external/liborcus/UnpackedTarball_liborcus.mk         |    1 
 external/liborcus/overrun.patch.0                     |   63 ++++++++++++++++++
 officecfg/registry/data/org/openoffice/Office/UI.xcu  |    2 
 sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx |    7 +-
 sw/source/core/layout/trvlfrm.cxx                     |   24 +++++-
 vcl/inc/dndeventdispatcher.hxx                        |    2 
 6 files changed, 89 insertions(+), 10 deletions(-)

New commits:
commit cd76005592cf330dc450f48df31d11f8f9f3993c
Author:     Xisco Fauli <xiscofa...@libreoffice.org>
AuthorDate: Thu Jun 23 12:27:34 2022 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Mon Jun 27 13:27:02 2022 +0200

    sw: fix crash in SwLayoutFrame::GetContentPos
    
    FindPageFrame might return nullptr
    
    See 
https://crashreport.libreoffice.org/stats/signature/SwLayoutFrame::GetContentPos(Point%20&,bool,bool,SwCursorMoveState%20*,bool)
    
    Change-Id: Ic69d26de4ab234ebd6283ace640d689f0ebe8eb3
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136307
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit 7500c243fea02acbeaddf91f6b48a53d698c1cab)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136383
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/sw/source/core/layout/trvlfrm.cxx 
b/sw/source/core/layout/trvlfrm.cxx
index 6942dab6a2ba..375b9fe34fd6 100644
--- a/sw/source/core/layout/trvlfrm.cxx
+++ b/sw/source/core/layout/trvlfrm.cxx
@@ -1290,13 +1290,22 @@ const SwContentFrame *SwLayoutFrame::GetContentPos( 
Point& rPoint,
                     if( !pStart->GetPrev()->IsLayoutFrame() )
                         return nullptr;
                     pStart = static_cast<const 
SwLayoutFrame*>(pStart->GetPrev());
-                    pContent = pStart->IsInDocBody()
-                                ? pStart->ContainsContent()
-                                : 
pStart->FindPageFrame()->FindFirstBodyContent();
+                    if( pStart->IsInDocBody() )
+                        pContent = pStart->ContainsContent();
+                    else
+                    {
+                        const SwPageFrame *pPage = pStart->FindPageFrame();
+                        if( !pPage )
+                            return nullptr;
+                        pContent = pPage->FindFirstBodyContent();
+                    }
                 }
                 if ( !pContent )  // Somewhere down the road we have to start 
with one!
                 {
-                    pContent = 
pStart->FindPageFrame()->GetUpper()->ContainsContent();
+                    const SwPageFrame *pPage = pStart->FindPageFrame();
+                    if( !pPage )
+                        return nullptr;
+                    pContent = pPage->GetUpper()->ContainsContent();
                     while ( pContent && !pContent->IsInDocBody() )
                         pContent = pContent->GetNextContentFrame();
                     if ( !pContent )
@@ -1314,7 +1323,12 @@ const SwContentFrame *SwLayoutFrame::GetContentPos( 
Point& rPoint,
                     pContent = pStart->ContainsContent();
                 }
                 else // Somewhere down the road we have to start with one!
-                    pContent = 
pStart->FindPageFrame()->GetUpper()->ContainsContent();
+                {
+                    const SwPageFrame *pPage = pStart->FindPageFrame();
+                    if( !pPage )
+                        return nullptr;
+                    pContent = pPage->GetUpper()->ContainsContent();
+                }
             }
             pActual = pContent;
         }
commit 1cd9a88ddb12db6518424c392df9841f179a048e
Author:     Stephan Bergmann <sberg...@redhat.com>
AuthorDate: Fri Jun 24 18:21:32 2022 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Mon Jun 27 13:27:01 2022 +0200

    external/liborcus: Fix heap-buffer-overflow
    
    ...as seen during CppunitTest_vcl_pdfexport:
    
