
+++ b/vcl/headless/svpgdi.cxx
@@ -1110,6 +1110,11 @@ SalBitmap* SvpSalGraphics::getBitmap( long nX, long nY, long nWidth, long nHeigh
     pBitmap->Create(Size(nWidth, nHeight), 32, BitmapPalette());
 
     cairo_surface_t* target = SvpSalGraphics::createCairoSurface(pBitmap->GetBuffer());
+    if (!target)
+    {
+        SAL_WARN("vcl.gdi", "SvpSalGraphics::getBitmap, cannot create cairo surface");
+        return nullptr;
+    }
     cairo_t* cr = cairo_create(target);
 
     SalTwoRect aTR(nX, nY, nWidth, nHeight, 0, 0, nWidth, nHeight);
commit 23a484ac0ef922326c38be26986d46fc6d87d001
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Jun 5 21:37:00 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:41 2019 +0200

    tdf#121005 forcepoint#44 merge into isDeleteForbidden
    
    Reviewed-on: https://gerrit.libreoffice.org/55355
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit c6222fb6b8b429fa2e767c73ad616147f95ab1b9)
    
    Change-Id: If7ce44786975c5f9bdc9e64d16274728b03bed32
    Reviewed-on: https://gerrit.libreoffice.org/62629
    Tested-by: Jenkins
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit ba4861a0dfdf97448925130995d69b4c516f0644)

diff --git a/sw/qa/core/data/ww8/fail/forcepoint-44.doc b/sw/qa/core/data/ww8/fail/forcepoint-44.doc
new file mode 100644
index 000000000000..100422a2249c
Binary files /dev/null and b/sw/qa/core/data/ww8/fail/forcepoint-44.doc differ
diff --git a/sw/source/core/layout/pagechg.cxx b/sw/source/core/layout/pagechg.cxx
index d498ffbdbf44..942df01f1a14 100644
--- a/sw/source/core/layout/pagechg.cxx
+++ b/sw/source/core/layout/pagechg.cxx
@@ -1139,6 +1139,8 @@ namespace
 {
     bool isDeleteForbidden(const SwPageFrame *pDel)
     {
+        if (pDel->IsDeleteForbidden())
+            return true;
         const SwLayoutFrame* pBody = pDel->FindBodyCont();
         const SwFrame* pBodyContent = pBody ? pBody->Lower() : nullptr;
         return pBodyContent && pBodyContent->IsDeleteForbidden();
commit 197e4d8899c7a9426ef62c1fbaa5409c08873a26
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Apr 16 16:45:14 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:40 2019 +0200

    forcepoint#39 bad layout
    
    reproducible with ./instdir/program/soffice.bin --headless --convert-to pdf sw/qa/core/data/ww8/pass/forcepoint-layout-1.doc
    
    Change-Id: I93bd8a75196ddb2a1a242752bb1e06164bf7148e
    Reviewed-on: https://gerrit.libreoffice.org/53002
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 2a957e408530cd16526d793c87f0e6fd4bed1548)

diff --git a/sw/qa/core/data/ww8/pass/forcepoint-layout-1.doc b/sw/qa/core/data/ww8/pass/forcepoint-layout-1.doc
new file mode 100755
index 000000000000..37801a9b14e2
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/forcepoint-layout-1.doc differ
diff --git a/sw/source/core/layout/fly.cxx b/sw/source/core/layout/fly.cxx
index 66c131d80f6d..fd4eec9b266f 100644
--- a/sw/source/core/layout/fly.cxx
+++ b/sw/source/core/layout/fly.cxx
@@ -1461,6 +1461,7 @@ void CalcContent( SwLayoutFrame *pLay,
                 static_cast<SwTextFrame*>(pFrame)->ForbidFollowFormat();
 
             {
+                SwFrameDeleteGuard aDeletePageGuard(pSect->FindPageFrame());
                 SwFrameDeleteGuard aDeleteGuard(pSect);
                 pFrame->Calc(pRenderContext);
             }
commit 592e3747470d1e2e2bb01eff9a894b764bf47278
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Oct 10 09:42:36 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:40 2019 +0200

    ofz#10879 stay inside sSecStr bounds
    
    Change-Id: I0ca70cdb9b80305c5339668d65d2c4c9977e7160
    Reviewed-on: https://gerrit.libreoffice.org/61605
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit b3b52643983ec28838eeeed9f841b0918dc745be)

diff --git a/svl/source/numbers/zformat.cxx b/svl/source/numbers/zformat.cxx
index 6e740b3f4df0..5552fd983d33 100644
--- a/svl/source/numbers/zformat.cxx
+++ b/svl/source/numbers/zformat.cxx
@@ -2899,7 +2899,7 @@ bool SvNumberformat::ImpGetTimeOutput(double fNumber,
                      (rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_STRING ||
                       rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_TIME100SECSEP) ?
                      nCntPost : rInfo.sStrArray[i].getLength() );
-            for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost; j++)
+            for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost && nSecPos < sSecStr.getLength(); ++j)
             {
                 sBuff.append(sSecStr[nSecPos]);
                 nSecPos++;
@@ -3689,7 +3689,7 @@ bool SvNumberformat::ImpGetDateTimeOutput(double fNumber,
                      (rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_STRING ||
                       rInfo.nTypeArray[i-1] == NF_SYMBOLTYPE_TIME100SECSEP) ?
                      nCntPost : rInfo.sStrArray[i].getLength() );
-            for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost; j++)
+            for (sal_Int32 j = 0; j < nLen && nSecPos < nCntPost && nSecPos < sSecStr.getLength(); ++j)
             {
                 sBuff.append(sSecStr[ nSecPos ]);
                 nSecPos++;
commit ee4745f1d91e40ac22eff4ca0f00449137b6feb4
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Sep 20 16:03:24 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:40 2019 +0200

    ofz#10523 guard aginst 0 pF->nLCode
    
    Change-Id: I8ef476e06f54ddd57be907488a8a65314abda3ee
    Reviewed-on: https://gerrit.libreoffice.org/60827
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit b8525055c6734baa36c1da0aaf33654a865e2021)

diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index b8828a15d67c..481a07b4114a 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -102,7 +102,7 @@ eF_ResT SwWW8ImplReader::Read_F_FormTextBox( WW8FieldDesc* pF, OUString& rStr )
 {
     WW8FormulaEditBox aFormula(*this);
 
