compilerplugins/clang/refcounting.cxx                         |    4 
 dbaccess/source/core/dataaccess/datasource.cxx                |    5 
 dbaccess/source/core/dataaccess/datasource.hxx                |    3 
 dbaccess/source/ui/inc/browserids.hxx                         |   10 
 editeng/source/editeng/impedit2.cxx                           |    9 
 filter/source/msfilter/msdffimp.cxx                           |    3 
 hwpfilter/source/hcode.cxx                                    |   28 -
 hwpfilter/source/hinfo.cxx                                    |   11 
 hwpfilter/source/hinfo.h                                      |    2 
 hwpfilter/source/hiodev.cxx                                   |   24 -
 hwpfilter/source/hiodev.h                                     |    6 
 hwpfilter/source/hpara.cxx                                    |    4 
 hwpfilter/source/hwpfile.cxx                                  |    6 
 hwpfilter/source/hwpfile.h                                    |    5 
 include/o3tl/safeint.hxx                                      |   37 +
 officecfg/registry/schema/org/openoffice/Setup.xcs            |    2 
 package/source/zipapi/ZipFile.cxx                             |   15 
 sal/textenc/tcvtkr6.tab                                       |    4 
 sc/qa/unit/data/xls/fail/ofz5527-1.xls                        |binary
 sc/source/core/data/grouptokenconverter.cxx                   |   20 +
 sc/source/core/tool/token.cxx                                 |    3 
 sc/source/filter/excel/xicontent.cxx                          |    4 
 sc/source/ui/docshell/externalrefmgr.cxx                      |    9 
 sc/source/ui/view/cellsh2.cxx                                 |    6 
 sd/source/ui/remotecontrol/BluetoothServer.cxx                |    9 
 sd/source/ui/remotecontrol/Server.cxx                         |    2 
 sot/source/sdstor/stgstrms.cxx                                |    4 
 svl/source/numbers/zforscan.cxx                               |   14 
 sw/qa/core/data/html/pass/ofz5535-1.html                      |    1 
 sw/qa/core/data/rtf/pass/forcepoint-1.rtf                     |  193 ++++++++++
 sw/source/core/bastyp/swcache.cxx                             |   32 +
 sw/source/core/txtnode/fntcache.cxx                           |    3 
 sw/source/filter/html/htmlctxt.cxx                            |    1 
 sw/source/filter/html/htmltab.cxx                             |    3 
 sw/source/filter/html/swhtml.cxx                              |   33 +
 sw/source/filter/html/swhtml.hxx                              |    2 
 sw/source/filter/ww8/ww8par.hxx                               |    2 
 sw/source/filter/ww8/ww8par2.cxx                              |    9 
 sw/source/filter/ww8/ww8par3.cxx                              |    8 
 sw/source/filter/ww8/ww8scan.cxx                              |   17 
 sw/source/filter/ww8/ww8scan.hxx                              |    9 
 sw/source/filter/ww8/ww8toolbar.cxx                           |    4 
 sw/source/ui/envelp/label1.cxx                                |   13 
 sysui/desktop/freedesktop/freedesktop-menus.spec              |   24 -
 sysui/desktop/macosx/Info.plist.in                            |   28 -
 sysui/desktop/menus/calc.desktop                              |    2 
 sysui/desktop/menus/impress.desktop                           |    2 
 sysui/desktop/menus/writer.desktop                            |    2 
 sysui/desktop/mimetypes/ms-excel-sheet-12.desktop             |    2 
 sysui/desktop/mimetypes/ms-excel-sheet-12.keys                |    2 
 sysui/desktop/mimetypes/ms-excel-sheet-binary-12.desktop      |    2 
 sysui/desktop/mimetypes/ms-excel-sheet-binary-12.keys         |    2 
 sysui/desktop/mimetypes/ms-excel-template-12.desktop          |    2 
 sysui/desktop/mimetypes/ms-excel-template-12.keys             |    2 
 sysui/desktop/mimetypes/ms-powerpoint-presentation-12.desktop |    2 
 sysui/desktop/mimetypes/ms-powerpoint-presentation-12.keys    |    2 
 sysui/desktop/mimetypes/ms-powerpoint-template-12.desktop     |    2 
 sysui/desktop/mimetypes/ms-powerpoint-template-12.keys        |    2 
 sysui/desktop/mimetypes/ms-word-document-12.desktop           |    2 
 sysui/desktop/mimetypes/ms-word-document-12.keys              |    2 
 sysui/desktop/mimetypes/ms-word-template-12.desktop           |    2 
 sysui/desktop/mimetypes/ms-word-template-12.keys              |    2 
 sysui/desktop/mimetypes/openoffice.applications               |    2 
 sysui/desktop/mimetypes/openoffice.mime                       |   14 
 sysui/desktop/solaris/mime.types                              |   12 
 vcl/inc/sft.hxx                                               |    9 
 vcl/source/fontsubset/sft.cxx                                 |  148 +++++--
 vcl/source/gdi/pdfwriter_impl.cxx                             |    2 
 vcl/source/helper/strhelper.cxx                               |    9 
 writerfilter/source/dmapper/DomainMapperTableManager.cxx      |    6 
 writerfilter/source/dmapper/TableManager.cxx                  |    2 
 writerfilter/source/rtftok/rtfdispatchvalue.cxx               |    2 
 writerperfect/source/common/WPXSvInputStream.cxx              |    5 
 xmloff/source/draw/XMLNumberStyles.cxx                        |    5 
 xmloff/source/table/XMLTableExport.cxx                        |   18 
 xmloff/source/text/txtparai.cxx                               |   15 
 76 files changed, 654 insertions(+), 260 deletions(-)

New commits:
commit 99d296a88336166b4d2a28523b9913f5a616b69d
Author: Caolán McNamara <caol...@redhat.com>
Date:   Fri Mar 2 11:33:24 2018 +0000

    forcepoint #17 nTextBreak is an index into pKernArray of len rInf.GetLen()
    
    Change-Id: I3afeaf987cc5e75362560165fea7230904530933
    Reviewed-on: https://gerrit.libreoffice.org/50630
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    Tested-by: Jenkins <c...@libreoffice.org>
    (cherry picked from commit c21fbf68da2b1ac0da3668f9494f9a8f5c4322c8)

diff --git a/sw/source/core/txtnode/fntcache.cxx 
b/sw/source/core/txtnode/fntcache.cxx
index 70be938edce2..bbd9a28e34fc 100644
--- a/sw/source/core/txtnode/fntcache.cxx
+++ b/sw/source/core/txtnode/fntcache.cxx
@@ -2400,9 +2400,8 @@ sal_Int32 SwFont::GetTextBreak( SwDrawTextInfo& rInf, 
long nTextWidth )
             rInf.GetOut().GetTextArray( rInf.GetText(), pKernArray,
                                             rInf.GetIdx(), rInf.GetLen() );
             long nCurrPos = pKernArray[nTextBreak] + nGridWidthAdd;
-            while( nTextBreak < rInf.GetLen() && nTextWidth >= nCurrPos)
+            while (++nTextBreak < rInf.GetLen() && nTextWidth >= nCurrPos)
             {
-                nTextBreak++;
                 nCurrPos = pKernArray[nTextBreak] + nGridWidthAdd * ( 
nTextBreak + 1 );
             }
             delete[] pKernArray;
commit 25eb13ece6670a8e1be1c42ea53ad2173fe381b5
Author: Caolán McNamara <caol...@redhat.com>
Date:   Fri Mar 2 11:06:12 2018 +0000

    ofz#6656 -1 isn't a good flag for all elements filled
    
    Change-Id: I163de8fd943859fbf986da0928f3e3552d063a09
    Reviewed-on: https://gerrit.libreoffice.org/50626
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    Tested-by: Jenkins <c...@libreoffice.org>
    (cherry picked from commit 88b1ca64c0cdb426025b246618e7e9e880c286d8)

