Rebased ref, commits from common ancestor:
commit 74432429bee769a85995752717a535c6dc36ffb1
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Tue Mar 1 10:18:51 2022 +0000
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:51 2022 +0100
ofz: don't register style if hbox load failed
Change-Id: I4d9d5d76f0c2385871003720e933ed1926f66c70
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130771
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
Tested-by: Jenkins
(cherry picked from commit 3ac009bfec614ece98313c6444b4c1183ff14954)
(cherry picked from commit 8abce17e43858d85325f05cb46d0b8d717356919)
diff --git a/hwpfilter/source/hwpread.cxx b/hwpfilter/source/hwpread.cxx
index f3a6401260c5..61c427ad836c 100644
--- a/hwpfilter/source/hwpread.cxx
+++ b/hwpfilter/source/hwpread.cxx
@@ -234,7 +234,6 @@ bool TxtBox::Read(HWPFile & hwpf)
hwpf.Read2b(&option, 1);
hwpf.Read2b(&ctrl_ch, 1);
hwpf.Read2b(style.margin, 12);
- hwpf.AddFBoxStyle(&style);
hwpf.Read2b(&box_xs, 1);
hwpf.Read2b(&box_ys, 1);
hwpf.Read2b(&cap_xs, 1);
@@ -362,7 +361,10 @@ bool TxtBox::Read(HWPFile & hwpf)
else
m_pTable = nullptr;
- return !hwpf.State();
+ bSuccess = !hwpf.State();
+ if (bSuccess)
+ hwpf.AddFBoxStyle(&style);
+ return bSuccess;
}
namespace
@@ -509,12 +511,14 @@ bool Picture::Read(HWPFile & hwpf)
style.boxtype = 'G';
else
style.boxtype = 'D';
- hwpf.AddFBoxStyle(&style);
// caption
hwpf.ReadParaList(caption);
- return !hwpf.State();
+ bool bSuccess = !hwpf.State();
+ if (bSuccess)
+ hwpf.AddFBoxStyle(&style);
+ return bSuccess;
}
// line(15)
@@ -552,7 +556,6 @@ bool Line::Read(HWPFile & hwpf)
hwpf.Read2b(&option, 1);
hwpf.Read2b(&ctrl_ch, 1);
hwpf.Read2b(style.margin, 12);
- hwpf.AddFBoxStyle(&style);
hwpf.Read2b(&box_xs, 1);
hwpf.Read2b(&box_ys, 1);
hwpf.Read2b(&cap_xs, 1);
@@ -581,7 +584,10 @@ bool Line::Read(HWPFile & hwpf)
hwpf.Read2b(&color, 1);
style.xpos = width;
- return !hwpf.State();
+ bool bSuccess = !hwpf.State();
+ if (bSuccess)
+ hwpf.AddFBoxStyle(&style);
+ return bSuccess;
}
// hidden(15)
commit 030561c8c7d324bc9edf462864f7a50cf54e0243
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Tue Mar 1 09:35:34 2022 +0000
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:51 2022 +0100
ofz: glyph data must be at least 10 bytes long to be useful
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130767
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
Tested-by: Jenkins
(cherry picked from commit b228045cf3fb50128fd40a8f26376443ad22f874)
Change-Id: I312c33c598013feced15c6f2dbcc66e493b703e6
diff --git a/vcl/source/fontsubset/ttcr.cxx b/vcl/source/fontsubset/ttcr.cxx
index 44d53ff10a23..e80260160c45 100644
--- a/vcl/source/fontsubset/ttcr.cxx
+++ b/vcl/source/fontsubset/ttcr.cxx
@@ -1251,7 +1251,7 @@ static void ProcessTables(TrueTypeCreator *tt)
/* printf("IDs: %d %d.\n", gd->glyphID, gd->newID); */
- if (gd->nbytes != 0) {
+ if (gd->nbytes >= 10) {
z = GetInt16(gd->ptr, 2);
if (z < xMin) xMin = z;
commit 52ed9ef879de38e71311917e0010bab42b1c9f49
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Feb 28 21:12:07 2022 +0000
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:51 2022 +0100
ofz: measure maximum possible contours
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130774
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
(cherry picked from commit 26abdb564dad2011a298fc1253279232cb8b59cf)
Change-Id: Ie039abd835fef06514edde12b99e17360f5481a5
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 2d2157f6f675..8a684e472e0a 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -362,7 +362,13 @@ static int GetSimpleTTOutline(TrueTypeFont const *ttf,
sal_uInt32 glyphID, Contr
if( glyphID >= ttf->nglyphs ) /*- glyph is not present in the
font */
return 0;
- const sal_uInt8* ptr = table + ttf->goffsets[glyphID];
+ sal_uInt32 nGlyphOffset = ttf->goffsets[glyphID];
+ if (nGlyphOffset > nTableSize)
+ return 0;
+
+ const sal_uInt8* ptr = table + nGlyphOffset;
+ const sal_uInt32 nMaxGlyphSize = nTableSize - nGlyphOffset;
+
const sal_Int16 numberOfContours = GetInt16(ptr,
GLYF_numberOfContours_offset);
if( numberOfContours <= 0 ) /*- glyph is not simple */
return 0;
@@ -377,7 +383,7 @@ static int GetSimpleTTOutline(TrueTypeFont const *ttf,
sal_uInt32 glyphID, Contr
/* determine the last point and be extra safe about it. But probably this
code is not needed */
sal_uInt16 lastPoint=0;
- const sal_Int32 nMaxContours = (nTableSize - 10)/2;
+ const sal_Int32 nMaxContours = (nMaxGlyphSize - 10)/2;
if (numberOfContours > nMaxContours)
return 0;
for (i=0; i<numberOfContours; i++)
commit 503d84cabb68233a12a3a9602253f4345be86ad7
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Tue Mar 1 11:45:23 2022 +0000
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:51 2022 +0100
protect frame from triggering deleting itself
LIBREOFFICE-N4LA0OHZ
Change-Id: I0d24277665a317f047b286fe0f0878b3814ded65