    > ==573913==ERROR: AddressSanitizer: heap-buffer-overflow on address 
0x62b0001dba0e at pc 0x560576627186 bp 0x7ffeab9fa730 sp 0x7ffeab9f9ef0
    > READ of size 26624 at 0x62b0001dba0e thread T0
    >  #0 in StrtolFixAndCheck(void*, char const*, char**, char*, int) at 
~/github.com/llvm/llvm-project/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:3629:3
    >  #1 in strtol at 
~/github.com/llvm/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:485:3
    >  #2 in 
orcus::sax_token_handler_wrapper_base::attribute(std::basic_string_view<char, 
std::char_traits<char>>, std::basic_string_view<char, std::char_traits<char>>) 
at workdir/UnpackedTarball/liborcus/src/parser/sax_token_parser.cpp:344:22
    >  #3 in 
orcus::sax_ns_parser<orcus::sax_token_parser<orcus::xml_stream_handler>::handler_wrapper>::handler_wrapper::attribute(orcus::sax::parser_attribute
 const&) at 
workdir/UnpackedTarball/liborcus/src/liborcus/../../include/orcus/sax_ns_parser.hpp:212:27
    >  #4 in 
orcus::sax_parser<orcus::sax_ns_parser<orcus::sax_token_parser<orcus::xml_stream_handler>::handler_wrapper>::handler_wrapper,
 orcus::sax_parser_default_config>::attribute() at 
workdir/UnpackedTarball/liborcus/src/liborcus/../../include/orcus/sax_parser.hpp:570:15
    >  #5 in 
orcus::sax_parser<orcus::sax_ns_parser<orcus::sax_token_parser<orcus::xml_stream_handler>::handler_wrapper>::handler_wrapper,
 orcus::sax_parser_default_config>::declaration(char const*) at 
workdir/UnpackedTarball/liborcus/src/liborcus/../../include/orcus/sax_parser.hpp:389:9
    >  #6 in 
orcus::sax_parser<orcus::sax_ns_parser<orcus::sax_token_parser<orcus::xml_stream_handler>::handler_wrapper>::handler_wrapper,
 orcus::sax_parser_default_config>::element() at 
workdir/UnpackedTarball/liborcus/src/liborcus/../../include/orcus/sax_parser.hpp:242:13
    >  #7 in 
orcus::sax_parser<orcus::sax_ns_parser<orcus::sax_token_parser<orcus::xml_stream_handler>::handler_wrapper>::handler_wrapper,
 orcus::sax_parser_default_config>::body() at 
workdir/UnpackedTarball/liborcus/src/liborcus/../../include/orcus/sax_parser.hpp:214:13
    >  #8 in 
orcus::sax_parser<orcus::sax_ns_parser<orcus::sax_token_parser<orcus::xml_stream_handler>::handler_wrapper>::handler_wrapper,
 orcus::sax_parser_default_config>::parse() at 
workdir/UnpackedTarball/liborcus/src/liborcus/../../include/orcus/sax_parser.hpp:182:5
    >  #9 in 
orcus::sax_ns_parser<orcus::sax_token_parser<orcus::xml_stream_handler>::handler_wrapper>::parse()
 at 
workdir/UnpackedTarball/liborcus/src/liborcus/../../include/orcus/sax_ns_parser.hpp:277:14
    >  #10 in orcus::sax_token_parser<orcus::xml_stream_handler>::parse() at 
workdir/UnpackedTarball/liborcus/src/liborcus/../../include/orcus/sax_token_parser.hpp:215:14
    >  #11 in orcus::xml_stream_parser::parse() at 
workdir/UnpackedTarball/liborcus/src/liborcus/xml_stream_parser.cpp:68:9
    >  #12 in orcus::orcus_xls_xml::detect(unsigned char const*, unsigned long) 
at workdir/UnpackedTarball/liborcus/src/liborcus/orcus_xls_xml.cpp:94:16
    >  #13 in orcus::detect(unsigned char const*, unsigned long) at 
workdir/UnpackedTarball/liborcus/src/liborcus/format_detection.cpp:68:9
    >  #14 in (anonymous 
namespace)::OrcusFormatDetect::detect(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>&)
 at sc/source/filter/orcus/filterdetect.cxx:83:31
    > 0x62b0001dba0e is located 0 bytes to the right of 26638-byte region 
[0x62b0001d5200,0x62b0001dba0e)
    > allocated by thread T0 here:
    >  #0 in operator new[](unsigned long) at 
~/github.com/llvm/llvm-project/compiler-rt/lib/asan/asan_new_delete.cpp:98:3
    >  #1 in SvMemoryStream::AllocateMemory(unsigned long) at 
tools/source/stream/stream.cxx:1698:12
    >  #2 in SvMemoryStream::SvMemoryStream(unsigned long, unsigned long) at 
tools/source/stream/stream.cxx:1544:9
    >  #3 in (anonymous 
namespace)::OrcusFormatDetect::detect(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>&)
 at sc/source/filter/orcus/filterdetect.cxx:71:20
    