diff --git a/xmloff/source/draw/XMLNumberStyles.cxx 
b/xmloff/source/draw/XMLNumberStyles.cxx
index cd8f8fae9709..5538563c8119 100644
--- a/xmloff/source/draw/XMLNumberStyles.cxx
+++ b/xmloff/source/draw/XMLNumberStyles.cxx
@@ -609,11 +609,8 @@ 
SdXMLNumberFormatImportContext::~SdXMLNumberFormatImportContext()
 
 void SdXMLNumberFormatImportContext::add( OUString& rNumberStyle, bool bLong, 
bool bTextual, bool   bDecimal02, OUString& rText )
 {
-    if( mnIndex == -1 || mnIndex == 16 )
-    {
-        mnIndex = -1;
+    if (mnIndex == 16)
         return;
-    }
 
     const SdXMLDataStyleNumber* pStyleMember = aSdXMLDataStyleNumbers;
     for( sal_uInt8 nIndex = 0; pStyleMember->meNumberStyle != 
XML_TOKEN_INVALID; nIndex++, pStyleMember++ )
commit 197eef02e64b1dd63047ab391c32e90ef9b0c12d
Author: Caolán McNamara <caol...@redhat.com>
Date:   Thu Mar 1 21:14:15 2018 +0000

    forcepoint #14 check to see if we incremented at all
    
    Change-Id: Ia4670adbddcc8501cf522be296b3061a3529f880
    Reviewed-on: https://gerrit.libreoffice.org/50607
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit 31deb001ab1d06832caf9439c6b1c061fc20e3d9)

diff --git a/vcl/source/helper/strhelper.cxx b/vcl/source/helper/strhelper.cxx
index 545f30c491d7..4a5446aabf60 100644
--- a/vcl/source/helper/strhelper.cxx
+++ b/vcl/source/helper/strhelper.cxx
@@ -300,9 +300,12 @@ OUString WhitespaceToSpace( const OUString& rLine, bool 
bProtect )
     *pLeap = 0;
 
     // there might be a space at beginning or end
-    pLeap--;
-    if( *pLeap == ' ' )
-        *pLeap = 0;
+    if (pLeap > pBuffer)
+    {
+        pLeap--;
+        if( *pLeap == ' ' )
+            *pLeap = 0;
+    }
 
     return OUString(*pBuffer == ' ' ? pBuffer+1 : pBuffer);
 }
commit d685768ca43dcb8e182a22c68cda640dc8fffd4b
Author: David Tardon <dtar...@redhat.com>
Date:   Tue Feb 27 17:47:19 2018 +0100

    set number of read bytes correctly
    
    It was wrong if we read less than was expected.
    
    Thanks to Antti Levomäki and Christian Jalio from Forcepoint.
    
    Change-Id: I070c1731d1aace4c101fa01efed0c28734c44899
    (cherry picked from commit 9534a8fe3e84bfcc7d0d2addac4dd8cd96746d99)
    Reviewed-on: https://gerrit.libreoffice.org/50463
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit 1b1f416244ace9ab3eb532cc4ab242486cd1930d)

diff --git a/writerperfect/source/common/WPXSvInputStream.cxx 
b/writerperfect/source/common/WPXSvInputStream.cxx
index 2c6b062d990b..7fcadf0a02e7 100644
--- a/writerperfect/source/common/WPXSvInputStream.cxx
+++ b/writerperfect/source/common/WPXSvInputStream.cxx
@@ -869,7 +869,10 @@ const unsigned char *WPXSvInputStream::read(unsigned long 
numBytes, unsigned lon
     if (!mpImpl->mnReadBufferLength)
         return nullptr;
 
-    numBytesRead = numBytes;
+    if (numBytes <= mpImpl->mnReadBufferLength)
+        numBytesRead = numBytes;
+    else
+        numBytesRead = mpImpl->mnReadBufferLength;
 
     mpImpl->mnReadBufferPos += numBytesRead;
     return mpImpl->mpReadBuffer;
commit d8b19fe9f22926b49a675fb164e72add9ad65173
Author: Rostislav Kondratenko <ros...@rkond.ru>
Date:   Wed Feb 21 17:27:00 2018 +0300

    tdf#97614 Fixing initialization code for Bluetooth and IP Server for 
Impress.
    
    Change-Id: Icc385fb760b8a5ff337f58dc95ba3c3f86805eaa
    Reviewed-on: https://gerrit.libreoffice.org/50108
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    Tested-by: Jenkins <c...@libreoffice.org>
    (cherry picked from commit fb5f13671c50f7f84d654a779bc0ff07e31ce95e)
    Reviewed-on: https://gerrit.libreoffice.org/50414
    (cherry picked from commit 424eb9e4282596818ed39943b9d4a64cb6888eef)

diff --git a/sd/source/ui/remotecontrol/BluetoothServer.cxx 
b/sd/source/ui/remotecontrol/BluetoothServer.cxx
index d51591109f9d..d6af643fbf45 100644
--- a/sd/source/ui/remotecontrol/BluetoothServer.cxx
+++ b/sd/source/ui/remotecontrol/BluetoothServer.cxx
@@ -1343,16 +1343,14 @@ void SAL_CALL BluetoothServer::run()
         return;
     }
 
-    SOCKADDR aName;
+    SOCKADDR_BTH aName;
     int aNameSize = sizeof(aName);
-    getsockname( aSocket, &aName, &aNameSize ); // Retrieve the local address 
and port
+    getsockname( aSocket, reinterpret_cast<SOCKADDR*>(&aName), &aNameSize ); 
// Retrieve the local address and port
 
     CSADDR_INFO aAddrInfo;
     memset( &aAddrInfo, 0, sizeof(aAddrInfo) );
-    aAddrInfo.LocalAddr.lpSockaddr = &aName;
+    aAddrInfo.LocalAddr.lpSockaddr = reinterpret_cast<SOCKADDR*>(&aName);
     aAddrInfo.LocalAddr.iSockaddrLength = sizeof( SOCKADDR_BTH );
-    aAddrInfo.RemoteAddr.lpSockaddr = &aName;
-    aAddrInfo.RemoteAddr.iSockaddrLength = sizeof( SOCKADDR_BTH );
     aAddrInfo.iSocketType = SOCK_STREAM;
     aAddrInfo.iProtocol = BTHPROTO_RFCOMM;
 
@@ -1376,7 +1374,6 @@ void SAL_CALL BluetoothServer::run()
     aRecord.dwNameSpace = NS_BTH;
     aRecord.dwNumberOfCsAddrs = 1;
     aRecord.lpcsaBuffer = &aAddrInfo;
-
     if (WSASetServiceW( &aRecord, RNRSERVICE_REGISTER, 0 ) == SOCKET_ERROR)
     {
         closesocket( aSocket );
diff --git a/sd/source/ui/remotecontrol/Server.cxx 
b/sd/source/ui/remotecontrol/Server.cxx
index 6d51a4e0d4a5..d653b0a380d6 100644
--- a/sd/source/ui/remotecontrol/Server.cxx
+++ b/sd/source/ui/remotecontrol/Server.cxx
@@ -83,7 +83,7 @@ void RemoteServer::execute()
         spServer = nullptr;
         return;
     }
-    osl::SocketAddr aAddr( "0", PORT );
+    osl::SocketAddr aAddr( "0.0.0.0", PORT );
     if ( !mSocket.bind( aAddr ) )
     {
         SAL_WARN( "sdremote", "bind failed" << mSocket.getErrorAsString() );
commit d09042b74783f4f921908e38b5965c2027533b81
Author: Caolán McNamara <caol...@redhat.com>
Date:   Mon Feb 26 12:30:57 2018 +0000

    forcepoint #10 pop empty stack
    
    Reviewed-on: https://gerrit.libreoffice.org/50359
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit befd67bcd0607bf2f0116a5418f3c7278e471631)
    
