core.git: Branch 'distro/collabora/co-24.04' - sw/qa sw/source

[Mike Kaganski (via logerrit)]

 sw/qa/extras/ooxmlexport/data/too_many_styles.odt |binary
 sw/qa/extras/ooxmlexport/ooxmlexport21.cxx        |    7 +++++++
 sw/source/filter/ww8/docxattributeoutput.cxx      |    2 +-
 3 files changed, 8 insertions(+), 1 deletion(-)

New commits:
commit 5797d70b10fff42b7ae0b94cd3b25e75139f7be4
Author:     Mike Kaganski <mike.kagan...@collabora.com>
AuthorDate: Tue Aug 6 17:32:55 2024 +0500
Commit:     Miklos Vajna <vmik...@collabora.com>
CommitDate: Fri Aug 9 10:54:08 2024 +0200

    tdf#162370: check if nNext is valid, too
    
    0xfff is a special value for a style slot on MS formats export: see
    MSWordStyles::GetSlot and BuildGetSlot. The slot in nNext must be
    checked the same way as nBase and nLink around it.
    
    Change-Id: I94836bc3f624eb99655e005217707e0ea7210c8c
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171547
    Tested-by: Jenkins
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171562
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>

diff --git a/sw/qa/extras/ooxmlexport/data/too_many_styles.odt 
b/sw/qa/extras/ooxmlexport/data/too_many_styles.odt
new file mode 100644
index 000000000000..c3260792eee7
Binary files /dev/null and b/sw/qa/extras/ooxmlexport/data/too_many_styles.odt 
differ
diff --git a/sw/qa/extras/ooxmlexport/ooxmlexport21.cxx 
b/sw/qa/extras/ooxmlexport/ooxmlexport21.cxx
index e26abce21066..cd406e4d8541 100644
--- a/sw/qa/extras/ooxmlexport/ooxmlexport21.cxx
+++ b/sw/qa/extras/ooxmlexport/ooxmlexport21.cxx
@@ -418,6 +418,13 @@ DECLARE_OOXMLEXPORT_TEST(testTdf126533_pageBitmap, 
"tdf126533_pageBitmap.docx")
                 
"/rels:Relationships/rels:Relationship[@Target='media/image1.jpeg']"_ostr, 1);
 }
 
+CPPUNIT_TEST_FIXTURE(Test, testTdf162370)
+{
+    // This must not crash on save; without the fix, it would fail with
+    // "Assertion failed: vector subscript out of range"
+    loadAndSave("too_many_styles.odt");
+}
+
 } // end of anonymous namespace
 CPPUNIT_PLUGIN_IMPLEMENT();
 
diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx 
b/sw/source/filter/ww8/docxattributeoutput.cxx
index 63be2289d99e..44c0aa1efddf 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -6772,7 +6772,7 @@ void DocxAttributeOutput::StartStyle( const OUString& 
rName, StyleType eType,
                 FSNS( XML_w, XML_val ), m_rExport.m_pStyles->GetStyleId(nBase) 
);
     }
 
-    if ( nNext != nSlot && eType != STYLE_TYPE_LIST)
+    if (nNext != nSlot && nNext != 0x0FFF && eType != STYLE_TYPE_LIST)
     {
         m_pSerializer->singleElementNS( XML_w, XML_next,
                 FSNS( XML_w, XML_val ), m_rExport.m_pStyles->GetStyleId(nNext) 
);