    This started to occur now after a95c585433246813096e8890b7ed6ef4fe30c621 
"Pump
    XInputStream into an SvMemoryStream rather than an OStringBuffer" no longer
    guarantees that the memory range passed into
    
      orcus::detect(const unsigned char* buffer, size_t length)
    
    is followed by a null byte at buffer[length].  (There appears to be no
    documentation for that function, but it looks unreasonable to me that it 
should
    require callers to provide a buffer thus terminated, and I rather assume 
that
    what is observed here is an orcus bug.)
    
    The problematic calls of std::strtol were used in code apparently meant to 
parse
    strings matching the XML VersionNum grammar production, and then store the 
two
    dot-separated numbers each as uint8_t.  The new code using a local readUint8
    accepts a different set of strings now than the original code using 
std::strtol,
    but the new set is arguably closer to what the actual XML VersionNum grammar
    production accepts (which is '1.' [0-9]+ for XML 1.0 and '1.1' for XML 
1.1), so
    this change should be OK.
    
    Change-Id: I1668542c96ced64667cb9f251e79126e1a54ac30
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136405
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sberg...@redhat.com>
    (cherry picked from commit 3f17a643d0f943d02c7cb2b5d8e702fe0e63e38d)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136417
    Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>

diff --git a/external/liborcus/UnpackedTarball_liborcus.mk 
b/external/liborcus/UnpackedTarball_liborcus.mk
index 2ad70119179b..12698bab7234 100644
--- a/external/liborcus/UnpackedTarball_liborcus.mk
+++ b/external/liborcus/UnpackedTarball_liborcus.mk
@@ -39,6 +39,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,liborcus,\
        external/liborcus/forcepoint-88.patch.1 \
        external/liborcus/forcepoint-95.patch.1 \
        external/liborcus/include.patch.0 \
+       external/liborcus/overrun.patch.0 \
 ))
 