    Change-Id: I96452a86187a6b03251614625445d1b18a5ee218

diff --git a/sw/qa/core/data/rtf/pass/forcepoint-1.rtf 
b/sw/qa/core/data/rtf/pass/forcepoint-1.rtf
new file mode 100755
index 000000000000..afee08d8d925
--- /dev/null
+++ b/sw/qa/core/data/rtf/pass/forcepoint-1.rtf
@@ -0,0 +1,193 @@
+{\rtf1\ansi\ansicpg1252\uc1 
\deff0\deflang3082\deflangfe3082{\fonttbl{\f0\froman\fcharset0\fprq2{\*\panose 
02020603050405020304}Times New Roman;}{\f1\fswiss\fcharset0\fprq2{\*\panose 
020b0604020202020204}Arial;}
+{\f2\fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier 
New;}{\f153\froman\fcharset238\fprq2 Times New Roman 
CE;}{\f154\froman\fcharset204\fprq2 Times New Roman 
Cyr;}{\f156\froman\fcharset161\fprq2 Times New Roman Greek;}
+{\f157\froman\fcharset162\fprq2 Times New Roman 
Tur;}{\f158\froman\fcharset177\fprq2 Times New Roman 
(Hebrew);}{\f159\froman\fcharset178\fprq2 Times New Roman 
(Arabic);}{\f160\froman\fcharset186\fprq2 Times New Roman Baltic;}
+{\f161\fswiss\fcharset238\fprq2 Arial CE;}{\f162\fswiss\fcharset204\fprq2 
Arial Cyr;}{\f164\fswiss\fcharset161\fprq2 Arial 
Greek;}{\f165\fswiss\fcharset162\fprq2 Arial 
Tur;}{\f166\fswiss\fcharset177\fprq2 Arial (Hebrew);}
+{\f167\fswiss\fcharset178\fprq2 Arial 
(Arabic);}{\f168\fswiss\fcharset186\fprq2 Arial 
Baltic;}{\f169\fmodern\fcharset238\fprq1 Courier New 
CE;}{\f170\fmodern\fcharset204\fprq1 Courier New 
Cyr;}{\f172\fmodern\fcharset161\fprq1 Courier New Greek;}
+{\f173\fmodern\fcharset162\fprq1 Courier New 
Tur;}{\f174\fmodern\fcharset177\fprq1 Courier New 
(Hebrew);}{\f175\fmodern\fcharset178\fprq1 Courier New 
(Arabic);}{\f176\fmodern\fcharset186\fprq1 Courier New 
Baltic;}}{\colortbl;\red0\green0\blue0;
+\red0\green0\blue255;\red0\green255\blue255;\red0\green255\blue0;\red255\green0\blue255;\red255\green0\blue0;\red255\green255\blue0;\red255\green255\blue255;\red0\green0\blue128;\red0\green128\blue128;\red0\green128\blue0;\red128\green0\blue128;
+\red128\green0\blue0;\red128\green128\blue0;\red128\green128\blue128;\red192\green192\blue192;}{\stylesheet{\ql
 \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\fs20\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext0 Normal;}{
+\s3\qj 
\li0\ri0\keepn\widctlpar\hyphpar0\aspalpha\aspnum\faauto\outlinelevel2\adjustright\rin0\lin0\itap0
 \b\fs24\lang3082\langfe1024\cgrid\langnp3082\langfenp1024 \sbasedon0 \snext0 
heading 3;}{\*\cs10 \additive Default Paragraph Font;}{
+\s15\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon0 \snext15 
Lower Roman List;}{\s16\ql \li0\ri0\nowidctlpar\tx431\faauto\rin0\lin0\itap0 
+\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon31 \snext0 
Numbered Heading 1;}{\s17\ql \li0\ri0\nowidctlpar\tx431\faauto\rin0\lin0\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon32 \snext0 
Numbered Heading 2;}{
+\s18\ql \li0\ri0\nowidctlpar\tx431\faauto\rin0\lin0\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon33 \snext0 
Numbered Heading 3;}{\s19\ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
+\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon0 \snext19 
Endnote Text;}{\s20\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext20 Diamond List;}{
+\s21\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext21 Numbered 
List;}{\s22\ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
+\fs20\lang3082\langfe3082\super\cgrid\langnp3082\langfenp3082 \snext22 Endnote 
Reference;}{\s23\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext23 Triangle 
List;}{
+\s24\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext24 Square 
List;}{\s25\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
+\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext25 Dashed 
List;}{\s26\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon21 \snext26 
Upper Roman List;}{
+\s27\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext27 Heart 
List;}{\s28\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
+\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon21 \snext28 
Upper Case List;}{\s29\ql 
\fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext29 Bullet List;}{
+\s30\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext30 Hand 
List;}{\s31\ql \li0\ri0\sb440\sa60\nowidctlpar\faauto\rin0\lin0\itap0 
+\b\f1\fs34\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon0 
\snext0 Heading 1;}{\s32\ql 
\li0\ri0\sb440\sa60\nowidctlpar\faauto\rin0\lin0\itap0 
\b\f1\fs28\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon0 \snext0 
Heading 2;}{
+\s33\ql \li0\ri0\sb440\sa60\nowidctlpar\faauto\rin0\lin0\itap0 
\b\f1\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon0 \snext0 
Heading 3;}{\s34\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
+\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext34 Tick 
List;}{\s35\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon21 \snext35 
Lower Case List;}{
+\s36\ql \li1440\ri1440\sa117\nowidctlpar\faauto\rin1440\lin1440\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon0 \snext36 
Block Text;}{\s37\ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
+\fs20\lang3082\langfe3082\super\cgrid\langnp3082\langfenp3082 \snext37 
Footnote Reference;}{\s38\ql \li0\ri0\nowidctlpar\tx1584\faauto\rin0\lin0\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon16 \snext0 
Section Heading;}{
+\s39\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext39 Implies 
List;}{\s40\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
+\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext40 Box 
List;}{\s41\ql \fi-431\li720\ri0\nowidctlpar\faauto\rin0\lin720\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \snext41 Star List;}{
+\s42\ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\f2\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon0 \snext42 
Plain Text;}{\s43\ql \li0\ri0\nowidctlpar\tx1584\faauto\rin0\lin0\itap0 
+\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 \sbasedon16 \snext0 
Chapter Heading;}}{\info{\author Unknown User}{\operator Unknown 
User}{\creatim\yr2003\mo4\dy6\hr19\min50}{\revtim\yr2003\mo4\dy6\hr23\min50}{\printim\yr2003\mo4\dy6\hr23\min29}
+{\version17}{\edmins226}{\nofpages4}{\nofwords1077}{\nofchars6144}{\*\company 
DellComputerCorporation}{\nofcharsws7545}{\vern8249}}\paperw11905\paperh16837\margl1440\margr1440
 