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130766
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
(cherry picked from commit ee2a192923bf709d05c174848e7054cd411b205a)
(cherry picked from commit 3d3c6462eeef581af2b936071c3ef432858b04a5)
diff --git a/sw/qa/extras/layout/data/LIBREOFFICE-N4LA0OHZ.rtf
b/sw/qa/extras/layout/data/LIBREOFFICE-N4LA0OHZ.rtf
new file mode 100755
index 000000000000..47d284aa5753
--- /dev/null
+++ b/sw/qa/extras/layout/data/LIBREOFFICE-N4LA0OHZ.rtf
@@ -0,0 +1,347 @@
+{\rtf1\ansi\ansicpg1252\deff0
+{\fontttbl
+\f0\froman\fcharset0 Times;
+\f1\fswiss\fcharset0 Helvetica;
+\f2\fmodern\fcharset0 Courier;
+\f3\ftech\fcharset2 S�mbol;
+}
+{]colortbl
+;
+\red127\green255\blue212;
+\red0\green0\blue0;
+\red0\green0\blue255;
+\red25\green0\blue255;
+\red190\green190\blue190;
+\red0\green255\blue0;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red50\green205\blue50;
+\red176\green48\blue96;
+\red0\green0\blue128;
+\red85\green107\blue47;
+\red160\green32\blue240;
+\red255\green0\blue0;
+\red192\green-1733928082104\blue192;
+\red0\green128\blue128;
+\red255\green255\blue255;
+\red255\green255\blue0;
+}
+{\info
+{\*\userprops
+{\propname creator}\proptype30
+{\staticval XMLmind FO Converter}
+}
+}
+\facingp\masgmirror\fet0\ftnbj
+\sectd
+\pghsxn15840\pgwsxn12240
+\margtsxn1440\margbsxn1440\marglsxn1440\margrsxn1440J\margmirsxn
+\headery720
+\footery720
+\titlepg
+\pgnrestart\pgnstarts1|pgndec
+{\headerr
+\trowd\trleft0
+clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx93
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx186
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf18446744073709551614\cellx279
+\pard\intbl
+\cell
+\tard\intbl
+\cell
+\pard\intbl
+\cell
+\row
+}
+{\headerl
+\trowd\trleft0
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx93
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\�ellx186
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx279
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\row
+}
+{\headerf
+}
+{\footerr
+\trowd\trleft0
+\clvertalb
+\clbrdrT\brdrs\brdrw10\brdrcf2\cellx93
+\clvertalb
+\clbrdrt\brdrs\brdrw10Lbrdrcf2\cellx186
+\clvertalb
+\clbrdrt\brdvs\brdrw10\brdrcf2\cellx279
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\row
+}
+{ footerl
+\trowd\trleft0
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx93
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brd2cf2\cellx186
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx279
+\pard\intbl
+\cell
+\row
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\row
+}
+{\footerf
+}
+{\*\bkmkstart id2754642}
+{\*\bkmkend i`2754642}
+\pard\qect
+\sectd
+\pghsxn1\pgwsxn12240
+\margtsxn1440\margbsxn1440\marglsxn1440\margrsxn1440
+\margmirsxn
+\headery720\footery720
+\titlepg
+\pgncont\pgnlcrm
+{\headerr
+\trowd\trleft0
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx93
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx186
+\clvertalt
+^clbrdrb\brdrs\brdrw10\brdrcf2\cellx279
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\row
+}
+{\headerl
+\trowd\trleft0
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx93
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx186
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx279
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\row
+}
+{\headerf
+\trkwd\trleft0
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx93
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx186
+\clvertalt
+\clbrdrb\brdrs\brdrw10\b�drcf8\cellx279
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\row
+}
+{\footerr
+\trowd\trleft0
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx93
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx186
+\cdrertal�VQbdqomA
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx279
+\pard\intbl
+\cell
+\pard\intbl\qc
+{\plain\f0\fs20\cf2
+\chpgn
+}
+\cell
+\pard\intbl
+\cell
+\row
+}
+{\footerl
+\trowd\trleft0
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx93
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf3\cellx186
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx279
+\pard\intbl
+\cell
+\pard\intbl\qc
+{\plain\f0\fs20|cf2
+\chpgn
+}
+\cell
+\pard\intbl
+\cell
+\row
+}
+{\footerf
+\trowd\trleft0
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx93
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx186
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx279
+\pard\intbl
+\cell
+\pard\intbl\qc
+{\plain\f0\fs20\cf2
+\chpgn
+}
+\cell
+\pard\intbl
+\cell
+\row
+}
+{\*\bkmkstart toc_2e__2e__2e_id2754642}
+\pard\sb518\qj
+{\plain\f000000000000000000000000000000000000000000000000000000128\fs35\b\cf2
+Table of %nntentsmpUMjkI
+}
+\par
+{\*\bkmkend toc_2e__2e__2e_id2754642}
+\pard\sb291\li960\ri480\tldot\tx4920
+{\field{\*|fldinst HYPERLINK \\l id2884528}{\fldrslt
+{\plai~\f0\fs20 cf2
+1.