 ifeq ($(OS),WNT)
diff --git a/external/liborcus/overrun.patch.0 
b/external/liborcus/overrun.patch.0
new file mode 100644
index 000000000000..de2097e32328
--- /dev/null
+++ b/external/liborcus/overrun.patch.0
@@ -0,0 +1,63 @@
+--- src/parser/sax_token_parser.cpp
++++ src/parser/sax_token_parser.cpp
+@@ -10,6 +10,7 @@
+ 
+ #include <mdds/sorted_string_map.hpp>
+ #include <cctype>
++#include <limits>
+ 
+ namespace orcus {
+ 
+@@ -329,6 +330,28 @@
+     m_elem.raw_name = elem.name;
+ }
+ 
++static uint8_t readUint8(char const * begin, char const * end, char const ** 
endptr) {
++    unsigned n = 0;
++    char const * p = begin;
++    for (; p != end; ++p) {
++        char const c = *p;
++        if (c < '0' || c > '9') {
++            break;
++        }
++        n = 10 * n + (c - '0');
++        if (n > std::numeric_limits<uint8_t>::max()) {
++            *endptr = nullptr;
++            return 0;
++        }
++    }
++    if (p == begin) {
++        *endptr = nullptr;
++        return 0;
++    }
++    *endptr = p;
++    return n;
++}
++
+ void sax_token_handler_wrapper_base::attribute(std::string_view name, 
std::string_view val)
+ {
+     decl_attr_type dat = decl_attr::get().find(name.data(), name.size());
+@@ -340,18 +362,18 @@
+             const char* p = val.data();
+             const char* p_end = p + val.size();
+ 
+-            char* endptr = nullptr;
+-            long v = std::strtol(p, &endptr, 10);
++            const char* endptr = nullptr;
++            uint8_t v = readUint8(p, p_end, &endptr);
+ 
+-            if (!endptr || endptr >= p_end || *endptr != '.')
++            if (!endptr || endptr == p_end || *endptr != '.')
+                 break;
+ 
+             m_declaration.version_major = v;
+             p = endptr + 1;
+ 
+-            v = std::strtol(p, &endptr, 10);
++            v = readUint8(p, p_end, &endptr);
+ 
+-            if (!endptr || endptr > p_end)
++            if (!endptr)
+                 break;
+ 
+             m_declaration.version_minor = v;
commit 25b970f1083b3f46fde2db02857ec0a8bab52613
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Fri Jun 24 15:44:40 2022 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Mon Jun 27 13:27:01 2022 +0200

    tdf#149626 use recursive_mutex to fix hang in macro callback during dnd
    
    See frame #5 and frame #45 where
    
    both the same DNDEventDispatcher object and both functions lock m_aMutex 
which is a std::mutex since
    
    commit 8de81db4e3fca488d50db2d74734109b31541a6f
    Date:   Mon Aug 2 09:21:17 2021 +0200
    