+\widowctrl\ftnbj\aenddoc\hyphhotz425\noxlattoyen\expshrtn\noultrlspc\dntblnsbdb\nospaceforul\hyphcaps0\horzdoc\dghspace120\dgvspace120\dghorigin1701\dgvorigin1984\dghshow0\dgvshow3\jcompress\viewkind1\viewscale100\nolnhtadjtbl
 \fet0\sectd 
+\sbknone\linex0\colsx360\sectdefaultcl 
{\*\pnseclvl1\pnucrm\pnstart1\pnindent720\pnhang{\pntxta 
.}}{\*\pnseclvl2\pnucltr\pnstart1\pnindent720\pnhang{\pntxta 
.}}{\*\pnseclvl3\pndec\pnstart1\pnindent720\pnhang{\pntxta .}}{\*\pnseclvl4
+\pnlcltr\pnstart1\pnindent720\pnhang{\pntxta 
)}}{\*\pnseclvl5\pndec\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta 
)}}{\*\pnseclvl6\pnlcltr\pnstart1\pnindent720\pnhang{\pntxtb (}{\pntxta 
)}}{\*\pnseclvl7\pnlcrm\pnstart1\pnindent720\pnhang{\pntxtb (}
+{\pntxta )}}{\*\pnseclvl8\pnlcltr\pnstart1\pnindent720\pnhang{\pntxtb 
(}{\pntxta )}}{\*\pnseclvl9\pnlcrm\pnstart1\pnindent720\pnhang{\pntxtb 
(}{\pntxta )}}\pard\plain \s16\ql 
\fi-1440\li1440\ri0\nowidctlpar\faauto\rin0\lin1440\itap0 
+\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\lang1034\langfe3082\langnp1034 Alumne: Jordi Mas i Hern\'e0ndez
+\par }\pard\plain \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\fs20\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\lang1034\langfe3082\langnp1034 PAC: C
+\par 
+\par }{\b\fs24\ul\lang1034\langfe3082\langnp1034 1. Introducci\'f3}{
+\par }{\b\fs24\ul\lang1034\langfe3082\langnp1034 \line 
}{\fs24\lang1034\langfe3082\langnp1034 L\rquote objectiu d\rquote aquesta PAC 
\'e9s comparar el funcionament de dos sistemes de traducci\'f3 autom\'e0tica.
+\par \line Cal destacar, que el Salt requereix la intervenci\'f3 humana per 
desambiguar molts casos mentre que l\rquote Internostrum ho intenta fer 
autom\'e0ticament. 
+\par }{\b\fs24\ul\lang1034\langfe3082\langnp1034 
+\par 2. Desenvolupament}{
+\par }{\b\fs24\ul\lang1034\langfe3082\langnp1034 
+\par }{\b\fs24\lang1034\langfe3082\langnp1034 Preedici\'f3}{
+\par }{\b\fs24\lang1034\langfe3082\langnp1034 
+\par }{\fs24\lang1034\langfe3082\langnp1034 De cara a facilitar al m\'e0xim la 
feina al sistema traducci\'f3 \'e9s for\'e7a convenient donar el text original 
el m\'e9s correcte possible. En aquest sentit, proposaria els seg\'fc
+ents canvis sobre el text original espanyol:}{
+\par }{\fs24\lang1034\langfe3082\langnp1034 
+\par - 'Com surgido'  ho substituiria per "Como surgido'\line }{
+\par }{\fs24\lang1034\langfe3082\langnp1034 - ' a cerca ' ho substituiria per 
' acerca '\line }{
+\par }\pard\plain \s16\ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\lang1034\langfe3082\langnp1034 - Imprevisilidad i orbitar no s\'f3n paraules 
normatives en castell\'e0 perqu\'e8
+ no tenen una entrada al diccionari de la RAE, per la qual cosa fora 
convenient canviar-les per una forma admesa.
+\par }\pard\plain \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\fs20\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\fs24\lang1034\langfe3082\langnp1034 \line 
}{\b\fs24\lang1033\langfe3082\langnp1033 Ambig\'fcitats l\'e8xiques}{
+\b\lang1033\langfe3082\langnp1033 
+\par }{\fs24\lang1033\langfe3082\langnp1033 
+\par }{\fs24\lang1034\langfe3082\langnp1034 - \lquote Cometa\rquote . Salt 
proposa \lquote cometa\rquote  i InterNostrum \rquote estel\rquote .\line 
+\par Per poder resoldre aquesta ambig\'fcitat necessitar\'edem que el 
traductor tingu\'e9s en compte la sem\'e0ntica dels mots, la qual cosa \'e9s 
impossible avui en dia. En aquesta situaci\'f3, malgrat la paraula estel \'e9
+s menys precisa que cometa quan es refereix a un cos del sistema solar, aquest 
mat\'eds nom\'e9s el pot donar l\rquote autor.
+\par 
+\par -\lquote Alcanzar\rquote , que en castell\'e0 t\'e9 dos sentits \lquote 
aconseguir\rquote  i \lquote arribar\rquote . Salt opta per \lquote 
aconseguir\rquote  i Internostrum per \lquote arribar\rquote . Sense tenir en 
compte la sem\'e0ntica de la frase 
+\'e9s impossible desambiguar aquest cas
+\par 
+\par }{\b\fs24\lang1033\langfe3082\langnp1033 Ambig\'fcitats 
sint\'e0ctiques}{\fs24\lang1034\langfe3082\langnp1034 
+\par 
+\par - \lquote Como surgido de la nada\rquote . Tots dos opten per la 
traducci\'f3 \lquote com sorgit del no res\rquote  i seria m\'e9s correcte 
\lquote com a sorgit del no res\rquote \line  
+\par }\pard\plain \s33\ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\b\f1\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\f0\lang1034\langfe3082\langnp1034 Ambig\'fcitats sint\'e0ctico-sem\'e0ntiques
+\par }\pard\plain \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\fs20\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\fs24\lang1034\langfe3082\langnp1034 
+\par }{\fs24\lang1034\langfe3082\langnp1034 
-}{\fs24\lang1034\langfe3082\langnp1034  \lquote Dicho\rquote . Salt proposa 
\lquote El dit vent\rquote  i InterNostrum \rquote Dit vent\rquote .Salt t\'e9 
un problema amb l\rquote analitzador sint\'e0ctic perqu\'e8
+ interpreta un relatiu com si fos un substantiu.
+\par 
+\par }\pard\plain \s33\ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\b\f1\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\f0\lang1034\langfe3082\langnp1034 Dialectal
+\par }\pard\plain \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\fs20\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\lang1034\langfe3082\langnp1034 
+\par }{\fs24\lang1034\langfe3082\langnp1034 Malgrat ambd\'f3s productes estan 
fets al Pa\'eds Val\'e8ncia, Salt escull preferentment la variant dialectal 
valenciana mentre que Internostrum opta per la varietat central, que s\rquote 
adopta com a est\'e0ndard.
+\line }{\lang1034\langfe3082\langnp1034 
+\par }{\fs24\lang1033\langfe3082\langnp1033 
-}{\fs24\lang1033\langfe3082\langnp1033  Pronom possessiu \lquote su\rquote . 
}{\fs24\lang1034\langfe3082\langnp1034 Salt proposa \lquote seua\rquote  i 
InterNostrum \rquote seva\rquote .
+ Per altra banda, els dos sistemes reconeixen correctament que es tracta 
d\rquote un forma femenina per l\rquote an\'e0lisis sint\'e0ctica que fan de la 
frase.\line 
+\par }{\fs24\lang1034\langfe3082\langnp1034 
-}{\fs24\lang1034\langfe3082\langnp1034  \lquote Atr\'e1s\rquote . Salt proposa 
\lquote arrere\rquote  i InterNostrum \rquote endarrere\rquote 
.}{\fs24\lang1034\langfe3082\langnp1034 
+\par 
+\par - \lquote Arrebatadas\rquote . }{\fs24\lang1034\langfe3082\langnp1034 
Salt proposa \lquote }{\fs24\lang1034\langfe3082\langnp1034 
Arrabassada}{\fs24\lang1034\langfe3082\langnp1034 \rquote  i InterNostrum 
\rquote }{\fs24\lang1034\langfe3082\langnp1034 
+arravassada}{\fs24\lang1034\langfe3082\langnp1034 \rquote . La forma que 
proposa Internostrum en aquest cas \'e9s err\'f2nia, i probablement es deu a un 
error en la introducci\'f3 del l\'e8xic.
+\par \line - \lquote Aparecer\rquote  Salt proposa \lquote 