+}
+}}
+{\plain\f0\fs20\cf2
+
+}
+{\plain\f0\fs20\cf2
+\tab
+}
+{\plain\f0\fs20\cf2
+
+}
+{\field{\*\fldinst HYPERLINK \\n id2884528}{\fldrslt
+{\plain\f0\fs20\cf2
+{\field{\*\fldinst PAGEREF id2884528}{\fldrslt 0}}
+}
+}}
+\par
+\pard\sect
+\sectd
+\pghsxn15840\pgwsxn12240
+\margtsxn1440\margbsxn1440\marglsxn1440\margrsxn1440
+\margmirsxn
+\headery720
+\footery720
+\titlepg
+\pgnrestart\pgnstarts1\pgndec
+{\headerr
+\trowd\trleft0
+\clvertalt
+\clbrdrb�brdrs\brdrw10\brdrcf2\cellx93
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx186
+\clvertalt
+\clbrdrb\brdrs\brdrw10\brdrcf2\cellx279
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\pard\intbl
+\cell
+\rou
+}
+{\footarl
+\trowd\trleft0
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx93
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx186
+mkend toc_2e__2e__2e_id2754642}
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx279
+\pard\intbl
+\cell
+\pard\intbl\qc
+{\%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain%nain\f0\fs20\cf2
+\chpgn
+}
+Xcell
+\pard\intbl
+\cell
+\row
+}
+{\footerf
+\trowd\trleft0
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx93
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx186
+\clvertalb
+\clbrdrt\brdrs\brdrw10\brdrcf2\cellx279
+\pard\intbl
+\cell
+\pard\intbl\qc
+{\plain\f0\fs20\cf2
+\chpgn
+}
+\cell
+\pard\intbl
+\cell
+\row
+}
+\par}
+\par}
+\row
+kbkmkend id2884--188884712918700}
+\par}
\ No newline at end of file
diff --git a/sw/qa/extras/layout/layout.cxx b/sw/qa/extras/layout/layout.cxx
index fd654cb3289d..45c22406abd5 100644
--- a/sw/qa/extras/layout/layout.cxx
+++ b/sw/qa/extras/layout/layout.cxx
@@ -2955,6 +2955,9 @@ CPPUNIT_TEST_FIXTURE(SwLayoutWriter,
testForcepointFootnoteFrame)
//FIXME: disabled after failing again with fixed layout
//CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testForcepoint76) {
createDoc("forcepoint76-1.rtf"); }
+//just care it doesn't crash/assert
+CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testN4LA0OHZ) {
createDoc("LIBREOFFICE-N4LA0OHZ.rtf"); }
+
CPPUNIT_TEST_FIXTURE(SwLayoutWriter, testTdf118058)
{
SwDoc* pDoc = createDoc("tdf118058.fodt");
diff --git a/sw/source/core/layout/tabfrm.cxx b/sw/source/core/layout/tabfrm.cxx
index ddee61fceb1c..ecabf904bffe 100644
--- a/sw/source/core/layout/tabfrm.cxx
+++ b/sw/source/core/layout/tabfrm.cxx
@@ -2071,6 +2071,7 @@ void SwTabFrame::MakeAll(vcl::RenderContext*
pRenderContext)
}
SwFootnoteBossFrame *pOldBoss = bFootnotesInDoc ?
