core.git: Branch 'libreoffice-24-2' - sw/qa sw/source

[Mike Kaganski (via logerrit)]

 sw/qa/extras/ooxmlexport/data/too_many_styles.odt |binary
 sw/qa/extras/ooxmlexport/ooxmlexport21.cxx        |    7 +++++++
 sw/source/filter/ww8/docxattributeoutput.cxx      |    2 +-
 3 files changed, 8 insertions(+), 1 deletion(-)

New commits:
commit 5b5e778f476b91a5647946e8c62204f8e6849e98
Author:     Mike Kaganski <mike.kagan...@collabora.com>
AuthorDate: Tue Aug 6 17:32:55 2024 +0500
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Tue Aug 20 10:10:23 2024 +0200

    tdf#162370: check if nNext is valid, too
    
    0xfff is a special value for a style slot on MS formats export: see
    MSWordStyles::GetSlot and BuildGetSlot. The slot in nNext must be
    checked the same way as nBase and nLink around it.
    
    Change-Id: I94836bc3f624eb99655e005217707e0ea7210c8c
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/171547
    Tested-by: Jenkins
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>
    (cherry picked from commit ad24ca100f0785f1ff638a2e06e72784bf3c4151)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/172002
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Signed-off-by: Xisco Fauli <xiscofa...@libreoffice.org>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/172092

diff --git a/sw/qa/extras/ooxmlexport/data/too_many_styles.odt 
b/sw/qa/extras/ooxmlexport/data/too_many_styles.odt
new file mode 100644
index 000000000000..c3260792eee7
Binary files /dev/null and b/sw/qa/extras/ooxmlexport/data/too_many_styles.odt 
differ
diff --git a/sw/qa/extras/ooxmlexport/ooxmlexport21.cxx 
b/sw/qa/extras/ooxmlexport/ooxmlexport21.cxx
index e902f7a7b873..2b28a7663c87 100644
--- a/sw/qa/extras/ooxmlexport/ooxmlexport21.cxx
+++ b/sw/qa/extras/ooxmlexport/ooxmlexport21.cxx
@@ -320,6 +320,13 @@ CPPUNIT_TEST_FIXTURE(Test, 
testTdf159207_footerFramePrBorder)
     // TODO: there SHOULD BE a top border, and even if loaded, it would be 
lost on re-import...
 }
 
+CPPUNIT_TEST_FIXTURE(Test, testTdf162370)
+{
+    // This must not crash on save; without the fix, it would fail with
+    // "Assertion failed: vector subscript out of range"
+    loadAndSave("too_many_styles.odt");
+}
+
 } // end of anonymous namespace
 CPPUNIT_PLUGIN_IMPLEMENT();
 
diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx 
b/sw/source/filter/ww8/docxattributeoutput.cxx
index 28da6d28838d..f213b69a2516 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -6758,7 +6758,7 @@ void DocxAttributeOutput::StartStyle( const OUString& 
rName, StyleType eType,
                 FSNS( XML_w, XML_val ), m_rExport.m_pStyles->GetStyleId(nBase) 
);
     }
 
-    if ( nNext != nSlot && eType != STYLE_TYPE_LIST)
+    if (nNext != nSlot && nNext != 0x0FFF && eType != STYLE_TYPE_LIST)
     {
         m_pSerializer->singleElementNS( XML_w, XML_next,
                 FSNS( XML_w, XML_val ), m_rExport.m_pStyles->GetStyleId(nNext) 
);