}{\fs24\lang1034\langfe3082\langnp1034 
apar\'e9ixer}{\fs24\lang1034\langfe3082\langnp1034 \rquote  i InterNostrum 
\rquote }{\fs24\lang1034\langfe3082\langnp1034 apar\'e8ixer}{
+\fs24\lang1034\langfe3082\langnp1034 \rquote . Salt proposa una forma 
incorrecte, que probablement es deu a un error en la introducci\'f3 del 
l\'e8xic.
+\par 
+\par }{\fs24\lang1034\langfe3082\langnp1034 - \lquote Encogerse\rquote 
.}{\fs24\lang1034\langfe3082\langnp1034  Salt proposa \lquote 
}{\fs24\lang1034\langfe3082\langnp1034 
encollir-se}{\fs24\lang1034\langfe3082\langnp1034 \rquote  i InterNostrum 
\rquote }{
+\fs24\lang1034\langfe3082\langnp1034 
encongir-se}{\fs24\lang1034\langfe3082\langnp1034 \rquote . Ambdues formes 
s\'f3n sin\'f2nimes.}{\fs24\lang1034\langfe3082\langnp1034 
+\par 
+\par - \lquote De estos\rquote .}{\fs24\lang1034\langfe3082\langnp1034  Salt 
proposa \lquote }{\fs24\lang1034\langfe3082\langnp1034 d\rquote 
estos}{\fs24\lang1034\langfe3082\langnp1034 \rquote  i InterNostrum \rquote 
}{\fs24\lang1034\langfe3082\langnp1034 d
+\rquote aquests}{\fs24\lang1034\langfe3082\langnp1034 \rquote . La segona 
forma \'e9s molt m\'e9s est\'e0ndard.\line 
}{\fs24\lang1034\langfe3082\langnp1034  
+\par }\pard\plain \s33\ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\b\f1\fs24\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\f0\lang1034\langfe3082\langnp1034 Estil
+\par }\pard\plain \ql 
\li0\ri0\nowidctlpar\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\tx9360\tx10080\faauto\rin0\lin0\itap0
 \fs20\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\lang1034\langfe3082\langnp1034 \line }
+{\fs24\lang1034\langfe3082\langnp1034 Salt tendeix a escollir les formes 
m\'e9s semblants a l\rquote espanyol i el Internostrum les m\'e9s allunyades.
+\par }{\lang1034\langfe3082\langnp1034 
+\par }{\fs24\lang1034\langfe3082\langnp1034 - \lquote Rodear\rquote 
.}{\fs24\lang1034\langfe3082\langnp1034  Salt proposa \lquote 
}{\fs24\lang1034\langfe3082\langnp1034 
rodejar}{\fs24\lang1034\langfe3082\langnp1034 \rquote  i InterNostrum \rquote }{
+\fs24\lang1034\langfe3082\langnp1034 
envoltar}{\fs24\lang1034\langfe3082\langnp1034 \rquote . Ambd\'faes formes 
s\'f3n sin\'f2nimes.}{\lang1034\langfe3082\langnp1034 \line 
+\par }{\fs24\lang1034\langfe3082\langnp1034 - \lquote Tardan\rquote 
.}{\fs24\lang1034\langfe3082\langnp1034  Salt proposa \lquote 
}{\fs24\lang1034\langfe3082\langnp1034 
tarden}{\fs24\lang1034\langfe3082\langnp1034 \rquote  i InterNostrum \rquote }{
+\fs24\lang1034\langfe3082\langnp1034 
triguen}{\fs24\lang1034\langfe3082\langnp1034 \rquote . Ambd\'faes formes 
s\'f3n sin\'f2nimes.
+\par 
+\par - \lquote A juzgar\rquote . Salt proposa \lquote a jutjar\rquote  i 
InterNostrum \lquote si s\rquote ha de jutjar\rquote , \'e9s a dir, el primer 
fa un calc de l\rquote espanyol i Internostrum fa una construcci\'f3 m\'e9s 
pr\'f2pia del catal\'e0.\line }{
+\b\fs24\lang1034\langfe3082\langnp1034  
+\par }\pard \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
{\fs24\lang1034\langfe3082\langnp1034 -}{\fs24\lang1034\langfe3082\langnp1034  
\lquote Junto\rquote . Salt proposa \lquote junt\rquote  i InterNostrum \rquote 
juntament\rquote .}{
+\b\fs24\ul\lang1034\langfe3082\langnp1034  
+\par 
+\par 
+\par 3. Marcatge dels textos
+\par \line }{\b\fs24\lang1034\langfe3082\langnp1034 Text original
+\par }\pard \ql \fi-2160\li2160\ri0\nowidctlpar\faauto\rin0\lin2160\itap0 
{\b\fs24\ul\lang1034\langfe3082\langnp1034 
+\par }\pard \qj \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 {\fs24 La 
visi\'f3n de un gran }{\fs24\highlight6 cometa}{\fs24  es fascinante. Sin 
embargo, los }{\fs24\highlight6 cometas}{\fs24  son una simple apariencia 
m\'e1s que una realidad sustancial: unas 
+\'93bolas de nieve sucia\'94 o unos bloques de hielo de pocos kil\'f3metros de 
di\'e1metro que quedaron como residuos en el proceso de nacimiento del sistema 
solar. La larga \'f3rbita oval de los }{\fs24\highlight6 cometas}{\fs24 
+ los a cerca al Sol y vuelve a alejarlos. Al aproximarse a la estrella madre, 
}{\fs24\highlight7 su}{\fs24  helada superficie se evapora formando una gran 
cabeza, que el viento solar extiende en una larga cola. }{\fs24\highlight3 
Dicho}{\fs24 
+ viento arrastra hacia }{\fs24\highlight7 atr\'e1s}{\fs24  el gas, 
}{\fs24\highlight16 junto}{\fs24  con part\'edculas de polvo }{\fs24\highlight7 
arrebatadas}{\fs24  en la evaporaci\'f3n, formando un par de colas que crecen a 
medida que el }{
+\fs24\highlight6 cometa}{\fs24  rodea el Sol, hasta }{\fs24\highlight6 
alcanzar}{\fs24  los 100 millones de km. Al retroceder el }{\fs24\highlight6 
cometa}{\fs24 , la cola vuelve a }{\fs24\highlight7 encogerse}{\fs24 .
+\par Entre las clases de }{\fs24\highlight6 cometas}{\fs24 , hay unos que se 
caracterizan por el hecho de que }{\fs24\highlight7 su}{\fs24  \'f3rbita es tan 
grande que tardan millones de a\'f1os en }{\fs24\highlight16 rodear}{\fs24  al 
Sol. Los }{
+\fs24\highlight6 cometas}{\fs24  de per\'edodo largo }{\fs24\highlight16 
tardan}{\fs24  m\'e1s de 200 a\'f1os en completar una \'f3rbita. Por \'faltimo, 
los de per\'edodo corto est\'e1
+n atrapados por la gravedad de los planetas y orbitan el Sol con relativa 
rapidez.
+\par Se ignora d\'f3nde se originan los }{\fs24\highlight6 cometas}{\fs24 , 
pero, }{\fs24\highlight16 a juzgar}{\fs24  por sus largas \'f3rbitas, 
}{\fs24\highlight7 su}{\fs24  lugar de procedencia est\'e1 mucho m\'e1s all\'e1 
de los planetas conocidos. 
+\par En los \'faltimos a\'f1os no se ha visto ning\'fan }{\fs24\highlight6 
cometa}{\fs24  realmente grandioso pero, dada la imprevisibilidad 
}{\fs24\highlight7 de estos}{\fs24  fen\'f3menos, puede }{\fs24\highlight7 
aparecer}{\fs24 
+ uno fulgurante, en cualquier momento, }{\fs24\highlight4 com surgido de la 
nada}{\fs24 .
+\par 
+\par }\pard\plain \s3\qj 
\li0\ri0\keepn\widctlpar\hyphpar0\aspalpha\aspnum\faauto\outlinelevel2\adjustright\rin0\lin0\itap0
 \b\fs24\lang3082\langfe1024\cgrid\langnp3082\langfenp1024 
{\b0\ul\lang1034\langfe1024\langnp1034 Llegenda
+\par }\pard\plain \qj \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\fs20\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\fs24\lang1034\langfe3082\langnp1034 
+\par }{\fs24\lang1033\langfe3082\chshdng0\chcfpat8\chcbpat6\langnp1033 
XXX}{\fs24\lang1033\langfe3082\langnp1033 - Ambig\'fcitats l\'e8xiques 
+\par }{\fs24\lang1034\langfe3082\chshdng0\chcfpat8\chcbpat4\langnp1034 
XXX}{\fs24\lang1034\langfe3082\langnp1034 - Ambig\'fcitats sint\'e0tiques
+\par 
}{\fs24\lang1034\langfe3082\highlight3\chshdng0\chcfpat8\chcbpat4\langnp1034 
XXX}{\fs24\lang1034\langfe3082\langnp1034 - Ambig\'fcitats 
sint\'e0ctico-sem\'e0ntiques}{\fs24\lang1034\langfe3082\highlight5\chshdng0\chcfpat8\chcbpat7\langnp1034
  