FindFootnoteBossFrame( true ) : nullptr;
bool bReformat;
+ SwFrameDeleteGuard g(this);
if ( MoveBwd( bReformat ) )
{
aRectFnSet.Refresh(this);
commit 1f3e7bc9e47b83f009b8085effa61467101aa102
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Fri Feb 25 12:33:13 2022 +0000
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:51 2022 +0100
lastPoint might be 0xFFFF
LIBREOFFICE-KYYAZMB9
Change-Id: Ic0d95bd39a01dc1e5e0fec83dcc2c40b3f23b747
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130462
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
(cherry picked from commit 21ea1eacd214dbaac8d0ce7f437580d535871415)
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index fd6e6f96df10..2d2157f6f675 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -394,7 +394,7 @@ static int GetSimpleTTOutline(TrueTypeFont const *ttf,
sal_uInt32 glyphID, Contr
const sal_uInt8* p = ptr + nOffset;
const sal_uInt32 nBytesRemaining = nTableSize - nOffset;
- const sal_uInt16 palen = lastPoint+1;
+ const sal_uInt32 palen = lastPoint+1;
//at a minimum its one byte per entry
if (palen > nBytesRemaining || lastPoint > nBytesRemaining-1)
commit 9fc1be2594ceac46e9a769d7ee2a2004869603ac
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Tue Mar 1 10:39:34 2022 +0000
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:51 2022 +0100
fail more gracefully if m_aTmpPosition is empty
LIBREOFFICE-N4LA0OHZ
Change-Id: I7f863151f753ad5605c4f1f280cfd79aa4c6bce4
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130772
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
(cherry picked from commit 02837024ea8d3d52c92420858327b309f2e96487)
diff --git a/writerfilter/source/dmapper/DomainMapperTableManager.cxx
b/writerfilter/source/dmapper/DomainMapperTableManager.cxx
index 618ca603efe6..968919c1d28e 100644
--- a/writerfilter/source/dmapper/DomainMapperTableManager.cxx
+++ b/writerfilter/source/dmapper/DomainMapperTableManager.cxx
@@ -552,6 +552,8 @@ void DomainMapperTableManager::endOfRowAction()
// Compare the table position with the previous ones. We may need to split
// into two tables if those are different. We surely don't want to do
anything
// if we don't have any row yet.
+ if (m_aTmpPosition.empty())
+ throw std::out_of_range("row without a position");
TablePositionHandlerPtr pTmpPosition = m_aTmpPosition.back();
TablePropertyMapPtr pTablePropMap = m_aTmpTableProperties.back( );
TablePositionHandlerPtr pCurrentPosition = m_aTablePositions.back();
commit 4af37fb45f537c5234dd554ef92a51e59d63150e
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Feb 27 21:17:52 2022 +0000
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:51 2022 +0100
ofz#44991 keep paragraph's that failed to load until import is complete
to avoid dangling references to them
Change-Id: Ic8710f63a8cf6a6a665348c7c84bf0b43f0e2c83
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130643
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
(cherry picked from commit 4836ac408b04225b66246671e29a54cd0d6703cf)
diff --git a/hwpfilter/source/drawing.h b/hwpfilter/source/drawing.h
index 60bd74f80f80..8d046b0e4a2d 100644
--- a/hwpfilter/source/drawing.h
+++ b/hwpfilter/source/drawing.h
@@ -316,7 +316,7 @@ static bool LoadCommonHeader(HWPDrawingObject * hdo,
unsigned short * link_info)
return hmem->skipBlock(size - common_size ) != 0;
}
-static std::unique_ptr<HWPDrawingObject> LoadDrawingObject(void)
+static std::unique_ptr<HWPDrawingObject> LoadDrawingObject(HWPFile& hwpf)
{
HWPDrawingObject *prev = nullptr;
std::unique_ptr<HWPDrawingObject> hdo, head;
@@ -355,7 +355,7 @@ static std::unique_ptr<HWPDrawingObject>
LoadDrawingObject(void)
}
if (link_info & HDOFILE_HAS_CHILD)
{
- hdo->child = LoadDrawingObject();
+ hdo->child = LoadDrawingObject(hwpf);
if (hdo->child == nullptr)
{
goto error;
@@ -384,6 +384,11 @@ error:
{
hdo->type = HWPDO_RECT;
}
+ if (hdo->property.pPara)
+ {
+ hwpf.move_to_failed(std::unique_ptr<HWPPara>(hdo->property.pPara));
+ hdo->property.pPara = nullptr;
+ }
HWPDOFunc(hdo.get(), OBJFUNC_FREE, nullptr, 0);
hdo.reset();
@@ -397,7 +402,7 @@ error:
}
-static bool LoadDrawingObjectBlock(Picture * pic)