        osl::Mutex->std::mutex in DNDEventDispatcher
    
     #0  0x00007ff094530c40 in __lll_lock_wait () at /lib64/libc.so.6
     #1  0x00007ff0945371d2 in pthread_mutex_lock@@GLIBC_2.2.5 () at 
/lib64/libc.so.6
     #2  0x00007ff08b901663 in __gthread_mutex_lock(pthread_mutex_t*) 
(__mutex=0x1a32c60)
         at 
/usr/bin/../lib/gcc/x86_64-redhat-linux/12/../../../../include/c++/12/x86_64-redhat-linux/bits/gthr-default.h:749
     #3  0x00007ff08b9024d5 in std::mutex::lock() (this=0x1a32c60) at 
/usr/bin/../lib/gcc/x86_64-redhat-linux/12/../../../../include/c++/12/bits/std_mutex.h:100
     #4  0x00007ff08b9018f3 in 
std::scoped_lock<std::mutex>::scoped_lock(std::mutex&) (this=0x7ffdd0d79240, 
__m=...)
         at 
/usr/bin/../lib/gcc/x86_64-redhat-linux/12/../../../../include/c++/12/mutex:731
     #5  0x00007ff08b9006a8 in 
DNDEventDispatcher::dragOver(com::sun::star::datatransfer::dnd::DropTargetDragEvent
 const&) (this=0x1a32c10, dtde=...)
         at vcl/source/window/dndeventdispatcher.cxx:156
     #6  0x00007ff075f47658 in 
GtkInstDropTarget::fire_dragOver(com::sun::star::datatransfer::dnd::DropTargetDragEvent
 const&) (this=0x199eb40, dtde=...)
         at vcl/unx/gtk3/gtkinst.cxx:1710
     #7  0x00007ff0760a7010 in GtkInstDropTarget::signalDragMotion(_GtkWidget*, 
_GdkDragContext*, int, int, unsigned int)
         (this=0x199eb40, pWidget=0x1c67e40, context=0x1957450, x=89, y=175, 
time=0) at vcl/unx/gtk3/gtkframe.cxx:5026
     #8  0x00007ff07609bb77 in GtkSalFrame::signalDragMotion(_GtkWidget*, 
_GdkDragContext*, int, int, unsigned int, void*)
         (pWidget=0x1c67e40, context=0x1957450, x=89, y=175, time=0, 
frame=0x19b7d70) at vcl/unx/gtk3/gtkframe.cxx:4922
     #9  0x00007ff075649527 in _gtk_marshal_BOOLEAN__OBJECT_INT_INT_UINTv () at 
/lib64/libgtk-3.so.0
     #10 0x00007ff0865dcd5b in g_signal_emit_valist () at 
/lib64/libgobject-2.0.so.0
     #11 0x00007ff0865ddeb8 in g_signal_emit_by_name () at 
/lib64/libgobject-2.0.so.0
     #12 0x00007ff07595b491 in gtk_drag_dest_motion.lto_priv () at 
/lib64/libgtk-3.so.0
     #13 0x00007ff0757b8f7d in gtk_main_do_event () at /lib64/libgtk-3.so.0
     #14 0x00007ff0754e5463 in _gdk_event_emit () at /lib64/libgdk-3.so.0
     #15 0x00007ff075518056 in gdk_event_source_dispatch () at 
/lib64/libgdk-3.so.0
     #16 0x00007ff0864c3faf in g_main_context_dispatch () at 
/lib64/libglib-2.0.so.0
     #17 0x00007ff0865192c8 in g_main_context_iterate.constprop () at 
/lib64/libglib-2.0.so.0
     #18 0x00007ff0864c1940 in g_main_context_iteration () at 
/lib64/libglib-2.0.so.0
     #19 0x00007ff075f3e60f in GtkSalData::Yield(bool, bool) (this=0x952930, 
bWait=false, bHandleAllCurrentEvents=false) at vcl/unx/gtk3/gtkdata.cxx:405
     #20 0x00007ff075f43e43 in GtkInstance::DoYield(bool, bool) (this=0x9527e0, 
bWait=false, bHandleAllCurrentEvents=false) at vcl/unx/gtk3/gtkinst.cxx:428
     #21 0x00007ff08c2dc5df in ImplYield(bool, bool) (i_bWait=false, 
i_bAllEvents=false) at vcl/source/app/svapp.cxx:474
     #22 0x00007ff08c2dc24d in Application::Reschedule(bool) 
(i_bAllEvents=false) at vcl/source/app/svapp.cxx:493
     #23 0x00007ff091eeeb55 in SbiRuntime::Step() (this=0xa21eb20) at 
basic/source/runtime/runtime.cxx:801