+\par 
}{\fs24\lang1034\langfe3082\highlight7\chshdng0\chcfpat8\chcbpat7\langnp1034 
XXX}{\fs24\lang1034\langfe3082\langnp1034 - Dialectal
+\par 
}{\fs24\lang1034\langfe3082\highlight16\chshdng0\chcfpat8\chcbpat7\langnp1034 
XXX}{\fs24\lang1034\langfe3082\langnp1034 - Estil
+\par }{\fs24\lang1034\langfe3082\langnp1034 
+\par }{\fs24 
+\par }\pard \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
{\b\fs24\lang1034\langfe3082\langnp1034 Text traduit}{
+\par }\pard \qj 
\li0\ri0\nowidctlpar\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\tx9360\tx10080\faauto\rin0\lin0\itap0
 {\b\fs24\lang1034\langfe3082\langnp1034 
+\par }\pard \ql 
\li0\ri0\nowidctlpar\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\tx9360\tx10080\faauto\rin0\lin0\itap0
 {\fs24\lang1034\langfe3082\highlight4\langnp1034 La visi\'f3 d'un gran}{
+\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
cometa/estel}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 \'e9s 
fascinant}{\fs24\lang1034\langfe3082\langnp1034 . }{
+\fs24\lang1034\langfe3082\highlight4\langnp1034 No 
obstant}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
/aix\'f2}{\fs24\lang1034\langfe3082\langnp1034 , 
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 els}{
+\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
cometes/estels}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 s\'f3n una simple aparen\'e7a 
m\'e9
+s que una realitat substancial: unes \'93boles de neu bruta\'94 o uns blocs de 
gel de pocs quil\'f2metres de di\'e0metre que van quedar com a residus en el 
proc\'e9s}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 
+de}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
naixement/naixenca}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 del sistema solar.}{
+\par }{\fs24\lang1034\langfe3082\langnp1034 
+\par }{\fs24\lang1034\langfe3082\highlight4\langnp1034 La llarga \'f2rbita 
oval dels}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
cometes/estels}{\fs24\lang1034\langfe3082\langnp1034  }{
+\fs24\lang1034\langfe3082\highlight6\langnp1034 
els}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 a prop al Sol i torna a 
allunyar-los. A l'aproximar-se a l'estrela mare, 
la}{\fs24\lang1034\langfe3082\langnp1034 
+ }{\fs24\lang1034\langfe3082\highlight5\langnp1034 
seua/seva}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 gelada superf\'edcie 
s'evapora formant un gran cap, que el vent solar est\'e9n en una llarga cua.}{
+\fs24\lang1034\langfe3082\langnp1034 
+\par }{
+\par }{\fs24\lang1034\langfe3082\highlight5\langnp1034 
El/}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight6\langnp1034 
Dit}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 
+vent arrossega cap a}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
arrere/endarrere}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 el gas}{
+\fs24\lang1034\langfe3082\langnp1034 , 
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
junt/juntament}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 amb part\'edcules de pols}{
+\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
arrabassada/arravassades}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 en l'evaporaci\'f3
+, formant un parell de cues que creixen a mesura 
que}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 
el}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 cometa/estel}{
+\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
rodeja/envolta}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 el Sol, 
fins}{\fs24\lang1034\langfe3082\langnp1034  }{
+\fs24\lang1034\langfe3082\highlight5\langnp1034 a aconseguir els /arribar a 
els}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 100 milions de 
km.}{\fs24\lang1034\langfe3082\langnp1034 
+\par }{
+\par }{\fs24\lang1034\langfe3082\highlight4\langnp1034 Al retrocedir 
el}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
cometa/estel}{\fs24\lang1034\langfe3082\langnp1034 , }{
+\fs24\lang1034\langfe3082\highlight4\langnp1034 la cua torna 
a}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
encollir-se/encongir-se}{\fs24\lang1034\langfe3082\langnp1034 . }{
+\fs24\lang1034\langfe3082\highlight4\langnp1034 Entre les classes 
de}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
cometes/estels}{\fs24\lang1034\langfe3082\langnp1034 , }{
+\fs24\lang1034\langfe3082\highlight4\langnp1034 hi ha uns que es caracteritzen 
pel fet que la}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
seua/seva}{\fs24\lang1034\langfe3082\langnp1034  }{
+\fs24\lang1034\langfe3082\highlight4\langnp1034 \'f2rbita \'e9s tan gran 
que}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
tarden/triguen}{\fs24\lang1034\langfe3082\langnp1034  }{
+\fs24\lang1034\langfe3082\highlight4\langnp1034 milions d'anys 
a}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
rodejar/envoltar}{\fs24\lang1034\langfe3082\langnp1034  }{
+\fs24\lang1034\langfe3082\highlight4\langnp1034 el Sol. 
Els}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
cometes/estels}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 
+de per\'edode llarg}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
tarden/triguen}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 m\'e9s de 200 anys a 
completar una \'f2
+rbita. Finalment, els de per\'edode curt 
estan}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 atrapats per la gravetat dels 
planetes i orbiten el Sol amb relativa 
rapidesa.}{\fs24\lang1034\langfe3082\langnp1034 
+
+\par }{
+\par }{\fs24\lang1034\langfe3082\highlight4\langnp1034 S'ignora on s'originen 
els}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
cometes/estels}{\fs24\lang1034\langfe3082\langnp1034  }{
+\fs24\lang1034\langfe3082\highlight4\langnp1034 , 
per\'f2}{\fs24\lang1034\langfe3082\langnp1034 , 
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 a/si s\rquote ha 
de}{\fs24\lang1034\langfe3082\langnp1034  }{
+\fs24\lang1034\langfe3082\highlight4\langnp1034 jutjar per 
les}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
seues/seves}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 
+llargues \'f2rbites, el seu lloc de proced\'e8ncia est\'e0 molt m\'e9s 
enll\'e0 dels planetes coneguts.}{
+\par }\pard \qj 
\li0\ri0\nowidctlpar\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\tx9360\tx10080\faauto\rin0\lin0\itap0
 {\fs24\lang1034\langfe3082\langnp1034  }{
+\par }\pard \ql 
\li0\ri0\nowidctlpar\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\tx9360\tx10080\faauto\rin0\lin0\itap0
 {\fs24\lang1034\langfe3082\highlight4\langnp1034 En els \'faltims anys no s'ha 
vist cap}{
+\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
cometa/estel}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight4\langnp1034 realment grandi\'f3s per\'f2, 
donada la}{
+\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight6\langnp1034 
imprevisibilidad}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
d'estos/aquests}{\fs24\lang1034\langfe3082\langnp1034  }{
+\fs24\lang1034\langfe3082\highlight4\langnp1034 fen\'f2mens, 
pot}{\fs24\lang1034\langfe3082\langnp1034  
}{\fs24\lang1034\langfe3082\highlight5\langnp1034 
apar\'e9ixer/apar\'e8ixer}{\fs24\lang1034\langfe3082\langnp1034  }{
+\fs24\lang1034\langfe3082\highlight4\langnp1034 un fulgurant, en qualsevol 
moment, com sorgit del no-res.}{\fs24\lang1034\langfe3082\langnp1034 
+\par 
+\par }\pard\plain \s3\qj 
\li0\ri0\keepn\widctlpar\hyphpar0\aspalpha\aspnum\faauto\outlinelevel2\adjustright\rin0\lin0\itap0
 \b\fs24\lang3082\langfe1024\cgrid\langnp3082\langfenp1024 
{\b0\ul\lang1034\langfe1024\langnp1034 Llegenda
+\par }\pard\plain \qj \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\fs20\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\fs24\lang1034\langfe3082\langnp1034 
+\par }{\fs24\lang1034\langfe3082\chshdng0\chcfpat8\chcbpat6\langnp1034 
XXX}{\fs24\lang1034\langfe3082\langnp1034 - errada coincident amb ambd\'f3s 
traductors
+\par }{\fs24\lang1033\langfe3082\chshdng0\chcfpat8\chcbpat4\langnp1033 
XXX}{\fs24\lang1033\langfe3082\langnp1033 - encert coincident  amb ambd\'f3s 
traductors
+\par 
}{\fs24\lang1033\langfe3082\highlight5\chshdng0\chcfpat8\chcbpat7\langnp1033 
XXX}{\fs24\lang1034\langfe3082\langnp1034 - Solucions diferents
+\par }\pard\plain \s22\ql 
\li0\ri0\nowidctlpar\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\tx9360\tx10080\faauto\rin0\lin0\itap0
 \fs20\lang3082\langfe3082\super\cgrid\langnp3082\langfenp3082 {
+\lang1034\langfe3082\nosupersub\langnp1034 
+\par }{\fs24\ul\lang1034\langfe3082\nosupersub\langnp1034 Notes
+\par }{\fs24\lang1034\langfe3082\nosupersub\langnp1034 \line - En cas de 
solucions diferents, la primera pertanya  al Salt i la segona a l\rquote 
Internostrum
+\par - En cas de paraules afegides el costat dret o esquerre de la barra / 
apareix buit, indicant que l\rquote altre traductor no ha incl\'f2s aquest mot.
+\par 
+\par }{\lang1034\langfe3082\nosupersub\langnp1034 
+\par }\pard\plain \ql \li0\ri0\nowidctlpar\faauto\rin0\lin0\itap0 
\fs20\lang3082\langfe3082\cgrid\langnp3082\langfenp3082 
{\b\fs24\ul\lang1034\langfe3082\langnp1034 4. Conclusi\'f3}{
+\par }\pard\plain \s22\ql 
\li0\ri15346071728\nowidctlpar\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\tx9360\tx10080\faauto\rin0\lin0\itap-4
 \fs21\lang67621623\langfe3082ー\super\cgrid\langnp3082\langfenp3082 {
+\lang1\langfe35850\nosupersub\langnp1034 
+\par 
+\par }{\fs24\lang18446744073709551615\langfe3082\nosupersub\langnp1034 El Salt 
utilitza intensament les formes dialectals valencianes mentre que l\rquote 
Internostrum utilitza el catal\'e0 est\'e0ndard. Per altra banda,  el Salt 
tendeix a fer servir calcs de l\rquote 
+espanyol mentre que l\rquote Internostrum acostuma a decantar-se per les 
formes pr\'f2pies del catal\'e0.
+\par 
+\par Ambd\'f3s sistemes fan una acceptable an\'e0lisis sint\'e0ctica que els 
permet desambiguar bastant casos de forma correcta. En algunes situacions es 
requereix coneixement sem\'e0ntic per poder desambiguar, que ara per ara 
impossible que ho assoleixin.
+
+\par }}
\ No newline at end of file
diff --git a/writerfilter/source/dmapper/DomainMapperTableManager.cxx 
b/writerfilter/source/dmapper/DomainMapperTableManager.cxx
index 1c1a3c10fcde..f5d2a8112ee9 100644
--- a/writerfilter/source/dmapper/DomainMapperTableManager.cxx
+++ b/writerfilter/source/dmapper/DomainMapperTableManager.cxx
@@ -463,6 +463,12 @@ void DomainMapperTableManager::startLevel( )
 