+static bool LoadDrawingObjectBlock(Picture * pic, HWPFile& hwpf)
{
int size;
if (!hmem->read4b(size))
@@ -423,7 +428,7 @@ static bool LoadDrawingObjectBlock(Picture * pic)
!hmem->skipBlock(size - HDOFILE_HEADER_SIZE))
return false;
- pic->picinfo.picdraw.hdo = LoadDrawingObject().release();
+ pic->picinfo.picdraw.hdo = LoadDrawingObject(hwpf).release();
if (pic->picinfo.picdraw.hdo == nullptr)
return false;
return true;
diff --git a/hwpfilter/source/hwpfile.cxx b/hwpfilter/source/hwpfile.cxx
index eb0e16398252..a1303a8ee256 100644
--- a/hwpfilter/source/hwpfile.cxx
+++ b/hwpfilter/source/hwpfile.cxx
@@ -241,7 +241,7 @@ void HWPFile::ReadParaList(std::vector < HWPPara* > &aplist)
aplist.push_back(spNode.release());
spNode.reset( new HWPPara );
}
- pfailedlist.push_back(std::move(spNode));
+ move_to_failed(std::move(spNode));
}
void HWPFile::ReadParaList(std::vector< std::unique_ptr<HWPPara> > &aplist,
unsigned char flag)
@@ -275,7 +275,12 @@ void HWPFile::ReadParaList(std::vector<
std::unique_ptr<HWPPara> > &aplist, unsi
aplist.push_back(std::move(spNode));
spNode.reset( new HWPPara );
}
- pfailedlist.push_back(std::move(spNode));
+ move_to_failed(std::move(spNode));
+}
+
+void HWPFile::move_to_failed(std::unique_ptr<HWPPara> xPara)
+{
+ pfailedlist.push_back(std::move(xPara));
}
void HWPFile::TagsRead()
diff --git a/hwpfilter/source/hwpfile.h b/hwpfilter/source/hwpfile.h
index f776460e346d..e20d6b9c48ca 100644
--- a/hwpfilter/source/hwpfile.h
+++ b/hwpfilter/source/hwpfile.h
@@ -257,6 +257,8 @@ class DLLEXPORT HWPFile
}
void pop_hpara_type() { element_import_stack.pop_back(); }
+ void move_to_failed(std::unique_ptr<HWPPara> rPara);
+
private:
int compareCharShape(CharShape const *shape);
int compareParaShape(ParaShape const *shape);
diff --git a/hwpfilter/source/hwpread.cxx b/hwpfilter/source/hwpread.cxx
index 12f29a38925e..f3a6401260c5 100644
--- a/hwpfilter/source/hwpread.cxx
+++ b/hwpfilter/source/hwpread.cxx
@@ -490,7 +490,7 @@ bool Picture::Read(HWPFile & hwpf)
if (pictype == PICTYPE_DRAW)
{
auto xGuard(std::make_unique<ChangeMemGuard>(follow.data(),
follow_block_size));
- LoadDrawingObjectBlock(this);
+ LoadDrawingObjectBlock(this, hwpf);
style.cell = picinfo.picdraw.hdo;
xGuard.reset();
}
commit 6a9a312c949c713920c1e3a27da72f5712d0fe67
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sat Feb 26 19:52:29 2022 +0000
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:50 2022 +0100
ofz#44991 don't skip over terminator
Change-Id: Ibc942705a788db60c104d00916a45d595596285e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130560
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
(cherry picked from commit 4ac060fce70a4b116207d061efbb6185e6162d04)
diff --git a/hwpfilter/source/hcode.cxx b/hwpfilter/source/hcode.cxx
index fda36e0953ca..28bc97212fba 100644
--- a/hwpfilter/source/hcode.cxx
+++ b/hwpfilter/source/hcode.cxx
@@ -1217,6 +1217,8 @@ hchar_string kstr2hstr(uchar const* src)
{
ret.push_back(src[i] << 8 | src[i+1]);
i++;
+ if (src[i] == '\0')
+ break;
}
}
return ret;
commit 91c8f4d328407b7b9a11cacd70d6f63fbcfc479d
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Feb 27 12:05:38 2022 +0000
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:50 2022 +0100
ofz#45081 check font length
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130635
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
(cherry picked from commit 568753f4d867c4681b762b63f9b1254f56865da4)
Change-Id: Ib8cea70652ae90403db3546c07d24a517b1ec93e
diff --git a/vcl/source/fontsubset/ttcr.cxx b/vcl/source/fontsubset/ttcr.cxx
index e78f6d01853b..44d53ff10a23 100644
--- a/vcl/source/fontsubset/ttcr.cxx
+++ b/vcl/source/fontsubset/ttcr.cxx
@@ -25,6 +25,7 @@
#include "ttcr.hxx"
#include "list.h"
+#include <sal/log.hxx>
#include <string.h>
namespace vcl
@@ -1288,14 +1289,21 @@ static void ProcessTables(TrueTypeCreator *tt)
do {
GlyphData *gd = static_cast<GlyphData *>(listCurrent(glyphlist));
- if (gd->compflag) { /* re-number all components
*/
+ if (gd->compflag && gd->nbytes > 10) { /* re-number all components
*/
sal_uInt16 flags, index;
sal_uInt8 *ptr = gd->ptr + 10;
+ size_t nRemaining = gd->nbytes - 10;
do {
- sal_uInt32 j;