     #24 0x00007ff091e0e659 in (anonymous namespace)::RunInitGuard::run() 
(this=0x76a6290) at basic/source/classes/sbxmod.cxx:1015
     #25 0x00007ff091e0d135 in SbModule::Run(SbMethod*) (this=0xa0ada00, 
pMeth=0xa16d7e0) at basic/source/classes/sbxmod.cxx:1176
     #26 0x00007ff091e0c503 in SbModule::Notify(SfxBroadcaster&, SfxHint 
const&) (this=0xa0ada00, rBC=..., rHint=...) at 
basic/source/classes/sbxmod.cxx:775
     #27 0x00007ff090b3ee6e in SfxBroadcaster::Broadcast(SfxHint const&) 
(this=0xa231de0, rHint=...) at svl/source/notify/SfxBroadcaster.cxx:39
     #28 0x00007ff091e1372e in SbMethod::Broadcast(SfxHintId) (this=0xa231ca0, 
nHintId=SfxHintId::BasicDataWanted) at basic/source/classes/sbxmod.cxx:2113
     #29 0x00007ff091f6ddfa in SbxObject::Call(rtl::OUString const&, SbxArray*) 
(this=0xa258670, rName="DTL_dragOver", pParam=0xa1e47d0)
         at basic/source/sbx/sbxobj.cxx:274
     #30 0x00007ff091d9dd76 in StarBASIC::Call(rtl::OUString const&, SbxArray*) 
(this=0xa258670, rName="DTL_dragOver", pParam=0xa1e47d0)
         at basic/source/classes/sb.cxx:1324
     #31 0x00007ff091dd7127 in (anonymous 
namespace)::BasicAllListener_Impl::firing_impl(com::sun::star::script::AllEventObject
 const&, com::sun::star::uno::Any*)
         (this=0xa2344a0, Event=..., pRet=0x0) at 
basic/source/classes/sbunoobj.cxx:3831
     #32 0x00007ff091dd6ba1 in (anonymous 
namespace)::BasicAllListener_Impl::firing(com::sun::star::script::AllEventObject
 const&) (this=0xa2344a0, Event=...)
         at basic/source/classes/sbunoobj.cxx:3855
     #33 0x00007ff091dd792f in (anonymous 
namespace)::InvocationToAllListenerMapper::invoke(rtl::OUString const&, 
com::sun::star::uno::Sequence<com::sun::star::uno::Any> const&, 
com::sun::star::uno::Sequence<short>&, 
com::sun::star::uno::Sequence<com::sun::star::uno::Any>&)
         (this=0xa110b70, FunctionName="dragOver", Params=uno::Sequence of 
length 1 = {...}) at basic/source/classes/sbunoobj.cxx:3983
     #34 0x00007ff091dd7be7 in non-virtual thunk to (anonymous 
namespace)::InvocationToAllListenerMapper::invoke(rtl::OUString const&, 
com::sun::star::uno::Sequence<com::sun::star::uno::Any> const&, 
com::sun::star::uno::Sequence<short>&, 
com::sun::star::uno::Sequence<com::sun::star::uno::Any>&) ()
         at /home/caolan/LibreOffice/core/instdir/program/libsblo.so
     #35 0x00007ff072d19921 in gcc3::callVirtualMethod(void*, unsigned int, 
void*, _typelib_TypeDescriptionReference*, bool, unsigned long*, unsigned int, 
unsigned long*, double*)
         (pThis=0xa110b98, nVtableIndex=4, pRegisterReturn=0x7ffdd0d7b5c0, 
pReturnTypeRef=0xa875c0, bSimpleReturn=false, pStack=0x7ffdd0d7b5e0, nStack=0, 
pGPR=0x7ffdd0d7b900, pFPR=0x7ffdd0d7b8c0) at 
bridges/source/cpp_uno/gcc3_linux_x86-64/callvirtualmethod.cxx:77
     #36 0x00007ff072d184fc in 
cpp_call(bridges::cpp_uno::shared::UnoInterfaceProxy*, 
bridges::cpp_uno::shared::VtableSlot, _typelib_TypeDescriptionReference*, int, 
_typelib_MethodParameter*, void*, void**, _uno_Any**)
         (pThis=0xa238bb0, aVtableSlot=..., pReturnTypeRef=0xa875c0, nParams=4, 
pParams=0x2470e40, pUnoReturn=0x7ffdd0d7bb80, pUnoArgs=0x7ffdd0d7bbb0, 
ppUnoExc=0x7ffdd0d7bb60) at 
bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:233