 void DomainMapperTableManager::endLevel( )
 {
+    if (m_aTableGrid.empty())
+    {
+        SAL_WARN("writerfilter.dmapper", "Table stack is empty");
+        return;
+    }
+
     m_aTableGrid.pop_back( );
     m_aGridSpans.pop_back( );
 
diff --git a/writerfilter/source/dmapper/TableManager.cxx 
b/writerfilter/source/dmapper/TableManager.cxx
index c14ec25b0d28..238258ffe15a 100644
--- a/writerfilter/source/dmapper/TableManager.cxx
+++ b/writerfilter/source/dmapper/TableManager.cxx
@@ -251,8 +251,6 @@ void TableManager::endParagraphGroup()
 
     if (mnTableDepth > 0)
     {
-        TableData::Pointer_t pTableData = mTableDataStack.top();
-
         if (isRowEnd())
         {
             endOfRowAction();
diff --git a/writerfilter/source/rtftok/rtfdispatchvalue.cxx 
b/writerfilter/source/rtftok/rtfdispatchvalue.cxx
index 1c0ec1bd8401..11235aaf06f3 100644
--- a/writerfilter/source/rtftok/rtfdispatchvalue.cxx
+++ b/writerfilter/source/rtftok/rtfdispatchvalue.cxx
@@ -198,7 +198,7 @@ RTFError RTFDocumentImpl::dispatchValue(RTFKeyword 
nKeyword, int nParam)
     }
     if (nSprm > 0)
     {
-        LanguageTag aTag((LanguageType)nParam);
+        LanguageTag aTag((LanguageType(static_cast<sal_uInt16>(nParam))));
         auto pValue = std::make_shared<RTFValue>(aTag.getBcp47());
         putNestedAttribute(m_aStates.top().aCharacterSprms, 
NS_ooxml::LN_EG_RPrBase_lang, nSprm, pValue);
         // Language is a character property, but we should store it at a 
paragraph level as well for fields.
commit 843dee0628276c1ca54fbe5a903c5f18f163a2c8
Author: Caolán McNamara <caol...@redhat.com>
Date:   Sat Feb 24 20:43:12 2018 +0000

    forcepoint #8 ensure ColumnDef lifetime
    
    Change-Id: Idb0c7b1530dc57f4d7c14751f1b76caecc3b03a6
    Reviewed-on: https://gerrit.libreoffice.org/50290
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Miklos Vajna <vmik...@collabora.co.uk>
    (cherry picked from commit b434bda77878e87f1eb8efeaab3dd0e5f5c4f420)

diff --git a/hwpfilter/source/hinfo.cxx b/hwpfilter/source/hinfo.cxx
index 26e2847ff048..48a0999b7108 100644
--- a/hwpfilter/source/hinfo.cxx
+++ b/hwpfilter/source/hinfo.cxx
@@ -204,6 +204,7 @@ ParaShape::ParaShape()
     , pspacing_next(0)
     , condense(0)
     , arrange_type(0)
+    , xColdef(new ColumnDef)
     , shade(0)
     , outline(0)
     , outline_continue(0)
@@ -243,17 +244,17 @@ void ParaShape::Read(HWPFile & hwpf)
             return;
         tab.position = tmp16;
     }
-    hwpf.Read1b(&coldef.ncols, 1);
-    hwpf.Read1b(&coldef.separator, 1);
+    hwpf.Read1b(&(xColdef->ncols), 1);
+    hwpf.Read1b(&(xColdef->separator), 1);
     if (!hwpf.Read2b(tmp16))
         return;
-    coldef.spacing = tmp16;
+    xColdef->spacing = tmp16;
     if (!hwpf.Read2b(tmp16))
         return;
-    coldef.columnlen = tmp16;
+    xColdef->columnlen = tmp16;
     if (!hwpf.Read2b(tmp16))
         return;
-    coldef.columnlen0 = tmp16;
+    xColdef->columnlen0 = tmp16;
     hwpf.Read1b(&shade, 1);
     hwpf.Read1b(&outline, 1);
     hwpf.Read1b(&outline_continue, 1);
diff --git a/hwpfilter/source/hinfo.h b/hwpfilter/source/hinfo.h
index 590b5f962e7c..21073f07de51 100644
--- a/hwpfilter/source/hinfo.h
+++ b/hwpfilter/source/hinfo.h
@@ -292,7 +292,7 @@ struct ParaShape
     unsigned char condense;
     unsigned char arrange_type;
     TabSet    tabs[MAXTABS];
-    ColumnDef coldef;
+    std::shared_ptr<ColumnDef> xColdef;
     unsigned char shade;
     unsigned char outline;
     unsigned char outline_continue;
diff --git a/hwpfilter/source/hpara.cxx b/hwpfilter/source/hpara.cxx
index 42baa6814956..f19e12fdb70d 100644
--- a/hwpfilter/source/hpara.cxx
+++ b/hwpfilter/source/hpara.cxx
@@ -125,8 +125,8 @@ bool HWPPara::Read(HWPFile & hwpf, unsigned char flag)
      }
 