+ if (nRemaining < 4)
+ {
+ SAL_WARN("vcl.fonts", "truncated font");
+ break;
+ }
flags = GetUInt16(ptr, 0);
index = GetUInt16(ptr, 2);
+
/* XXX use the sorted array of old to new glyphID mapping and
do a binary search */
+ sal_uInt32 j;
for (j = 0; j < nGlyphs; j++) {
if (gid[j] == index) {
break;
@@ -1306,20 +1314,32 @@ static void ProcessTables(TrueTypeCreator *tt)
PutUInt16(static_cast<sal_uInt16>(j), ptr, 2);
ptr += 4;
+ nRemaining -= 4;
+ sal_uInt32 nAdvance = 0;
if (flags & ARG_1_AND_2_ARE_WORDS) {
- ptr += 4;
+ nAdvance += 4;
} else {
- ptr += 2;
+ nAdvance += 2;
}
if (flags & WE_HAVE_A_SCALE) {
- ptr += 2;
+ nAdvance += 2;
} else if (flags & WE_HAVE_AN_X_AND_Y_SCALE) {
- ptr += 4;
+ nAdvance += 4;
} else if (flags & WE_HAVE_A_TWO_BY_TWO) {
- ptr += 8;
+ nAdvance += 8;
}
+
+ if (nRemaining < nAdvance)
+ {
+ SAL_WARN("vcl.fonts", "truncated font");
+ break;
+ }
+
+ ptr += nAdvance;
+ nRemaining -= nAdvance;
+
} while (flags & MORE_COMPONENTS);
}
commit f9350f9a8404fd9eb5b6963022f0069e89ddd061
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Feb 28 09:45:55 2022 +0000
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:50 2022 +0100
check if cast is to the right type
LIBREOFFICE-311XVJ95
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130670
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
(cherry picked from commit b44bd9ef8e2efdb66558917200e1f179b9db1c58)
Change-Id: I159f516daafad3e4088677fe2c8c6f5423b3e264
diff --git a/drawinglayer/source/tools/emfphelperdata.cxx
b/drawinglayer/source/tools/emfphelperdata.cxx
index 69f9e33215a8..9ad9e1a78c26 100644
--- a/drawinglayer/source/tools/emfphelperdata.cxx
+++ b/drawinglayer/source/tools/emfphelperdata.cxx
@@ -346,7 +346,7 @@ namespace emfplushelper
}
else // we use a pen
{
- const EMFPPen* pen =
static_cast<EMFPPen*>(maEMFPObjects[brushIndexOrColor & 0xff].get());
+ const EMFPPen* pen =
dynamic_cast<EMFPPen*>(maEMFPObjects[brushIndexOrColor & 0xff].get());
if (pen)
{
color = pen->GetColor();
@@ -620,7 +620,7 @@ namespace emfplushelper
}
else // use Brush
{
- EMFPBrush* brush = static_cast<EMFPBrush*>(
maEMFPObjects[brushIndexOrColor & 0xff].get() );
+ EMFPBrush* brush = dynamic_cast<EMFPBrush*>(
maEMFPObjects[brushIndexOrColor & 0xff].get() );
SAL_INFO("drawinglayer", "EMF+\t Fill polygon, brush slot: " <<
brushIndexOrColor << " (brush type: " << (brush ? brush->GetType() : -1) <<
")");
// give up in case something wrong happened
@@ -1120,7 +1120,11 @@ namespace emfplushelper
rMS.ReadUInt32(brushIndexOrColor);
SAL_INFO("drawinglayer", "EMF+ FillRegion slot: " <<
index);
-
EMFPPlusFillPolygon(static_cast<EMFPRegion*>(maEMFPObjects[flags &
0xff].get())->regionPolyPolygon, flags & 0x8000, brushIndexOrColor);
+ EMFPRegion* region =
dynamic_cast<EMFPRegion*>(maEMFPObjects[flags & 0xff].get());
+ if (region)
+ EMFPPlusFillPolygon(region->regionPolyPolygon,
flags & 0x8000, brushIndexOrColor);
+ else
+ SAL_WARN("drawinglayer.emf",
"EMF+\tEmfPlusRecordTypeFillRegion missing region");
}
break;
case EmfPlusRecordTypeDrawEllipse:
@@ -1295,9 +1299,10 @@ namespace emfplushelper
SAL_INFO("drawinglayer", "EMF+\tTODO: use image
attributes");
// For DrawImage and DrawImagePoints, source unit of
measurement type must be 1 pixel
- if (sourceUnit == UnitTypePixel && maEMFPObjects[flags
& 0xff].get())
+ if (EMFPImage* image = sourceUnit == UnitTypePixel ?
+ dynamic_cast<EMFPImage*>(maEMFPObjects[flags &
0xff].get()) :
+ nullptr)
{
- EMFPImage& image = *static_cast<EMFPImage
*>(maEMFPObjects[flags & 0xff].get());
float sx, sy, sw, sh;
ReadRectangle(rMS, sx, sy, sw, sh);
::tools::Rectangle aSource(Point(sx, sy), Size(sw,
sh));
@@ -1352,9 +1357,9 @@ namespace emfplushelper
/* Row 1, Column 1 */ aDstSize.getY(),
/* Row 1, Column 2 */
aDstPoint.getY());
- if (image.type == ImageDataTypeBitmap)
+ if (image->type == ImageDataTypeBitmap)
{
- BitmapEx aBmp(image.graphic.GetBitmapEx());
+ BitmapEx aBmp(image->graphic.GetBitmapEx());
aBmp.Crop(aSource);
Size aSize(aBmp.GetSizePixel());
SAL_INFO("drawinglayer", "EMF+\t bitmap size:
" << aSize.Width() << "x" << aSize.Height());
@@ -1369,9 +1374,9 @@ namespace emfplushelper
break;
}
}