     #37 0x00007ff072d17c58 in unoInterfaceProxyDispatch(uno_Interface*, 
typelib_TypeDescription const*, void*, void**, uno_Any**)
         (pUnoI=0xa238bb0, pMemberDescr=0x24c98c0, pReturn=0x7ffdd0d7bb80, 
pArgs=0x7ffdd0d7bbb0, ppException=0x7ffdd0d7bb60)
         at bridges/source/cpp_uno/gcc3_linux_x86-64/uno2cpp.cxx:413
     #38 0x00007ff0472645ca in stoc_invadp::(anonymous 
namespace)::AdapterImpl::invoke(_typelib_TypeDescription const*, void*, void**, 
_uno_Any**)
         (this=0xa112060, pMemberType=0xa11be80, pReturn=0x7ffdd0d7c4f0, 
pArgs=0x7ffdd0d7bca0, ppException=0x7ffdd0d7bde0)
         at stoc/source/invocation_adapterfactory/iafactory.cxx:457
     #39 0x00007ff04726379d in stoc_invadp::adapter_dispatch(_uno_Interface*, 
_typelib_TypeDescription const*, void*, void**, _uno_Any**)
         (pUnoI=0xa118a50, pMemberType=0xa11be80, pReturn=0x7ffdd0d7c4f0, 
pArgs=0x7ffdd0d7bca0, ppException=0x7ffdd0d7bde0)
         at stoc/source/invocation_adapterfactory/iafactory.cxx:605
     #40 0x00007ff072d04e95 in 
cpp2uno_call(bridges::cpp_uno::shared::CppInterfaceProxy*, 
_typelib_TypeDescription const*, _typelib_TypeDescriptionReference*, int, 
_typelib_MethodParameter*, void**, void**, void**, unsigned long*)
         (pThis=0xa11b350, pMemberTypeDescr=0xa11be80, pReturnTypeRef=0x939280, 
nParams=1, pParams=0xa112460, gpreg=0x7ffdd0d7c520, fpreg=0x7ffdd0d7c540, 
ovrflw=0x7ffdd0d7c590, pRegisterReturn=0x7ffdd0d7c4f0) at 
bridges/source/cpp_uno/gcc3_linux_x86-64/cpp2uno.cxx:191
     #41 0x00007ff072d04611 in cpp_vtable_call(sal_Int32, sal_Int32, void**, 
void**, void**, sal_uInt64*)
         (nFunctionIndex=7, nVtableOffset=0, gpreg=0x7ffdd0d7c510, 
fpreg=0x7ffdd0d7c540, ovrflw=0x7ffdd0d7c590, pRegisterReturn=0x7ffdd0d7c4f0)
         at bridges/source/cpp_uno/gcc3_linux_x86-64/cpp2uno.cxx:389
     #42 0x00007ff072d29836 in privateSnippetExecutor () at 
/home/caolan/LibreOffice/core/instdir/program/libgcc3_uno.so
     #43 0x00007ff08b903787 in 
DNDListenerContainer::fireDragOverEvent(com::sun::star::uno::Reference<com::sun::star::datatransfer::dnd::XDropTargetDragContext>
 const&, signed char, int, int, signed char)
         (this=0x5a444c0, context=uno::Reference to ((anonymous 
namespace)::GtkDropTargetDragContext *) 0xa1dda68, dropAction=1 '\001', 
locationX=89, locationY=33, sourceActions=3 '\003') at 
vcl/source/window/dndlistenercontainer.cxx:224
     #44 0x00007ff08b900b7d in 
DNDEventDispatcher::fireDragOverEvent(vcl::Window*, 
com::sun::star::uno::Reference<com::sun::star::datatransfer::dnd::XDropTargetDragContext>
 const&, signed char, Point const&, signed char)
         (pWindow=0x5a27060, xContext=uno::Reference to ((anonymous 
namespace)::GtkDropTargetDragContext *) 0xa1dda68, nDropAction=1 '\001', 
rLocation=Point = {...}, nSourceActions=3 '\003') at 
vcl/source/window/dndeventdispatcher.cxx:297
     #45 0x00007ff08b9007f5 in 
DNDEventDispatcher::dragOver(com::sun::star::datatransfer::dnd::DropTargetDragEvent
 const&) (this=0x1a32c10, dtde=...)
         at vcl/source/window/dndeventdispatcher.cxx:178
     #46 0x00007ff075f47658 in 
GtkInstDropTarget::fire_dragOver(com::sun::star::datatransfer::dnd::DropTargetDragEvent
 const&) (this=0x199eb40, dtde=...)
        at vcl/unx/gtk3/gtkinst.cxx:1710
    