-    if (rStr[pF->nLCode-1]==0x01) {
+    if (pF->nLCode && rStr[pF->nLCode-1]==0x01) {
         ImportFormulaControl(aFormula,pF->nSCode+pF->nLCode-1, WW8_CT_EDIT);
     }
 
commit f5cb34b4c6fc7e8f8635bdef78f6cabf41123ec5
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Sep 17 09:01:59 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:40 2019 +0200

    ofz#10395 Null-dereference
    
    Change-Id: I7bde5987a51949d60174335327652186e0ad8998
    Reviewed-on: https://gerrit.libreoffice.org/60559
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 07b3bfb125fae70e0ab796a929a4f2abe4937912)
    Reviewed-on: https://gerrit.libreoffice.org/60564
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit fde33870d6989efeb59355aad1209a7f50e7ecf6)

diff --git a/oox/source/shape/WpsContext.cxx b/oox/source/shape/WpsContext.cxx
index 15a102200ae3..16352fd33398 100644
--- a/oox/source/shape/WpsContext.cxx
+++ b/oox/source/shape/WpsContext.cxx
@@ -180,11 +180,14 @@ oox::core::ContextHandlerRef WpsContext::onCreateContext(sal_Int32 nElementToken
         if (rAttribs.hasAttribute(XML_prst))
         {
             uno::Reference<beans::XPropertySet> xPropertySet(mxShape, uno::UNO_QUERY);
-            oox::OptValue<OUString> presetShapeName = rAttribs.getString(XML_prst);
-            OUString preset = presetShapeName.get();
-            comphelper::SequenceAsHashMap aCustomShapeGeometry(xPropertySet->getPropertyValue("CustomShapeGeometry"));
-            aCustomShapeGeometry["PresetTextWarp"] = uno::makeAny(preset);
-            xPropertySet->setPropertyValue("CustomShapeGeometry", uno::makeAny(aCustomShapeGeometry.getAsConstPropertyValueList()));
+            if (xPropertySet.is())
+            {
+                oox::OptValue<OUString> presetShapeName = rAttribs.getString(XML_prst);
+                OUString preset = presetShapeName.get();
+                comphelper::SequenceAsHashMap aCustomShapeGeometry(xPropertySet->getPropertyValue("CustomShapeGeometry"));
+                aCustomShapeGeometry["PresetTextWarp"] = uno::makeAny(preset);
+                xPropertySet->setPropertyValue("CustomShapeGeometry", uno::makeAny(aCustomShapeGeometry.getAsConstPropertyValueList()));
+            }
         }
         break;
     case XML_txbx:
commit bada8c0b5856f694fbe5b50097bde71553f80de3
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sun Sep 2 21:20:40 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:40 2019 +0200

    ofz#10189 check container size
    
    Change-Id: Ie99e3b082795989290799d057a99b1bcff94b161
    Reviewed-on: https://gerrit.libreoffice.org/59912
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    Tested-by: Jenkins
    (cherry picked from commit 8767161e056b5d7fc8cf168d0541db86635d1041)

diff --git a/sc/source/core/data/dptabres.cxx b/sc/source/core/data/dptabres.cxx
index 136a5b69779c..b27da087ae64 100644
--- a/sc/source/core/data/dptabres.cxx
+++ b/sc/source/core/data/dptabres.cxx
@@ -2839,10 +2839,14 @@ void ScDPResultDimension::LateInitFrom(
 {
     if ( rParams.IsEnd( nPos ) )
         return;
-    OSL_ENSURE( nPos <= pItemData.size(), OString::number(pItemData.size()).getStr() );
+    if (nPos >= pItemData.size())
+    {
+        SAL_WARN("sc.core", "pos " << nPos << ", but vector size is " << pItemData.size());
+        return;
+    }
+    SCROW rThisData = pItemData[nPos];
     ScDPDimension* pThisDim = rParams.GetDim( nPos );
     ScDPLevel* pThisLevel = rParams.GetLevel( nPos );
-    SCROW rThisData = pItemData[nPos];
 
     if (!pThisDim || !pThisLevel)
         return;
commit 3fc816e1a9432e0a48e46c1c270631a167df5c3b
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Aug 25 19:08:35 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:39 2019 +0200

    ofz#10056 Null deref
    
    Change-Id: I9ea0f272d0a8b13fb51fec55ac57adca47cafc77
    Reviewed-on: https://gerrit.libreoffice.org/59601
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 48c677d55330ac6caf0065fa1776c985b876eead)

diff --git a/writerfilter/source/ooxml/OOXMLStreamImpl.cxx b/writerfilter/source/ooxml/OOXMLStreamImpl.cxx
index 2b7bff9f0abe..a815db220592 100644
--- a/writerfilter/source/ooxml/OOXMLStreamImpl.cxx
+++ b/writerfilter/source/ooxml/OOXMLStreamImpl.cxx
@@ -325,12 +325,20 @@ bool OOXMLStreamImpl::lcl_getTarget(const uno::Reference<embed::XRelationshipAcc
                     // simple string concatination here to handle that.
                     uno::Reference<uri::XUriReference> xPart = xFac->parse(sMyTarget);
                     uno::Reference<uri::XUriReference> xAbs = xFac->makeAbsolute(xBase, xPart, true, uri::RelativeUriExcessParentSegments_RETAIN);
-                    rDocumentTarget = xAbs->getPath();
-                    // path will start with the fragment separator. need to
-                    // remove that
-                    rDocumentTarget = rDocumentTarget.copy( 1 );
-                    if(sStreamType == sEmbeddingsType)
-                        embeddingsTarget = rDocumentTarget;
+                    if (!xAbs.is())
+                    {
+                        //it was invalid gibberish
+                        bFound = false;
+                    }
+                    else
+                    {
+                        rDocumentTarget = xAbs->getPath();
+                        // path will start with the fragment separator. need to
+                        // remove that
+                        rDocumentTarget = rDocumentTarget.copy( 1 );
+                        if(sStreamType == sEmbeddingsType)
+                            embeddingsTarget = rDocumentTarget;
+                    }
                 }
 
                 break;
commit 1bbae6cccda3adf9bcaa8a3a608488392bb323eb
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Aug 24 15:01:23 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:39 2019 +0200

    ofz#10045 Null deref
    
    Change-Id: If9c8edd94b02240510325d6c9c0fc7584ba89b5f
    Reviewed-on: https://gerrit.libreoffice.org/59574
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit fabac301a2c431a51bcae435e7ad87c843331877)

diff --git a/writerfilter/source/dmapper/DomainMapperTableHandler.cxx b/writerfilter/source/dmapper/DomainMapperTableHandler.cxx
index 12d22f321151..bb038d4c7f27 100644
--- a/writerfilter/source/dmapper/DomainMapperTableHandler.cxx
+++ b/writerfilter/source/dmapper/DomainMapperTableHandler.cxx
@@ -1015,8 +1015,11 @@ void DomainMapperTableHandler::endTable(unsigned int nestedTableLevel, bool bTab
         {
             xStart = m_aTableRanges[0][0][0];
             uno::Sequence< uno::Sequence< uno::Reference<text::XTextRange> > >& rLastRow = m_aTableRanges[m_aTableRanges.size() - 1];
-            uno::Sequence< uno::Reference<text::XTextRange> >& rLastCell = rLastRow[rLastRow.getLength() - 1];
-            xEnd = rLastCell[1];
+            if (rLastRow.getLength())
+            {
+                uno::Sequence< uno::Reference<text::XTextRange> >& rLastCell = rLastRow[rLastRow.getLength() - 1];
+                xEnd = rLastCell[1];
+            }
         }
         uno::Reference<text::XTextTable> xTable;
         try
commit ccc087ae259e92492899ee4f02c8c7fe19d7c8c9
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Aug 14 15:22:58 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:39 2019 +0200

    tdf#117086 crash on deleted SwFootnoteBossFrame
    
    use SwFrameDeleteGuard to lock pOldBoss to exist over the range
    its directly accessed
    
    Change-Id: I68af80114a380f68b86cbc78278fb9e5e87cccce
    Reviewed-on: https://gerrit.libreoffice.org/59113
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit d1b9cbe749fc3329bda1e8ddaee6d8a6f783ad82)

diff --git a/sw/source/core/layout/flowfrm.cxx b/sw/source/core/layout/flowfrm.cxx
index 72d5de9da185..ddcf0a9ad465 100644
--- a/sw/source/core/layout/flowfrm.cxx
+++ b/sw/source/core/layout/flowfrm.cxx
@@ -1850,6 +1850,8 @@ bool SwFlowFrame::MoveFwd( bool bMakePage, bool bPageBreak, bool bMoveAlways )
         }
     }
 
