https://bugs.freedesktop.org/show_bug.cgi?id=79131
--- Comment #3 from Julien Nabet <[email protected]> --- Markus: trying to unwind this bug, I started from bt, more specifically this part: #4 0x00002aaacce8938f in SvxCustomShape::createCustomShapeDefaults (this=0x89e8a20, rValueType="-1") at /home/julien/compile-libreoffice/libreoffice/svx/source/unodraw/unoshap2.cxx:1979 #5 0x00002aaadc041352 in oox::vml::CustomShape::implConvertAndInsert (this=0x8a11c10, rxShapes=uno::Reference to (SwXDrawPage *) 0x89a9d20, rShapeRect=...) at /home/julien/compile-libreoffice/libreoffice/oox/source/vml/vmlshape.cxx:957 I tried to understand why rValueType was equal to -1 so started here: 957 xDefaulter->createCustomShapeDefaults( OUString::number( getShapeType() ) ); still in vmlshape.cxx 146 sal_Int32 ShapeType::getShapeType() const 147 { 148 return maTypeModel.moShapeType.get( 0 ); 149 } A search in Opengrok seems to indicate moShapeType is initialized in oox/source/vml/vmlshapecontext.cxx: 288 mrTypeModel.moShapeType = rAttribs.getInteger( O_TOKEN( spt ) ); see http://opengrok.libreoffice.org/xref/core/oox/source/vml/vmlshapecontext.cxx#288 The problem is there's no control of the spt value I tried this: - change type of moShapeType from OptValue< sal_Int32 > to OptValue< sal_uInt32 > (include/oox/vml/vmlshape.hxx) - use this: mrTypeModel.moShapeType = rAttribs.getUnsigned( O_TOKEN( spt ) ); instead of this: mrTypeModel.moShapeType = rAttribs.getInteger( O_TOKEN( spt ) ); The file can be opened without crash but -1 is converted to 152 Any idea? -- You are receiving this mail because: You are the assignee for the bug.
_______________________________________________ Libreoffice-bugs mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