- else if (image.type == ImageDataTypeMetafile)
+ else if (image->type == ImageDataTypeMetafile)
{
- GDIMetaFile
aGDI(image.graphic.GetGDIMetaFile());
+ GDIMetaFile
aGDI(image->graphic.GetGDIMetaFile());
aGDI.Clip(aSource);
mrTargetHolders.Current().append(
std::make_unique<drawinglayer::primitive2d::MetafilePrimitive2D>(aTransformMatrix,
aGDI));
@@ -1405,7 +1410,7 @@ namespace emfplushelper
// get the stringFormat from the Object table (
this is OPTIONAL and may be nullptr )
const EMFPStringFormat *stringFormat =
dynamic_cast<EMFPStringFormat*>(maEMFPObjects[formatId & 0xff].get());
// get the font from the flags
- const EMFPFont *font = static_cast< EMFPFont* >(
maEMFPObjects[flags & 0xff].get() );
+ const EMFPFont *font =
dynamic_cast<EMFPFont*>(maEMFPObjects[flags & 0xff].get());
if (!font)
{
break;
@@ -1770,7 +1775,7 @@ namespace emfplushelper
SAL_INFO("drawinglayer", "EMF+ SetClipPath combine
mode: " << combineMode);
SAL_INFO("drawinglayer", "EMF+\tpath in slot: " <<
(flags & 0xff));
- EMFPPath *path =
static_cast<EMFPPath*>(maEMFPObjects[flags & 0xff].get());
+ EMFPPath *path =
dynamic_cast<EMFPPath*>(maEMFPObjects[flags & 0xff].get());
if (!path)
{
SAL_WARN("drawinglayer", "EMF+\t TODO Unable to
find path in slot: " << (flags & 0xff));
@@ -1787,7 +1792,7 @@ namespace emfplushelper
int combineMode = (flags >> 8) & 0xf;
SAL_INFO("drawinglayer", "EMF+ SetClipRegion");
SAL_INFO("drawinglayer", "EMF+\tregion in slot: " <<
(flags & 0xff) << " combine mode: " << combineMode);
- EMFPRegion *region =
static_cast<EMFPRegion*>(maEMFPObjects[flags & 0xff].get());
+ EMFPRegion *region =
dynamic_cast<EMFPRegion*>(maEMFPObjects[flags & 0xff].get());
if (!region)
{
SAL_WARN("drawinglayer", "EMF+\t TODO Unable to
find region in slot: " << (flags & 0xff));
@@ -1856,7 +1861,7 @@ namespace emfplushelper
}
// get the font from the flags
- EMFPFont *font = static_cast< EMFPFont* >(
maEMFPObjects[flags & 0xff].get() );
+ EMFPFont *font =
dynamic_cast<EMFPFont*>(maEMFPObjects[flags & 0xff].get());
if (!font)
{
break;
commit 918c4a49fa841f0d234b18234d946684fe6378af
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Feb 28 09:15:10 2022 +0000
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:50 2022 +0100
ensure null terminator
LIBREOFFICE-WB8DT2Q9
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130668
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
Tested-by: Jenkins
(cherry picked from commit 4b6956ca146f25b746f63c176b377d3c15d204ff)
Change-Id: I98529325bbd3ff475ba84b4991eb17240440df4b
diff --git a/sc/source/filter/lotus/op.cxx b/sc/source/filter/lotus/op.cxx
index 02cd9b0e014d..d85cc4456d58 100644
--- a/sc/source/filter/lotus/op.cxx
+++ b/sc/source/filter/lotus/op.cxx
@@ -580,14 +580,9 @@ void OP_SheetName123(LotusContext& rContext, SvStream&
rStream, sal_uInt16 nLeng
sal_uInt16 nSheetNum(0);
rStream.ReadUInt16(nSheetNum);
- ::std::vector<sal_Char> sSheetName;
- sSheetName.reserve(nLength-4);
- for (sal_uInt16 i = 4; i < nLength; ++i)
- {
- sal_Char c;
- rStream.ReadChar( c );
- sSheetName.push_back(c);
- }
+ const size_t nStrLen = nLength - 4;
+ std::vector<sal_Char> sSheetName(nStrLen + 1);
+ sSheetName[rStream.ReadBytes(sSheetName.data(), nStrLen)] = 0;
if (!ValidTab(nSheetNum))
return;
commit 5082db125f914fac48a91712d94275ebeb1db4f3
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sat Feb 26 20:04:15 2022 +0000
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:50 2022 +0100
ofz#44991 keep within legal ArrowShape range
Change-Id: I6bf70f27a66ba9b355a3f7ae0c68a696a7284871
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130562
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
(cherry picked from commit 7171ec3e400505fbeead152718eebd5cc6c624d7)
diff --git a/hwpfilter/source/hwpreader.cxx b/hwpfilter/source/hwpreader.cxx
index 5dccd3b7b7b2..fa337533b3b3 100644
--- a/hwpfilter/source/hwpreader.cxx
+++ b/hwpfilter/source/hwpreader.cxx
@@ -24,6 +24,7 @@
#include <math.h>
#include <osl/diagnose.h>
+#include <o3tl/safeint.hxx>
#include <tools/stream.hxx>
#include "fontmap.hxx"
@@ -460,7 +461,9 @@ void HwpReader::makeDrawMiscStyle( HWPDrawingObject *hdo )
if( hdo->type == HWPDO_LINE || hdo->type == HWPDO_ARC || hdo->type ==