+    std::unique_ptr<SwFrameDeleteGuard> xDeleteGuard(bMakePage ? new SwFrameDeleteGuard(pOldBoss) : nullptr);
+
     bool bSamePage = true;
     SwLayoutFrame *pNewUpper =
             m_rThis.GetLeaf( bMakePage ? MAKEPAGE_INSERT : MAKEPAGE_NONE, true );
@@ -1888,6 +1890,8 @@ bool SwFlowFrame::MoveFwd( bool bMakePage, bool bPageBreak, bool bMoveAlways )
         pOldBoss = pOldBoss->FindFootnoteBossFrame( true );
         SwPageFrame* pNewPage = pOldPage;
 
+        xDeleteGuard.reset();
+
         // First, we move the footnotes.
         bool bFootnoteMoved = false;
 
commit f46c4395590e11e693d135ff655c2423f06371a5
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri Aug 17 08:47:19 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:39 2019 +0200

    ofz#9934 null deref
    
    Change-Id: I6833ad8a556b561a37e468da8845914cabfac4c5
    Reviewed-on: https://gerrit.libreoffice.org/59249
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 4fb7390956a193e00c1b599129b89933c41f98ae)

diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index 0c03ec593fd3..1cf091d5b4f0 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -1380,8 +1380,9 @@ void DomainMapper_Impl::appendOLE( const OUString& rStreamName, const OLEHandler
         if (!m_aAnchoredStack.empty())
             m_aAnchoredStack.top( ).bToRemove = true;
         RemoveLastParagraph();
-        m_aTextAppendStack.pop();
-
+        SAL_WARN_IF(m_aTextAppendStack.empty(), "writerfilter.dmapper", "no text stack");
+        if (!m_aTextAppendStack.empty())
+            m_aTextAppendStack.pop();
 
         appendTextContent( xOLE, uno::Sequence< beans::PropertyValue >() );
 
commit 6bb558aef6c88b05f4e2d8478480d0b6f4936b30
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Aug 16 14:24:46 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:39 2019 +0200

    tdf#119224 start and end are expected to exist for the scope of this function
    
    Change-Id: I771bce68a2ac923af6a7d54646a2c59ce6f10f7e
    Reviewed-on: https://gerrit.libreoffice.org/59179
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 81818670fe90fca438dfb0c22903474745112cfe)

diff --git a/sw/source/core/layout/trvlfrm.cxx b/sw/source/core/layout/trvlfrm.cxx
index a102300b8ba1..6708dca13589 100644
--- a/sw/source/core/layout/trvlfrm.cxx
+++ b/sw/source/core/layout/trvlfrm.cxx
@@ -2029,13 +2029,15 @@ void SwRootFrame::CalcFrameRects(SwShellCursor &rCursor)
 
     //First obtain the ContentFrames for the start and the end - those are needed
     //anyway.
-    SwContentFrame const* pStartFrame = pStartPos->nNode.GetNode().
+    SwContentFrame* pStartFrame = pStartPos->nNode.GetNode().
         GetContentNode()->getLayoutFrame( this, &rCursor.GetSttPos(), pStartPos );
 
-    SwContentFrame const* pEndFrame   = pEndPos->nNode.GetNode().
+    SwContentFrame* pEndFrame   = pEndPos->nNode.GetNode().
         GetContentNode()->getLayoutFrame( this, &rCursor.GetEndPos(), pEndPos );
 
-    OSL_ENSURE( (pStartFrame && pEndFrame), "Keine ContentFrames gefunden." );
+    assert(pStartFrame && pEndFrame && "No ContentFrames found.");
+    //tdf#119224 start and end are expected to exist for the scope of this function
+    SwFrameDeleteGuard aStartFrameGuard(pStartFrame), aEndFrameGuard(pEndFrame);
 
     //Do not subtract the FlyFrames in which selected Frames lie.
     SwSortedObjs aSortObjs;
commit c871ebc713a794b324067977da4c3607b7d42a8e
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 15 09:16:54 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:38 2019 +0200

    ofz#9892 Null-dereference
    
    Change-Id: I8ab1948e5760da365bdddaf45955912a18b20ead
    Reviewed-on: https://gerrit.libreoffice.org/59056
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
    (cherry picked from commit a0aea0b22a5ceb31b69407be6b74506194d44134)

diff --git a/oox/source/drawingml/shapecontext.cxx b/oox/source/drawingml/shapecontext.cxx
index fe011c94f944..471d95727919 100644
--- a/oox/source/drawingml/shapecontext.cxx
+++ b/oox/source/drawingml/shapecontext.cxx
@@ -100,7 +100,9 @@ ContextHandlerRef ShapeContext::onCreateContext( sal_Int32 aElementToken, const
     }
     case XML_txXfrm:
     {
-        mpShapePtr->getTextBody()->getTextProperties().moRotation = rAttribs.getInteger( XML_rot );
+        const TextBodyPtr& rShapePtr = mpShapePtr->getTextBody();
+        if (rShapePtr)
+            rShapePtr->getTextProperties().moRotation = rAttribs.getInteger( XML_rot );
         return nullptr;
     }
     case XML_cNvSpPr:
commit 117ab2f46255f14c166582a52005672a16a832f1
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Aug 13 09:20:19 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:38 2019 +0200

    crashtesting: empty B2DRange range turned into oversized Rectangle
    
    with document ooo47086-1.xls
    
    Change-Id: Ia43b6b3e3951875280892138c7068348f1b56a7c
    Reviewed-on: https://gerrit.libreoffice.org/58921
    Tested-by: Jenkins
    Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
    (cherry picked from commit eabb2bf06aba0de81a6d1e7715859fa63379325b)

diff --git a/svx/source/svdraw/svdopath.cxx b/svx/source/svdraw/svdopath.cxx
index fdc9c9c63a5d..922a1bb6f7b1 100644
--- a/svx/source/svdraw/svdopath.cxx
+++ b/svx/source/svdraw/svdopath.cxx
@@ -1692,6 +1692,9 @@ static Rectangle lcl_ImpGetBoundRect(const basegfx::B2DPolyPolygon& rPolyPolygon
 {
     basegfx::B2DRange aRange(basegfx::tools::getRange(rPolyPolygon));
 