    Change-Id: I06f24ac50d6d029803d46974162e1afec898d866
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136391
    Tested-by: Jenkins
    Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>

diff --git a/vcl/inc/dndeventdispatcher.hxx b/vcl/inc/dndeventdispatcher.hxx
index e29e76a7d039..9756056da3bd 100644
--- a/vcl/inc/dndeventdispatcher.hxx
+++ b/vcl/inc/dndeventdispatcher.hxx
@@ -39,7 +39,7 @@ class DNDEventDispatcher final : public 
::cppu::WeakImplHelper<
     void designate_currentwindow(vcl::Window *pWindow);
     DECL_LINK(WindowEventListener, VclWindowEvent&, void);
 
-    std::mutex m_aMutex;
+    std::recursive_mutex m_aMutex;
     css::uno::Sequence< css::datatransfer::DataFlavor > m_aDataFlavorList;
 
     vcl::Window* findTopLevelWindow(Point location);
commit 0790487e618514eb6e14fdfa9846af302be526c7
Author:     Roman Kuznetsov <antilibreoff...@gmail.com>
AuthorDate: Tue Jun 21 13:48:22 2022 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Mon Jun 27 13:27:01 2022 +0200

    tdf#148138 change Text Boundaries color to Gray for Dark mode
    
    Change-Id: I276896d0ea94e741be8c0ae49f79f95769e0c2a7
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136234
    Tested-by: Jenkins
    Reviewed-by: Heiko Tietze <heiko.tie...@documentfoundation.org>
    Reviewed-by: Adolfo Jayme Barrientos <fit...@ubuntu.com>
    (cherry picked from commit 4412044340ea8447058bb99f529310c2be56a5a9)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136415

diff --git a/officecfg/registry/data/org/openoffice/Office/UI.xcu 
b/officecfg/registry/data/org/openoffice/Office/UI.xcu
index 4e0e4c030b2c..ab3090babe24 100644
--- a/officecfg/registry/data/org/openoffice/Office/UI.xcu
+++ b/officecfg/registry/data/org/openoffice/Office/UI.xcu
@@ -433,7 +433,7 @@
             <value>true</value>
           </prop>
           <prop oor:name="Color">
-            <value>1842204</value>
+            <value>8421504</value>
           </prop>
         </node>
         <node oor:name="AppBackground">
commit 19957cc2d7fac8edd9550f7815694daed8498b38
Author:     Nathan Pratta Teodosio <nathan.teodo...@canonical.com>
AuthorDate: Tue Jun 21 08:47:14 2022 -0300
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Mon Jun 27 13:27:01 2022 +0200

    Follow-up for Poppler 22.06 update
    
    Change-Id: I8ee9f1a53cc4389e6a4d44e9765b478b5edfffd4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136342
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <michael.st...@allotropia.de>
    (cherry picked from commit ad1ffc62e40c2409b610dfff25a8483b1f2556ad)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/136382
    Reviewed-by: Adolfo Jayme Barrientos <fit...@ubuntu.com>

diff --git a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx 
b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
index d9efa39d8a54..f12478cb2f4d 100644
--- a/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
+++ b/sdext/source/pdfimport/xpdfwrapper/pdfioutdev_gpl.cxx
@@ -476,10 +476,10 @@ int PDFOutDev::parseFont( long long nNewId, GfxFont* 
gfxFont, const GfxState* st
         // we must write byte count to stdout before
 #if POPPLER_CHECK_VERSION(22, 6, 0)
         std::optional<std::vector<unsigned char>> pBuf = 
gfxFont->readEmbFontFile( m_pDoc->getXRef() );
-        nSize = pBuf->size();
-        if ( nSize > 0 )
+        if ( pBuf )
         {
             aNewFont.isEmbedded = true;
+            nSize = pBuf->size();
         }
 #else
         char* pBuf = gfxFont->readEmbFontFile( m_pDoc->getXRef(), &nSize );
@@ -503,7 +503,8 @@ void PDFOutDev::writeFontFile( GfxFont* gfxFont ) const
     int nSize = 0;
 #if POPPLER_CHECK_VERSION(22, 6, 0)
     std::optional<std::vector<unsigned char>> pBuf = gfxFont->readEmbFontFile( 
m_pDoc->getXRef() );
-    nSize = pBuf->size();
+    if ( pBuf )
+        nSize = pBuf->size();
     if ( nSize == 0 )
         return;
 #else

Reply via email to