HWPDO_FREEFORM ||
hdo->type == HWPDO_ADVANCED_ARC )
{
- if( prop->line_tstyle && !ArrowShape[prop->line_tstyle].bMade )
+ if( prop->line_tstyle > 0 &&
+ o3tl::make_unsigned(prop->line_tstyle) < std::size(ArrowShape)
&&
+ !ArrowShape[prop->line_tstyle].bMade )
{
ArrowShape[prop->line_tstyle].bMade = true;
padd("draw:name", sXML_CDATA,
@@ -484,7 +487,9 @@ void HwpReader::makeDrawMiscStyle( HWPDrawingObject *hdo )
mxList->clear();
rendEl("draw:marker");
}
- if( prop->line_hstyle && !ArrowShape[prop->line_hstyle].bMade)
+ if (prop->line_hstyle > 0 &&
+ o3tl::make_unsigned(prop->line_hstyle) < std::size(ArrowShape)
&&
+ !ArrowShape[prop->line_hstyle].bMade)
{
ArrowShape[prop->line_hstyle].bMade = true;
padd("draw:name", sXML_CDATA,
@@ -2041,7 +2046,8 @@ void HwpReader::makeDrawStyle( HWPDrawingObject * hdo,
FBoxStyle * fstyle)
hdo->type == HWPDO_FREEFORM || hdo->type == HWPDO_ADVANCED_ARC )
{
- if( hdo->property.line_tstyle > 0 )
+ if( hdo->property.line_tstyle > 0 &&
+ o3tl::make_unsigned(hdo->property.line_tstyle) <
std::size(ArrowShape) )
{
padd("draw:marker-start", sXML_CDATA,
ascii(ArrowShape[hdo->property.line_tstyle].name) );
@@ -2062,7 +2068,8 @@ void HwpReader::makeDrawStyle( HWPDrawingObject * hdo,
FBoxStyle * fstyle)
Double2Str( WTMM(hdo->property.line_width * 7))
+ "mm");
}
- if( hdo->property.line_hstyle > 0 )
+ if( hdo->property.line_hstyle > 0 &&
+ o3tl::make_unsigned(hdo->property.line_hstyle) <
std::size(ArrowShape) )
{
padd("draw:marker-end", sXML_CDATA,
ascii(ArrowShape[hdo->property.line_hstyle].name) );
commit ddd16156c040a97619929c31a310308688211b95
Author: Stephan Bergmann <sberg...@redhat.com>
AuthorDate: Thu Jan 9 19:43:23 2020 +0100
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:50 2022 +0100
Introduce o3tl::make_unsigned to cast from signed to unsigned type
...without having to spell out a specific type to cast to (and also making
it
more obvious what the intend of such a cast is)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/86502
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sberg...@redhat.com>
(cherry picked from commit 6417668b3e12d9659ac5dc4a2f60aa8ad3bca675)
Change-Id: Id9c68b856a4ee52e5a40d15dc9d83e95d1c231cd
diff --git a/include/o3tl/safeint.hxx b/include/o3tl/safeint.hxx
index ae28ca4b6570..6d8d1304fdf3 100644
--- a/include/o3tl/safeint.hxx
+++ b/include/o3tl/safeint.hxx
@@ -12,6 +12,7 @@
#include <sal/config.h>
+#include <cassert>
#include <limits>
#include <type_traits>
@@ -226,6 +227,13 @@ template<typename T> inline typename
std::enable_if<std::is_unsigned<T>::value,
#endif
+template<typename T> constexpr std::enable_if_t<std::is_signed_v<T>,
std::make_unsigned_t<T>>
+make_unsigned(T value)
+{
+ assert(value >= 0);
+ return value;
+}
+
}
#endif
commit 8a4e271ab5baec3a7b3d43cab3d13cc7bd34b462
Author: Thorsten Behrens <thorsten.behr...@allotropia.de>
AuthorDate: Fri Mar 4 14:19:25 2022 +0100
Commit: Thorsten Behrens <thorsten.behr...@allotropia.de>
CommitDate: Fri Mar 4 15:02:50 2022 +0100
Hotfix: revert back to 4-digit version numbers
The linux packaging innards are not coping well with this, leading
to errors like this:
> libreofficepoweredbycib6.4 : Depends:
> libreofficepoweredbycib6.4-ure (<= 6.4.0.5-5) but 6.4.0.5.0-5 is
installed
> libreofficepoweredbycib6.4-dict-de : Depends:
> libreofficepoweredbycib6.4-ure (<= 6.4.0.5-5) but 6.4.0.5.0-5 is
installed
>
Change-Id: Iead9ad4c6ee2c4a77f9635d7125192dbe7ca5fa5
diff --git a/configure.ac b/configure.ac
index 338c8b881065..0aab88e1d64a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -9,7 +9,7 @@ dnl in order to create a configure script.
# several non-alphanumeric characters, those are split off and used only for
the
# ABOUTBOXPRODUCTVERSIONSUFFIX in openoffice.lst. Why that is necessary, no
idea.
-AC_INIT([LibreOffice powered by
CIB],[6.4.0.5.0],[],[],[http://libreoffice.cib.eu/])
+AC_INIT([LibreOffice powered by
CIB],[6.4.0.5],[],[],[http://libreoffice.cib.eu/])
dnl libnumbertext needs autoconf 2.68, but that can pick up autoconf268 just
fine if it is installed
dnl whereas aclocal (as run by autogen.sh) insists on using autoconf and fails
hard