+    if (aRange.isEmpty())
+        return Rectangle();
+
     return Rectangle(
         FRound(aRange.getMinX()), FRound(aRange.getMinY()),
         FRound(aRange.getMaxX()), FRound(aRange.getMaxY()));
commit 417740a011acec0518ec94e11e425c3537bffbfa
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Aug 13 16:41:31 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:38 2019 +0200

    ofz#9870: check sequence length before use
    
    Change-Id: I137a9de49c5a73eb5f277dc1519e5e036abba31c
    Reviewed-on: https://gerrit.libreoffice.org/58946
    Tested-by: Jenkins
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit 148b3cfd0b948163416f1d19ee6876d3459f1d9f)

diff --git a/writerfilter/source/ooxml/OOXMLDocumentImpl.cxx b/writerfilter/source/ooxml/OOXMLDocumentImpl.cxx
index 9ede7431bf6c..86ba0026c60d 100644
--- a/writerfilter/source/ooxml/OOXMLDocumentImpl.cxx
+++ b/writerfilter/source/ooxml/OOXMLDocumentImpl.cxx
@@ -634,6 +634,12 @@ void OOXMLDocumentImpl::resolveGlossaryStream(Stream & /*rStream*/)
               OOXMLStream::Pointer_t gStream;
               uno::Sequence< beans::StringPair > aSeq = aSeqs[j];
               //Follows following aSeq[0] is Id, aSeq[1] is Type, aSeq[2] is Target
+              if (aSeq.getLength() < 3)
+              {
+                  SAL_WARN("writerfilter.ooxml", "too short sequence");
+                  continue;
+              }
+
               OUString gId(aSeq[0].Second);
               OUString gType(aSeq[1].Second);
               OUString gTarget(aSeq[2].Second);
commit 25f5516152e71f62401762c2fb4d575777c9540f
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 08:55:23 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:38 2019 +0200

    forcepoint#55 invalid iterator increment
    
    Change-Id: I151602f645a48404d93e0ae64a9e1d2a6ba2bc4b
    Reviewed-on: https://gerrit.libreoffice.org/58386
    Tested-by: Jenkins
    Reviewed-by: Markus Mohrhard <markus.mohrhard at googlemail.com>
    (cherry picked from commit 26300f5d4c4e6241baf8cadcfea094e7969814a5)

diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx
index 27abbbf249fe..adcbd04db774 100644
--- a/sc/source/core/data/column3.cxx
+++ b/sc/source/core/data/column3.cxx
@@ -2978,6 +2978,8 @@ public:
                 if (xCurGrp)
                 {
                     // Move to the cell after the last cell of the current group.
+                    if (xCurGrp->mnLength > std::distance(it, itEnd))
+                        throw css::lang::IllegalArgumentException();
                     std::advance(it, xCurGrp->mnLength);
                     nRow += xCurGrp->mnLength;
                 }
commit 11d72022bb7bb38e7a25c385bbbf465c61a1fd14
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 09:18:16 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:38 2019 +0200

    forcepoint#57 sanity check stream signature size
    
    Change-Id: I5ae459e159a64f32c62278a87e37deb08ab9d6ac
    Reviewed-on: https://gerrit.libreoffice.org/58448
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 8ed224599ae7985b577f0bf737b2b9b2e8dd47b7)

diff --git a/xmlsecurity/source/helper/xmlsignaturehelper.cxx b/xmlsecurity/source/helper/xmlsignaturehelper.cxx
index e7e8e05cdb06..b794c666c1fb 100644
--- a/xmlsecurity/source/helper/xmlsignaturehelper.cxx
+++ b/xmlsecurity/source/helper/xmlsignaturehelper.cxx
@@ -424,21 +424,25 @@ bool XMLSignatureHelper::ReadAndVerifySignatureStorage(const uno::Reference<embe
                 if (!bCacheLastSignature && i == aRelationsInfo.getLength() - 1)
                     bCache = false;
 
-                if (bCache)
+                if (!bCache)
+                    continue;
+                // Store the contents of the stream as is, in case we need to write it back later.
+                xInputStream.clear();
+                xInputStream.set(xStorage->openStreamElement(it->Second, nOpenMode), uno::UNO_QUERY);
+                uno::Reference<beans::XPropertySet> xPropertySet(xInputStream, uno::UNO_QUERY);
+                if (!xPropertySet.is())
+                    continue;
+
+                sal_Int64 nSize = 0;
+                xPropertySet->getPropertyValue("Size") >>= nSize;
+                if (nSize < 0 || nSize > SAL_MAX_INT32)
                 {
-                    // Store the contents of the stream as is, in case we need to write it back later.
-                    xInputStream.clear();
-                    xInputStream.set(xStorage->openStreamElement(it->Second, nOpenMode), uno::UNO_QUERY);
-                    uno::Reference<beans::XPropertySet> xPropertySet(xInputStream, uno::UNO_QUERY);
-                    if (xPropertySet.is())
-                    {
-                        sal_Int64 nSize = 0;
-                        xPropertySet->getPropertyValue("Size") >>= nSize;
-                        uno::Sequence<sal_Int8> aData;
-                        xInputStream->readBytes(aData, nSize);
-                        mpXSecController->setSignatureBytes(aData);
-                    }
+                    SAL_WARN("xmlsecurity.helper", "bogus signature size: " << nSize);
+                    continue;
                 }
+                uno::Sequence<sal_Int8> aData;
+                xInputStream->readBytes(aData, nSize);
+                mpXSecController->setSignatureBytes(aData);
             }
         }
     }
commit 16f4c3ae73c227c404d1f7eec2062abe531c3386
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 11:48:30 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:38 2019 +0200

    forcepoint#64 null deref
    
    Change-Id: I4acf03a7911aa203fc4ef10b6a96b0135d6adbbc
    Reviewed-on: https://gerrit.libreoffice.org/58415
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit a5b84a6888deaa406786b350a0adcf9ef9020f48)

diff --git a/sc/source/filter/xml/XMLTableShapeImportHelper.cxx b/sc/source/filter/xml/XMLTableShapeImportHelper.cxx
index 553c36fae9c2..1021091726c4 100644
--- a/sc/source/filter/xml/XMLTableShapeImportHelper.cxx
+++ b/sc/source/filter/xml/XMLTableShapeImportHelper.cxx
@@ -200,7 +200,7 @@ void XMLTableShapeImportHelper::finishShape(
             // the group
             Point aStartPoint( rShape->getPosition().X,rShape->getPosition().Y );
             uno::Reference< drawing::XShape > xChild( rShapes, uno::UNO_QUERY );
-            if (SvxShape* pGroupShapeImp = SvxShape::getImplementation( lcl_getTopLevelParent( xChild ) ))
+            if (SvxShape* pGroupShapeImp = xChild.is() ? SvxShape::getImplementation(lcl_getTopLevelParent(xChild)) : nullptr)
             {
                 if (SdrObject *pSdrObj = pGroupShapeImp->GetSdrObject())
                 {
commit 57aa6591bf0ae363bb60b590c91def65a741fedb
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 11:36:01 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:37 2019 +0200

    forcepoint#63 null deref
    
    Change-Id: Ib22ff870cd0d8cdd2350b2aa8698f5a2e3866bdc
    Reviewed-on: https://gerrit.libreoffice.org/58411
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 9a0e5aeca5a118e748e625f6ecbd49a497b8e232)

diff --git a/filter/source/xsltfilter/OleHandler.cxx b/filter/source/xsltfilter/OleHandler.cxx
index d79cd01713a1..37440f95b6b4 100644
--- a/filter/source/xsltfilter/OleHandler.cxx
+++ b/filter/source/xsltfilter/OleHandler.cxx
@@ -97,7 +97,7 @@ namespace XSLT
     OString SAL_CALL
     OleHandler::encodeSubStorage(const OUString& streamName)
     {
-        if (!m_storage->hasByName(streamName))
+        if (!m_storage.is() || !m_storage->hasByName(streamName))
             {
                 return "Not Found:";// + streamName;
             }
commit 9d6bd08ca6cdba84e50d028c21a01527af690127
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 11:31:21 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:37 2019 +0200

    forcepoint#62 null deref
    
    Change-Id: I255aeb96c3763aa106128d3463e4fd55395ef8b8
    Reviewed-on: https://gerrit.libreoffice.org/58409
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 9e434f2f5ad61092ee685369bce93d90a28db149)

diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index 80e52d8e28fa..0c03ec593fd3 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -4521,7 +4521,7 @@ void DomainMapper_Impl::PopFieldContext()
                     else
                     {
                         FormControlHelper::Pointer_t pFormControlHelper(pContext->getFormControlHelper());
-                        if (pFormControlHelper.get() != nullptr && pFormControlHelper->hasFFDataHandler() )
+                        if (pFormControlHelper.get() != nullptr && pFormControlHelper->hasFFDataHandler() && xCrsr.is())
                         {
                             uno::Reference< text::XFormField > xFormField( pContext->GetFormField() );
                             xToInsert.set(xFormField, uno::UNO_QUERY);
@@ -4537,7 +4537,7 @@ void DomainMapper_Impl::PopFieldContext()
                                 pFormControlHelper->insertControl(xTxtRange);
                             }
                         }
-                        else if(!pContext->GetHyperlinkURL().isEmpty())
+                        else if (!pContext->GetHyperlinkURL().isEmpty() && xCrsr.is())
                         {
                             xCrsr->gotoEnd( true );
 
commit e7f6c81166a107506139d8d79610a51da59989eb
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 10:19:52 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:37 2019 +0200

    forcepoint#58 null deref
    
    Change-Id: I826890ec85a16bc05fc1e4cd068079b0f8734d07
    Reviewed-on: https://gerrit.libreoffice.org/58394
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 8cee73aae9bca3a94aa7a0aa3bfa82b593d4c3c7)

diff --git a/writerfilter/source/rtftok/rtfsdrimport.cxx b/writerfilter/source/rtftok/rtfsdrimport.cxx
index 4a4001337790..d4e492a08e97 100644
--- a/writerfilter/source/rtftok/rtfsdrimport.cxx
+++ b/writerfilter/source/rtftok/rtfsdrimport.cxx
@@ -1004,6 +1004,8 @@ void RTFSdrImport::append(const OUString& aKey, const OUString& aValue)
 
 void RTFSdrImport::appendGroupProperty(const OUString& aKey, const OUString& aValue)
 {
+    if (m_aParents.empty())
+        return;
     uno::Reference<drawing::XShape> xShape(m_aParents.top(), uno::UNO_QUERY);
     if (xShape.is())
         applyProperty(xShape, aKey, aValue);
commit 64359dee56571892411e4c4fbd09360f0963a20e
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 09:04:58 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:37 2019 +0200

    forcepoint#56 null deref
    
    Change-Id: Iaa9c4d6901a340145412fa46eaf5c292c3fb62e8
    Reviewed-on: https://gerrit.libreoffice.org/58387
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 0845c1a74aef650b4aebaeea9587b3bfb5b38ffb)

diff --git a/writerfilter/source/dmapper/DomainMapper_Impl.cxx b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
index 703c36c4b411..80e52d8e28fa 100644
--- a/writerfilter/source/dmapper/DomainMapper_Impl.cxx
+++ b/writerfilter/source/dmapper/DomainMapper_Impl.cxx
@@ -2649,15 +2649,17 @@ void DomainMapper_Impl::PushFieldContext()
     TagLogger::getInstance().element("pushFieldContext");
 #endif
 
-    uno::Reference< text::XTextAppend >  xTextAppend;
+    uno::Reference<text::XTextCursor> xCrsr;
     if (!m_aTextAppendStack.empty())
-        xTextAppend = m_aTextAppendStack.top().xTextAppend;
-    uno::Reference< text::XTextRange > xStart;
-    if (xTextAppend.is())
     {
-        uno::Reference< text::XTextCursor > xCrsr = xTextAppend->createTextCursorByRange( xTextAppend->getEnd() );
-        xStart = xCrsr->getStart();
+        uno::Reference<text::XTextAppend> xTextAppend = m_aTextAppendStack.top().xTextAppend;
+        if (xTextAppend.is())
+            xCrsr = xTextAppend->createTextCursorByRange(xTextAppend->getEnd());
     }
+
+    uno::Reference< text::XTextRange > xStart;
+    if (xCrsr.is())
+        xStart = xCrsr->getStart();
     m_aFieldStack.push( std::make_shared<FieldContext>( xStart ) );
 }
 /*-------------------------------------------------------------------------
commit 0f12376600564878c0eef20e242341821273cfe4
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Aug 1 08:39:03 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:37 2019 +0200

    forcepoint#54 null deref
    
    Change-Id: I9ca04647b16f90bb2d2d4aa0d25b08a09c408fe0
    Reviewed-on: https://gerrit.libreoffice.org/58383
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 2c1cf211e830399ef70e1df94976871afc7c6b3e)

diff --git a/oox/source/crypto/CryptTools.cxx b/oox/source/crypto/CryptTools.cxx
index 4bb3ec2f2d28..f46b87828de0 100644
--- a/oox/source/crypto/CryptTools.cxx
+++ b/oox/source/crypto/CryptTools.cxx
@@ -141,6 +141,8 @@ sal_uInt32 Decrypt::update(vector<sal_uInt8>& output, vector<sal_uInt8>& input,
 #endif // USE_TLS_OPENSSL
 
 #if USE_TLS_NSS
+    if (!mContext)
+        return 0;
     (void)PK11_CipherOp( mContext, &output[0], &outputLength, actualInputLength, &input[0], actualInputLength );
 #endif // USE_TLS_NSS
 
commit f62301950a614878fca63147fe5aedfed59948fb
Author:     Eike Rathke <erack at redhat.com>
AuthorDate: Mon Oct 16 22:08:27 2017 +0200
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:36 2019 +0200

    Resolves: tdf#112933 correct number of one decimal in fraction of seconds
    
    Regression from
    
        commit 0ac1e2ad19d4fdb46dcf54f67db2df081f4675bb
        Date:   Wed Aug 2 09:39:43 2017 +0100
    
            Resolves: ofz#2833 null deref
    
    and similar for date+time
    
        commit 42b894f80a6d0c39bb0f7092eb204a15c22c4f38
        Date:   Sat Aug 5 19:15:36 2017 +0100
    
            ofz#2867 null deref
    
    Effectively revert the code changes of those, leaving the test
    case files intact, and "do the right thing" (switching two lines,
    to
    
        nPos = nPos + sStrArray[i].getLength();
        i++;
    
    nPos actually had always to be incremented by the length of the
    *current* string position but was used after only as an error
    position indicator, meaningless if there was no error.
    
    (cherry picked from commit 4f72d2ec6c210232e0abd4965e215611e807c125)
    
     Conflicts:
            svl/source/numbers/zforscan.cxx
    
    Backported.
    
