core.git: Branch 'libreoffice-25-8' - include/xmloff xmloff/source

[Caolán McNamara (via logerrit)]

 include/xmloff/xmlnumfi.hxx      |    6 ++++--
 xmloff/source/style/xmlnumfi.cxx |   29 +++++++++++++++++++++--------
 2 files changed, 25 insertions(+), 10 deletions(-)

New commits:
commit 4857535b81afc2191c73a1cbddde003fe169c8f9
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Mon Jun 23 09:24:58 2025 +0100
Commit:     Xisco Fauli <xiscofa...@libreoffice.org>
CommitDate: Thu Jun 26 18:01:50 2025 +0200

    ofz#426843907 Stack-overflow
    
    Change-Id: I03f10968aaa32960bc6dfd2175a582ec1dd30918
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/186815
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    (cherry picked from commit b6d240c4bab906f84c0ecefc2b4021b59ff368e4)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/186935
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>

diff --git a/include/xmloff/xmlnumfi.hxx b/include/xmloff/xmlnumfi.hxx
index c8de09bfd106..c6a3159d796e 100644
--- a/include/xmloff/xmlnumfi.hxx
+++ b/include/xmloff/xmlnumfi.hxx
@@ -158,7 +158,10 @@ private:
     SvXMLDateElementAttributes  m_eDateSecs;
     bool                        m_bDateNoDefault;
 
-    SAL_DLLPRIVATE sal_Int32 PrivateGetKey();
+    SAL_DLLPRIVATE sal_Int32 
PrivateGetKey(std::vector<SvXMLNumFormatContext*>& rCreateStack);
+
+    SAL_DLLPRIVATE sal_Int32 CreateAndInsert(SvNumberFormatter* pFormatter, 
std::vector<SvXMLNumFormatContext*>& rCreateStack);
+    SAL_DLLPRIVATE void CreateAndInsert(bool bOverwrite, 
std::vector<SvXMLNumFormatContext*>& rCreateStack);
 
 public:
                 SvXMLNumFormatContext( SvXMLImport& rImport,
@@ -180,7 +183,6 @@ public:
     virtual void CreateAndInsert(bool bOverwrite) override final;
 
     sal_Int32 GetKey();
-    sal_Int32 CreateAndInsert( SvNumberFormatter* pFormatter );
     sal_Int32 CreateAndInsert( css::uno::Reference< 
css::util::XNumberFormatsSupplier > const & xFormatsSupplier );
     SvXMLStylesTokens GetType() const           { return m_nType; }   // 
SvXMLStylesTokens
 
diff --git a/xmloff/source/style/xmlnumfi.cxx b/xmloff/source/style/xmlnumfi.cxx
index 2a51c7c66701..8803bf63f6de 100644
--- a/xmloff/source/style/xmlnumfi.cxx
+++ b/xmloff/source/style/xmlnumfi.cxx
@@ -1523,7 +1523,7 @@ sal_Int32 SvXMLNumFormatContext::GetKey()
     }
 }
 
-sal_Int32 SvXMLNumFormatContext::PrivateGetKey()
+sal_Int32 
SvXMLNumFormatContext::PrivateGetKey(std::vector<SvXMLNumFormatContext*>& 
rCreateStack)
 {
     //  used for map elements in CreateAndInsert - don't reset bRemoveAfterUse 
flag
 
@@ -1531,7 +1531,7 @@ sal_Int32 SvXMLNumFormatContext::PrivateGetKey()
         return m_nKey;
     else
     {
-        CreateAndInsert(true);
+        CreateAndInsert(true, rCreateStack);
         return m_nKey;
     }
 }
@@ -1547,7 +1547,10 @@ sal_Int32 SvXMLNumFormatContext::CreateAndInsert( 
css::uno::Reference< css::util
             pFormatter = pObj->GetNumberFormatter();
 
         if ( pFormatter )
-            return CreateAndInsert( pFormatter );
+        {
+            std::vector<SvXMLNumFormatContext*> aCreateStack;
+            return CreateAndInsert(pFormatter, aCreateStack);
+        }
         else
             return -1;
     }
@@ -1555,13 +1558,19 @@ sal_Int32 SvXMLNumFormatContext::CreateAndInsert( 
css::uno::Reference< css::util
         return m_nKey;
 }
 
-void SvXMLNumFormatContext::CreateAndInsert(bool /*bOverwrite*/)
+void SvXMLNumFormatContext::CreateAndInsert(bool bOverwrite)
+{
+    std::vector<SvXMLNumFormatContext*> aCreateStack;
+    return CreateAndInsert(bOverwrite, aCreateStack);
+}
+
+void SvXMLNumFormatContext::CreateAndInsert(bool /*bOverwrite*/, 
std::vector<SvXMLNumFormatContext*>& rCreateStack)
 {
     if (m_nKey <= -1)
-        CreateAndInsert(m_pData->GetNumberFormatter());
+        CreateAndInsert(m_pData->GetNumberFormatter(), rCreateStack);
 }
 
-sal_Int32 SvXMLNumFormatContext::CreateAndInsert(SvNumberFormatter* pFormatter)
+sal_Int32 SvXMLNumFormatContext::CreateAndInsert(SvNumberFormatter* 
pFormatter, std::vector<SvXMLNumFormatContext*>& rCreateStack)
 {
     if (!pFormatter)
     {
@@ -1569,20 +1578,22 @@ sal_Int32 
SvXMLNumFormatContext::CreateAndInsert(SvNumberFormatter* pFormatter)
         return -1;
     }
 
+    rCreateStack.push_back(this);
+
     sal_uInt32 nIndex = NUMBERFORMAT_ENTRY_NOT_FOUND;
 
     for (size_t i = 0; i < m_aMyConditions.size(); i++)
     {
         SvXMLNumFormatContext* pStyle = const_cast<SvXMLNumFormatContext*>( 
static_cast<const SvXMLNumFormatContext *>(m_pStyles->FindStyleChildContext(
             XmlStyleFamily::DATA_STYLE, m_aMyConditions[i].sMapName)));
-        if (this == pStyle)
+        if (std::find(rCreateStack.begin(), rCreateStack.end(), pStyle) != 
rCreateStack.end())
         {
             SAL_INFO("xmloff.style", "invalid style:map references containing 
style");
             pStyle = nullptr;
         }
         if (pStyle)
         {
-            if (pStyle->PrivateGetKey() > -1)     // don't reset pStyle's 
bRemoveAfterUse flag
+            if (pStyle->PrivateGetKey(rCreateStack) > -1)     // don't reset 
pStyle's bRemoveAfterUse flag
                 AddCondition(i);
         }
     }
@@ -1724,6 +1735,8 @@ sal_Int32 
SvXMLNumFormatContext::CreateAndInsert(SvNumberFormatter* pFormatter)
     if (!m_bRemoveAfterUse)
         GetImport().AddNumberStyle( m_nKey, GetName() );
 
+    rCreateStack.pop_back();
+
     return m_nKey;
 }