core.git: sw/qa sw/source

[Mike Kaganski (via logerrit)]

 sw/qa/extras/ooxmlexport/data/too_many_styles.odt |binary
 sw/qa/extras/ooxmlexport/ooxmlexport21.cxx        |    7 +++++++
 sw/source/filter/ww8/docxattributeoutput.cxx      |    2 +-
 3 files changed, 8 insertions(+), 1 deletion(-)

New commits:
commit ad24ca100f0785f1ff638a2e06e72784bf3c4151
Author:     Mike Kaganski <mike.kagan...@collabora.com>
AuthorDate: Tue Aug 6 17:32:55 2024 +0500
Commit:     Mike Kaganski <mike.kagan...@collabora.com>
CommitDate: Tue Aug 6 18:28:12 2024 +0200

    tdf#162370: check if nNext is valid, too
    
    0xfff is a special value for a style slot on MS formats export: see
    MSWordStyles::GetSlot and BuildGetSlot. The slot in nNext must be
    checked the same way as nBase and nLink around it.
    
    Change-Id: I94836bc3f624eb99655e005217707e0ea7210c8c
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171547
    Tested-by: Jenkins
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>

diff --git a/sw/qa/extras/ooxmlexport/data/too_many_styles.odt 
b/sw/qa/extras/ooxmlexport/data/too_many_styles.odt
new file mode 100644
index 000000000000..c3260792eee7
Binary files /dev/null and b/sw/qa/extras/ooxmlexport/data/too_many_styles.odt 
differ
diff --git a/sw/qa/extras/ooxmlexport/ooxmlexport21.cxx 
b/sw/qa/extras/ooxmlexport/ooxmlexport21.cxx
index cf9d75b7e871..0247edfbad87 100644
--- a/sw/qa/extras/ooxmlexport/ooxmlexport21.cxx
+++ b/sw/qa/extras/ooxmlexport/ooxmlexport21.cxx
@@ -918,6 +918,13 @@ CPPUNIT_TEST_FIXTURE(Test, testTdf161509)
                 u"Plain Text"_ustr);
 }
 
+CPPUNIT_TEST_FIXTURE(Test, testTdf162370)
+{
+    // This must not crash on save; without the fix, it would fail with
+    // "Assertion failed: vector subscript out of range"
+    loadAndSave("too_many_styles.odt");
+}
+
 } // end of anonymous namespace
 CPPUNIT_PLUGIN_IMPLEMENT();
 
diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx 
b/sw/source/filter/ww8/docxattributeoutput.cxx
index b3daa01bba03..2a684a266f84 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -6779,7 +6779,7 @@ void DocxAttributeOutput::StartStyle( const OUString& 
rName, StyleType eType,
                 FSNS( XML_w, XML_val ), m_rExport.m_pStyles->GetStyleId(nBase) 
);
     }
 
-    if ( nNext != nSlot && eType != STYLE_TYPE_LIST)
+    if (nNext != nSlot && nNext != 0x0FFF && eType != STYLE_TYPE_LIST)
     {
         m_pSerializer->singleElementNS( XML_w, XML_next,
                 FSNS( XML_w, XML_val ), m_rExport.m_pStyles->GetStyleId(nNext) 
);