    Change-Id: I9bc4e5e56d70a275d26df0b72ed6a19e9297e0fa
    Reviewed-on: https://gerrit.libreoffice.org/43440
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>
    (cherry picked from commit 35fcdb14e5d8af2f9770fc1994ad47b0774b9a55)

diff --git a/svl/source/numbers/zforscan.cxx b/svl/source/numbers/zforscan.cxx
index a5f1ada91cdc..11339a43fb59 100644
--- a/svl/source/numbers/zforscan.cxx
+++ b/svl/source/numbers/zforscan.cxx
@@ -2348,21 +2348,18 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
                         bDecSep = true;
                         nTypeArray[i] = NF_SYMBOLTYPE_DIGIT;
                         OUString& rStr = sStrArray[i];
+                        nPos = nPos + sStrArray[i].getLength();
+                        nCounter++;
                         i++;
-                        if (i < nAnzStrings)
+                        while (i < nAnzStrings &&
+                               sStrArray[i][0] == '0')
                         {
+                            rStr += sStrArray[i];
                             nPos = nPos + sStrArray[i].getLength();
+                            nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
+                            nAnzResStrings--;
                             nCounter++;
-                            while (i < nAnzStrings &&
-                                   sStrArray[i][0] == '0')
-                            {
-                                rStr += sStrArray[i];
-                                nPos = nPos + sStrArray[i].getLength();
-                                nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
-                                nAnzResStrings--;
-                                nCounter++;
-                                i++;
-                            }
+                            i++;
                         }
                     }
                     else
@@ -2501,21 +2498,18 @@ sal_Int32 ImpSvNumberformatScan::FinalScan( OUString& rString )
                             bDecSep = true;
                             nTypeArray[i] = NF_SYMBOLTYPE_DIGIT;
                             OUString& rStr = sStrArray[i];
+                            nPos = nPos + sStrArray[i].getLength();
                             i++;
-                            if (i < nAnzStrings)
+                            nCounter++;
+                            while (i < nAnzStrings &&
+                                   sStrArray[i][0] == '0')
                             {
+                                rStr += sStrArray[i];
                                 nPos = nPos + sStrArray[i].getLength();
+                                nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
+                                nAnzResStrings--;
                                 nCounter++;
-                                while (i < nAnzStrings &&
-                                       sStrArray[i][0] == '0')
-                                {
-                                    rStr += sStrArray[i];
-                                    nPos = nPos + sStrArray[i].getLength();
-                                    nTypeArray[i] = NF_SYMBOLTYPE_EMPTY;
-                                    nAnzResStrings--;
-                                    nCounter++;
-                                    i++;
-                                }
+                                i++;
                             }
                         }
                         else
commit 0fd7a9244f632e97fc11a696254db46f3571e468
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Aug 2 21:18:15 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:36 2019 +0200

    forcepoint#69 ditch any unclosed m_pPosAfterTOC before dropping cursor
    
    Change-Id: I6b56a48f5449b25fe3bdc2e02d3885388b0da74f
    Reviewed-on: https://gerrit.libreoffice.org/58498
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 71aae473c9c3cf15f75e2722afc7153a3af76d44)

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index f3ab92e7a9a9..b8bc89d44274 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -5405,6 +5405,7 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss)
 
     SAL_WARN_IF(m_pTableEndPaM, "sw.ww8", "document ended without table ending");
     m_pTableEndPaM.reset();  //ensure this is deleted before pPaM
+    m_pPosAfterTOC.reset();
     mpCursor.reset();
     m_pPaM = nullptr;
     m_pLastAnchorPos.reset();//ensure this is deleted before UpdatePageDescs
diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index 5776dd743ffa..05326eee6aa3 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -1358,7 +1358,7 @@ private:
     // Indicate that current on loading a hyperlink, which is inside a TOC; Managed by Read_F_Hyperlink() and End_Field()
     bool m_bLoadingTOXHyperlink;
     // a document position recorded the after-position of TOC section, managed by Read_F_TOX() and End_Field()
-    SwPaM* m_pPosAfterTOC;
+    std::unique_ptr<SwPaM> m_pPosAfterTOC;
     // used for some dropcap tweaking
     SwTextNode* m_pPreviousNode;
 
diff --git a/sw/source/filter/ww8/ww8par5.cxx b/sw/source/filter/ww8/ww8par5.cxx
index ab18387cfa26..eb6de960dff6 100644
--- a/sw/source/filter/ww8/ww8par5.cxx
+++ b/sw/source/filter/ww8/ww8par5.cxx
@@ -567,8 +567,7 @@ sal_uInt16 SwWW8ImplReader::End_Field()
                         if (m_pPosAfterTOC)
                         {
                             *m_pPaM = *m_pPosAfterTOC;
-                            delete m_pPosAfterTOC;
-                            m_pPosAfterTOC = nullptr;
+                            m_pPosAfterTOC.reset();
                         }
                     }
                 }
@@ -3370,11 +3369,7 @@ eF_ResT SwWW8ImplReader::Read_F_Tox( WW8FieldDesc* pF, OUString& rStr )
 
     //The TOC field representation contents should be inserted into TOC section, but not after TOC section.
     //So we need update the document position when loading TOC representation and after loading TOC;
-    if (m_pPosAfterTOC)
-    {
-        delete m_pPosAfterTOC;
-    }
-    m_pPosAfterTOC = new SwPaM(*m_pPaM, m_pPaM);
+    m_pPosAfterTOC.reset(new SwPaM(*m_pPaM, m_pPaM));
     (*m_pPaM).Move(fnMoveBackward);
     SwPaM aRegion(*m_pPaM, m_pPaM);
 
commit ac49e84deb4a3e45f9131aec36a83894250a8955
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Jul 24 14:20:20 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:36 2019 +0200

    ofz#9431 don't check attribs of Invalid column
    
    Change-Id: I9c5adcadfa2a8593ff90622449d6bdfa4810f2c0
    Reviewed-on: https://gerrit.libreoffice.org/57917
    Tested-by: Jenkins
    Reviewed-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit d909146913c762c2cdb6bed52fbbd817c05681e9)

diff --git a/sc/source/filter/rtf/eeimpars.cxx b/sc/source/filter/rtf/eeimpars.cxx
index 77e0c9bc0d2d..8b7e50886dd1 100644
--- a/sc/source/filter/rtf/eeimpars.cxx
+++ b/sc/source/filter/rtf/eeimpars.cxx
@@ -146,7 +146,7 @@ void ScEEImport::WriteToDocument( bool bSizeColsRows, double nOutputFactor, SvNu
         SCCOL nCol = nStartCol + pE->nCol + nMergeColAdd;
         // Determine RowMerge
         // Pure ColMerge and ColMerge of the first MergeRow already done during parsing
-        if ( nRow <= nOverlapRowMax )
+        if (nRow <= nOverlapRowMax && ValidCol(nCol))
         {
             while ( nCol <= MAXCOL && mpDoc->HasAttrib( nCol, nRow, nTab,
                 nCol, nRow, nTab, HASATTR_OVERLAPPED ) )
commit fd0812538979e9cdba09a77200c38c607f9c8267
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Jul 23 09:23:54 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:36 2019 +0200

    ofz#9507 wrong start point for Johab block 59
    
    Change-Id: I011f4cbb10324c4a7d4e1be3ab1355291f79730b
    Reviewed-on: https://gerrit.libreoffice.org/57839
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sbergman at redhat.com>
    (cherry picked from commit 6582602a126403185294afe9e3c2cd8479f9157b)

diff --git a/sal/textenc/tcvtkr6.tab b/sal/textenc/tcvtkr6.tab
index 776c15dbcf5e..ac9c0d15293d 100644
--- a/sal/textenc/tcvtkr6.tab
+++ b/sal/textenc/tcvtkr6.tab
@@ -1013,7 +1013,7 @@ static ImplUniToDBCSHighTab const aJOHABDBCSHighTab[256] =
     { 0x06, 0xFA, aImplUniToDBCSTab_JOHAB_56 },                 /* 0x56 */
     { 0x03, 0xFC, aImplUniToDBCSTab_JOHAB_57 },                 /* 0x57 */
     { 0x00, 0xFD, aImplUniToDBCSTab_JOHAB_58 },                 /* 0x58 */
-    { 0x07, 0xFF, aImplUniToDBCSTab_JOHAB_59 },                 /* 0x59 */
+    { 0x0F, 0xFF, aImplUniToDBCSTab_JOHAB_59 },                 /* 0x59 */
     { 0x01, 0xE9, aImplUniToDBCSTab_JOHAB_5A },                 /* 0x5A */
     { 0x05, 0xFA, aImplUniToDBCSTab_JOHAB_5B },                 /* 0x5B */
     { 0x01, 0xFD, aImplUniToDBCSTab_JOHAB_5C },                 /* 0x5C */
commit 714cd130c19c533c882252bcfe96e44a63a1d3c2
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Jun 26 11:58:30 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:36 2019 +0200

