include/xmloff/txtparae.hxx       |    5 +++++
 sc/source/filter/xml/xmlcelli.cxx |    2 +-
 xmloff/source/text/txtparae.cxx   |   33 ++++++++++++++++++++++++++++-----
 3 files changed, 34 insertions(+), 6 deletions(-)

New commits:
commit 7773932ba7c4bafeed7fba0a5d87f75eed09f850
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Apr 17 09:17:43 2023 +0100
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Mon Apr 17 17:03:17 2023 +0200

    tdf#151560 don't crash on loading dubious fods
    
    Change-Id: Ib41b3a95dd3829e8d3eca61621257fdd416bd8dc
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150483
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/sc/source/filter/xml/xmlcelli.cxx 
b/sc/source/filter/xml/xmlcelli.cxx
index dbbfccf5a5a0..c2841fa33c7f 100644
--- a/sc/source/filter/xml/xmlcelli.cxx
+++ b/sc/source/filter/xml/xmlcelli.cxx
@@ -1493,7 +1493,7 @@ bool ScXMLTableRowCellContext::IsPossibleErrorString() 
const
         return false;
     else if(mbNewValueType && mbErrorValue)
         return true;
-    return mbPossibleErrorCell || (mbCheckWithCompilerForError &&
+    return mbPossibleErrorCell || (mbCheckWithCompilerForError && 
maStringValue &&
             GetScImport().GetFormulaErrorConstant(*maStringValue) != 
FormulaError::NONE);
 }
 
commit d405ddce1fca35e088d35805345571687c46ff5f
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Sun Apr 16 20:44:25 2023 +0100
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Mon Apr 17 17:03:07 2023 +0200

    crashtesting: crash on export of forum-mso-de-102589.docx to odt
    
    recurses to death
    
    Change-Id: I4474de502df0924176cbe8d6c9244d0b73838458
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/150460
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/include/xmloff/txtparae.hxx b/include/xmloff/txtparae.hxx
index 36d554be2a20..1ba8b0b1a0c8 100644
--- a/include/xmloff/txtparae.hxx
+++ b/include/xmloff/txtparae.hxx
@@ -30,6 +30,7 @@
 #include <xmloff/xmltoken.hxx>
 #include <xmloff/SinglePropertySetInfoCache.hxx>
 #include <xmloff/XMLTextListAutoStylePool.hxx>
+#include <o3tl/sorted_vector.hxx>
 #include <o3tl/span.hxx>
 #include <memory>
 #include <vector>
@@ -51,6 +52,7 @@ namespace com::sun::star
     namespace beans { class XPropertySet; class XPropertyState;
                       class XPropertySetInfo; }
     namespace container { class XEnumeration; class XIndexAccess; class 
XNameReplace; }
+    namespace drawing { class XShape; }
     namespace text { class XTextContent; class XTextRange; class XText;
                      class XFootnote; class XTextFrame; class XTextSection;
                      class XTextField; }
@@ -110,6 +112,9 @@ class XMLOFF_DLLPUBLIC XMLTextParagraphExport : public 
XMLStyleExport
     XMLTextListsHelper* mpTextListsHelper;
     ::std::vector< std::unique_ptr<XMLTextListsHelper> > 
maTextListsHelperStack;
 
+    o3tl::sorted_vector<css::uno::Reference<css::text::XTextFrame>> 
maFrameRecurseGuard;
+    o3tl::sorted_vector<css::uno::Reference<css::drawing::XShape>> 
maShapeRecurseGuard;
+
     bool mbCollected;
 
     enum class FrameType { Text, Graphic, Embedded, Shape };
diff --git a/xmloff/source/text/txtparae.cxx b/xmloff/source/text/txtparae.cxx
index aaf47ddd4b71..1e02dbce341d 100644
--- a/xmloff/source/text/txtparae.cxx
+++ b/xmloff/source/text/txtparae.cxx
@@ -110,6 +110,7 @@
 #include <iterator>
 #include <officecfg/Office/Common.hxx>
 #include <o3tl/safeint.hxx>
+#include <comphelper/scopeguard.hxx>
 #include <comphelper/sequenceashashmap.hxx>
 
 using namespace ::com::sun::star;
@@ -3054,17 +3055,39 @@ void XMLTextParagraphExport::exportAnyTextFrame(
                 if ( bExportContent )
                 {
                     Reference < XTextFrame > xTxtFrame( rTxtCntnt, UNO_QUERY );
-                    Reference < XText > xTxt(xTxtFrame->getText());
-                    exportFrameFrames( true, bIsProgress, xTxtFrame );
-                    exportText( xTxt, bAutoStyles, bIsProgress, true );
+                    bool bAlreadySeen = 
!maFrameRecurseGuard.insert(xTxtFrame).second;
+                    if (bAlreadySeen)
+                    {
+                        SAL_WARN("xmloff", "loop in frame export, ditching");
+                    }
+                    else
+                    {
+                        comphelper::ScopeGuard const g([this, xTxtFrame]() {
+                            maFrameRecurseGuard.erase(xTxtFrame);
+                        });
+                        Reference < XText > xTxt(xTxtFrame->getText());
+                        exportFrameFrames( true, bIsProgress, xTxtFrame );
+                        exportText( xTxt, bAutoStyles, bIsProgress, true );
+                    }
                 }
             }
             break;
         case FrameType::Shape:
             {
                 Reference < XShape > xShape( rTxtCntnt, UNO_QUERY );
-                css::uno::Sequence<OUString> aAutoStylePropNames = 
GetAutoStylePool().GetPropertyNames();
-                GetExport().GetShapeExport()->collectShapeAutoStyles( xShape, 
aAutoStylePropNames );
+                bool bAlreadySeen = !maShapeRecurseGuard.insert(xShape).second;
+                if (bAlreadySeen)
+                {
+                    SAL_WARN("xmloff", "loop in shape export, ditching");
+                }
+                else
+                {
+                    comphelper::ScopeGuard const g([this, xShape]() {
+                        maShapeRecurseGuard.erase(xShape);
+                    });
+                    css::uno::Sequence<OUString> aAutoStylePropNames = 
GetAutoStylePool().GetPropertyNames();
+                    GetExport().GetShapeExport()->collectShapeAutoStyles( 
xShape, aAutoStylePropNames );
+                }
             }
             break;
         default:

Reply via email to