    forcepoint#47 bail when we detect the emf is broken
    
    Change-Id: I065635393763af774b45cbba6bd85c4334383b93
    Reviewed-on: https://gerrit.libreoffice.org/56458
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    (cherry picked from commit 8e5441469e07e85c5bd278ac5777eb2b550f900a)

diff --git a/cppcanvas/source/mtfrenderer/emfplus.cxx b/cppcanvas/source/mtfrenderer/emfplus.cxx
index 480ec100fc71..6ad81dd0369a 100644
--- a/cppcanvas/source/mtfrenderer/emfplus.cxx
+++ b/cppcanvas/source/mtfrenderer/emfplus.cxx
@@ -1859,11 +1859,14 @@ namespace cppcanvas
 
                 if (size < 12) {
                     SAL_INFO("cppcanvas.emf", "Size field is less than 12 bytes");
+                    break;
                 } else if (size > length) {
                     SAL_INFO("cppcanvas.emf", "Size field is greater than bytes left");
+                    break;
                 }
                 if (dataSize > (size-12)) {
                     SAL_INFO("cppcanvas.emf", "DataSize field is greater than Size-12");
+                    break;
                 }
 
                 SAL_INFO("cppcanvas.emf", "EMF+ record size: " << size << " type: " << emfTypeToName(type) << " flags: " << flags << " data size: " << dataSize);
commit 25901ac324e00040dcdb90382cf22b28e3c049d6
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Tue Jun 12 12:14:36 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:35 2019 +0200

    forcepoint#45 object may not be a EMFPPen
    
    Change-Id: Ifb5c17e13faf6e9d246e1668ef7916957a5296b6
    Reviewed-on: https://gerrit.libreoffice.org/55679
    Tested-by: Jenkins
    Reviewed-by: Eike Rathke <erack at redhat.com>
    (cherry picked from commit d5db9b8a8f99bed76c9a3e195a28049d677610a9)

diff --git a/cppcanvas/source/mtfrenderer/emfplus.cxx b/cppcanvas/source/mtfrenderer/emfplus.cxx
index 9154f92b92bf..480ec100fc71 100644
--- a/cppcanvas/source/mtfrenderer/emfplus.cxx
+++ b/cppcanvas/source/mtfrenderer/emfplus.cxx
@@ -1615,7 +1615,7 @@ namespace cppcanvas
         void ImplRenderer::EMFPPlusDrawPolygon (const ::basegfx::B2DPolyPolygon& polygon, const ActionFactoryParameters& rParms,
                                                 OutDevState& rState, const CanvasSharedPtr& rCanvas, sal_uInt32 penIndex)
         {
-            EMFPPen* pen = static_cast<EMFPPen*>( aObjects [penIndex & 0xff] );
+            EMFPPen* pen = dynamic_cast<EMFPPen*>( aObjects [penIndex & 0xff] );
 
             SAL_WARN_IF( !pen, "cppcanvas.emf", "emf+ missing pen" );
 
commit 9869f1a8745b0cec8cf159c47bda5373e67fcb09
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon May 28 21:51:01 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:35 2019 +0200

    forcepoint#42 check available str length
    
    Change-Id: Ie476968ddaa4c3e5475ae9aa6133e7aba38d5975
    Reviewed-on: https://gerrit.libreoffice.org/54978
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
    (cherry picked from commit 15ea1cda0b3c37ff944ad9a239b7ed453e8b0591)

diff --git a/basic/source/comp/scanner.cxx b/basic/source/comp/scanner.cxx
index 6dfe2c589bbf..784122d6d7c1 100644
--- a/basic/source/comp/scanner.cxx
+++ b/basic/source/comp/scanner.cxx
@@ -543,7 +543,7 @@ bool SbiScanner::NextSym()
             case '>': if( *pLine == '=' ) n = 2; break;
             case ':': if( *pLine == '=' ) n = 2; break;
         }
-        aSym = aLine.copy( nCol, n );
+        aSym = aLine.copy(nCol, std::min(n, aLine.getLength() - nCol));
         pLine += n-1; nCol = nCol + n;
     }
 
commit 055be3f241902f59b2caac3e21053f5c801e02b3
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon May 28 21:36:16 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:35 2019 +0200

    forcepoint#41 null deref
    
    Change-Id: I16e9e083811c6e14861da1ba1df7d46e8c8771d7
    Reviewed-on: https://gerrit.libreoffice.org/54974
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
    (cherry picked from commit 0a2035492c66bc323d84ad6c2c4cbc0dc3c9d9aa)

diff --git a/drawinglayer/source/texture/texture3d.cxx b/drawinglayer/source/texture/texture3d.cxx
index a3915d5f290d..127cb71b729b 100644
--- a/drawinglayer/source/texture/texture3d.cxx
+++ b/drawinglayer/source/texture/texture3d.cxx
@@ -75,8 +75,6 @@ namespace drawinglayer
             mbIsTransparent(maBitmapEx.IsTransparent())
         {
             // #121194# Todo: use alpha channel, too (for 3d)
-            mpReadBitmap = maBitmapEx.GetBitmap().AcquireReadAccess();
-            OSL_ENSURE(mpReadBitmap, "GeoTexSvxBitmapEx: Got no read access to Bitmap (!)");
 
             if(mbIsTransparent)
             {
@@ -93,8 +91,13 @@ namespace drawinglayer
                 mpReadTransparence = maTransparence.AcquireReadAccess();
             }
 
-            mfMulX = (double)mpReadBitmap->Width() / maSize.getX();
-            mfMulY = (double)mpReadBitmap->Height() / maSize.getY();
+            mpReadBitmap = maBitmapEx.GetBitmap().AcquireReadAccess();
+            SAL_WARN_IF(!mpReadBitmap, "drawinglayer", "GeoTexSvxBitmapEx: Got no read access to Bitmap");
+            if (mpReadBitmap)
+            {
+                mfMulX = static_cast<double>(mpReadBitmap->Width()) / maSize.getX();
+                mfMulY = static_cast<double>(mpReadBitmap->Height()) / maSize.getY();
+            }
 
             if(maSize.getX() <= 1.0)
             {
commit 8a0bd13ce26a5ed60a1dd69c7a4329bc4602ebc1
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon May 28 21:22:56 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:35 2019 +0200

    forcepoint#40 null deref
    
    presumably since
    
    commit 0098bee792c3e208ea4f6ef1c676958d3f4cd207
    Date:   Thu Sep 21 06:48:09 2017 +0200
    
        tdf#112501: Pivot table: popupbuttons are placed on wrong cells
    
    Change-Id: I5413c0ba06fca25cb22256a20ef9640767dd9e50
    Reviewed-on: https://gerrit.libreoffice.org/54970
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Christian Lohmaier <lohmaier+LibreOffice at googlemail.com>
    (cherry picked from commit 69c5be9b26cf1a45e220d69f65b1bb0fa2aedaf6)

diff --git a/sc/qa/unit/data/xls/forcepoint-pivot-1.xls b/sc/qa/unit/data/xls/forcepoint-pivot-1.xls
new file mode 100644
index 000000000000..12919922666b
Binary files /dev/null and b/sc/qa/unit/data/xls/forcepoint-pivot-1.xls differ
diff --git a/sc/source/filter/excel/xipivot.cxx b/sc/source/filter/excel/xipivot.cxx
index 11fe5a15bde4..85f178379a7c 100644
--- a/sc/source/filter/excel/xipivot.cxx
+++ b/sc/source/filter/excel/xipivot.cxx
@@ -1507,13 +1507,13 @@ void XclImpPivotTable::ApplyMergeFlags(const ScRange& rOutRange, const ScDPSaveD
         itr    = aFieldBtns.begin();
         itrEnd = aFieldBtns.end();
         vector<const ScDPSaveDimension*>::const_iterator itDim = aFieldDims.begin();
-        for (; itr != itrEnd; ++itr, ++itDim)
+        for (; itr != itrEnd; ++itr)
         {
             ScMF nMFlag = ScMF::Button;
-            const ScDPSaveDimension* pDim = *itDim;
-            if (pDim->HasInvisibleMember())
+            const ScDPSaveDimension* pDim = itDim != aFieldDims.end() ? *itDim++ : nullptr;
+            if (pDim && pDim->HasInvisibleMember())
                 nMFlag |= ScMF::HiddenMember;
-            if (!pDim->IsDataLayout())
+            if (!pDim || !pDim->IsDataLayout())
                 nMFlag |= ScMF::ButtonPopup;
             rDoc.ApplyFlagsTab(itr->Col(), itr->Row(), itr->Col(), itr->Row(), itr->Tab(), nMFlag);
         }
commit c267b139f660c6990ec879294c8c1b5f5cfb7699
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon May 14 16:50:30 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:35 2019 +0200

    ofz#7322 lcl_MarkEqualByStart sort logic differs from that of operator==
    
    when it encounters a SwPosition with a SwIndex nContent whose m_pIndexReg is
    null and compares to one whose m_pIndexReg is not null, where both have an
    m_nIndex of 0.
    
    operator== considers them different, while lcl_MarkEqualByStart doesn't care
    and sorts them as equal
    
    Change-Id: I29920b98c9e6f395487de1b9cafa6b1282b2b1b6
    Reviewed-on: https://gerrit.libreoffice.org/54342
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Miklos Vajna <vmiklos at collabora.co.uk>
    (cherry picked from commit b3aece104b886618552828c168a1b51b3290f38f)

diff --git a/sw/qa/core/data/ww8/indeterminate/ofz7322-1.doc b/sw/qa/core/data/ww8/indeterminate/ofz7322-1.doc
new file mode 100644
index 000000000000..5f4858849acf
Binary files /dev/null and b/sw/qa/core/data/ww8/indeterminate/ofz7322-1.doc differ
diff --git a/sw/source/core/doc/docbm.cxx b/sw/source/core/doc/docbm.cxx
index 89252fb447cf..59937a578d8d 100644
--- a/sw/source/core/doc/docbm.cxx
+++ b/sw/source/core/doc/docbm.cxx
@@ -206,6 +206,13 @@ namespace
         return false;
     }
 
+    bool lcl_MarkEqualByStart(const IDocumentMarkAccess::pMark_t& rpFirst,
+                              const IDocumentMarkAccess::pMark_t& rpSecond)
+    {
+        return !lcl_MarkOrderingByStart(rpFirst, rpSecond) &&
+               !lcl_MarkOrderingByStart(rpSecond, rpFirst);
+    }
+
     IDocumentMarkAccess::iterator_t lcl_FindMark(
         IDocumentMarkAccess::container_t& rMarks,
         const IDocumentMarkAccess::pMark_t& rpMarkToFind)
@@ -216,7 +223,7 @@ namespace
         // since there are usually not too many marks on the same start
         // position, we are not doing a bisect search for the upper bound
         // but instead start to iterate from pMarkLow directly
-        while(ppCurrentMark != rMarks.end() && **ppCurrentMark == *rpMarkToFind)
+        while (ppCurrentMark != rMarks.end() && lcl_MarkEqualByStart(*ppCurrentMark, rpMarkToFind))
         {
             if(ppCurrentMark->get() == rpMarkToFind.get())
             {
commit f6915c4e24879cc9beadf393d8c863822eba0727
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Fri May 11 09:27:49 2018 +0100
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:35 2019 +0200

    Related: ofz#8226 + valgrind: uninitialized value
    
    Change-Id: I63dea876dffe2d9e17b506dbd8515da2d97fbf08
    Reviewed-on: https://gerrit.libreoffice.org/54114
    Reviewed-by: Michael Stahl <Michael.Stahl at cib.de>
    Tested-by: Jenkins <ci at libreoffice.org>
    (cherry picked from commit 0ec74577a97ca51d50e0f3782c289c95c6430641)

diff --git a/starmath/source/mathtype.cxx b/starmath/source/mathtype.cxx
index d18ef6386445..2138c48747a5 100644
--- a/starmath/source/mathtype.cxx
+++ b/starmath/source/mathtype.cxx
@@ -2841,7 +2841,7 @@ void MathType::HandleSetSize()
 bool MathType::HandleChar(sal_Int32 &rTextStart, int &rSetSize, int nLevel,
     sal_uInt8 nTag, sal_uInt8 nSelector, sal_uInt8 nVariation, bool bSilent)
 {
-    sal_Unicode nChar;
+    sal_Unicode nChar(0);
     bool bRet = true;
 
     if (xfAUTO(nTag))
@@ -2854,7 +2854,7 @@ bool MathType::HandleChar(sal_Int32 &rTextStart, int &rSetSize, int nLevel,
     pS->ReadUChar( nTypeFace );
     if (nVersion < 3)
     {
-        sal_uInt8 nChar8;
+        sal_uInt8 nChar8(0);
         pS->ReadUChar( nChar8 );
         nChar = nChar8;
     }
commit 9dd3e285fdf3f121de1a70fa67c4e8d5ddf1b6f0
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Mon Mar 12 14:13:23 2018 +0000
Commit:     Michael Stahl <Michael.Stahl at cib.de>
CommitDate: Tue Aug 6 14:35:34 2019 +0200

    forcepoint #27 check region bands loaded from stream for consistency
    
    Change-Id: I92376b5fb4208c78fa25a94d4dd394256793161c
    Reviewed-on: https://gerrit.libreoffice.org/51145
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Michael Stahl <mstahl at redhat.com>
    (cherry picked from commit 2a63eb8ba642b58814f8a78ba65a2c537aa97cdf)

diff --git a/vcl/inc/regionband.hxx b/vcl/inc/regionband.hxx
index 91a13ebffcbf..11a19314a2f5 100644
--- a/vcl/inc/regionband.hxx
+++ b/vcl/inc/regionband.hxx
@@ -36,6 +36,7 @@ private:
     ImplRegionBand*             mpLastCheckedBand;
 
     void implReset();
+    SAL_WARN_UNUSED_RESULT bool CheckConsistency() const;
 
 public:
     RegionBand();
@@ -46,7 +47,7 @@ public:
 
     bool operator==( const RegionBand& rRegionBand ) const;
 

... etc. - the rest is truncated


More information about the Libreoffice-commits mailing list