     if (nch && !reuse_shape){
-         if( pshape->coldef.ncols > 1 ) {
-             hwpf.SetColumnDef(&(pshape->coldef));
+         if( pshape->xColdef->ncols > 1 ) {
+             hwpf.SetColumnDef(pshape->xColdef);
          }
      }
 
diff --git a/hwpfilter/source/hwpfile.cxx b/hwpfilter/source/hwpfile.cxx
index 326c428d98f7..47b63855f741 100644
--- a/hwpfilter/source/hwpfile.cxx
+++ b/hwpfilter/source/hwpfile.cxx
@@ -405,7 +405,7 @@ ColumnDef *HWPFile::GetColumnDef(int num)
     }
 
     if( it != columnlist.end() )
-        return (*it)->coldef;
+        return (*it)->xColdef.get();
     else
         return nullptr;
 }
@@ -569,12 +569,12 @@ void HWPFile::AddColumnInfo()
     setMaxSettedPage();
 }
 
-void HWPFile::SetColumnDef(ColumnDef *coldef)
+void HWPFile::SetColumnDef(std::shared_ptr<ColumnDef>& rColdef)
 {
     ColumnInfo *cinfo = columnlist.back();
     if( cinfo->bIsSet )
         return;
-    cinfo->coldef = coldef;
+    cinfo->xColdef = rColdef;
     cinfo->bIsSet = true;
 }
 
diff --git a/hwpfilter/source/hwpfile.h b/hwpfilter/source/hwpfile.h
index 3fab3a5b3dd4..c98f90c82fe2 100644
--- a/hwpfilter/source/hwpfile.h
+++ b/hwpfilter/source/hwpfile.h
@@ -70,11 +70,10 @@ class   HStream;
 struct ColumnInfo{
     int start_page;
     bool bIsSet;
-    ColumnDef *coldef;
+    std::shared_ptr<ColumnDef> xColdef;
     explicit ColumnInfo(int num){
         start_page = num;
         bIsSet = false;
-        coldef = nullptr;
     }
 };
 
@@ -211,7 +210,7 @@ class DLLEXPORT HWPFile
         void AddBox(FBox *);
         void AddPage(){ m_nCurrentPage++;}
         void AddColumnInfo();
-        void SetColumnDef(ColumnDef *coldef);
+        void SetColumnDef(std::shared_ptr<ColumnDef>&);
         void AddParaShape(std::shared_ptr<ParaShape>&);
         void AddCharShape(std::shared_ptr<CharShape>&);
         void AddFBoxStyle(FBoxStyle *);
commit 0eeb0c2730ede5236620f379f3761c04984d58d6
Author: Caolán McNamara <caol...@redhat.com>
Date:   Sat Feb 24 19:25:01 2018 +0000

    forcepoint #7 check ksc5601_2uni_page21 bounds
    
    Change-Id: I578e7a63bb50f2088d35174d88f075c00469bad3
    Reviewed-on: https://gerrit.libreoffice.org/50287
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Miklos Vajna <vmik...@collabora.co.uk>
    (cherry picked from commit bdf30af5c2323e6f84e4bea8c7fbbcafa1dc91b3)

diff --git a/hwpfilter/source/hcode.cxx b/hwpfilter/source/hcode.cxx
index 9aaa9e98f04a..606a3dcfcf5e 100644
--- a/hwpfilter/source/hcode.cxx
+++ b/hwpfilter/source/hcode.cxx
@@ -1139,14 +1139,11 @@ int kssm_hangul_to_ucs2(hchar ch, hchar *dest)
 hchar ksc5601_sym_to_ucs2 (hchar input)
 {
     unsigned char ch = sal::static_int_cast<unsigned char>(input >> 8);
-    unsigned char ch2;
-    int idx;
-
-    ch2 = sal::static_int_cast<unsigned char>(input & 0xff);
-    idx = (ch - 0xA1) * 94 + (ch2 - 0xA1);
-    if (idx <= 1114 && idx >= 0){
-    hchar value = ksc5601_2uni_page21[idx];
-    return value ? value :  0x25a1;
+    unsigned char ch2 = sal::static_int_cast<unsigned char>(input & 0xff);
+    int idx = (ch - 0xA1) * 94 + (ch2 - 0xA1);
+    if (idx >= 0 && idx < 
static_cast<int>(SAL_N_ELEMENTS(ksc5601_2uni_page21))) {
+        hchar value = ksc5601_2uni_page21[idx];
+        return value ? value :  0x25a1;
     }
     return 0x25a1;
 }
@@ -1154,15 +1151,12 @@ hchar ksc5601_sym_to_ucs2 (hchar input)
 hchar ksc5601_han_to_ucs2 (hchar input)
 {
     unsigned char ch = sal::static_int_cast<unsigned char>(input >> 8);
-    unsigned char ch2;
-    int idx;
-
-    ch2 = sal::static_int_cast<unsigned char>(input & 0xff);
-    idx = (ch - 0xA1) * 94 + (ch2 - 0xA1);
-    if (idx >= 3854){
-    // Hanja : row 42 - row 93 : 3854 = 94 * (42-1)
-    hchar value = ksc5601_2uni_page21[idx - 3854];
-    return value ? value : '?';
+    unsigned char ch2 = sal::static_int_cast<unsigned char>(input & 0xff);
+    int idx = (ch - 0xA1) * 94 + (ch2 - 0xA1);
+    if (idx >= 3854 && idx < static_cast<int>(3854 + 
SAL_N_ELEMENTS(ksc5601_2uni_page21))) {
+        // Hanja : row 42 - row 93 : 3854 = 94 * (42-1)
+        hchar value = ksc5601_2uni_page21[idx - 3854];
+        return value ? value : '?';
     }
     return '?';
 }
commit cf2e8155471430ef1d37feb94648da56ee93c6b0
Author: ekuiitr <jhaekans...@gmail.com>
Date:   Tue Feb 6 22:49:11 2018 +0530

    tdf#88802 disable arrow if database or table or field not selected
    
    Change-Id: I5a29b58f6e8981ee3de73ccaa83ed04e4ee71dc6
    Reviewed-on: https://gerrit.libreoffice.org/49314
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Julien Nabet <serval2...@yahoo.fr>
    Reviewed-on: https://gerrit.libreoffice.org/50266
    Reviewed-by: Heiko Tietze <tietze.he...@gmail.com>
    (cherry picked from commit d631bc8370fca37a33c51b5a29aca6815760f258)

diff --git a/sw/source/ui/envelp/label1.cxx b/sw/source/ui/envelp/label1.cxx
index e2d3fc066889..152276ba6868 100644
--- a/sw/source/ui/envelp/label1.cxx
+++ b/sw/source/ui/envelp/label1.cxx
@@ -266,7 +266,11 @@ SwLabPage::SwLabPage(vcl::Window* pParent, const 
SfxItemSet& rSet)
     m_pAddrBox->SetClickHdl (LINK(this, SwLabPage, AddrHdl         ));
     m_pDatabaseLB->SetSelectHdl(LINK(this, SwLabPage, DatabaseHdl     ));
     m_pTableLB->SetSelectHdl(LINK(this, SwLabPage, DatabaseHdl     ));
+    m_pDBFieldLB->SetSelectHdl(LINK(this, SwLabPage, DatabaseHdl     ));
     m_pInsertBT->SetClickHdl (LINK(this, SwLabPage, FieldHdl        ));
+    // Disable insert button first,
+    // it'll be enabled if m_pDatabaseLB, m_pTableLB and m_pInsertBT are filled
+    m_pInsertBT->Disable();
     m_pContButton->SetClickHdl (LINK(this, SwLabPage, PageHdl         ));
     m_pSheetButton->SetClickHdl (LINK(this, SwLabPage, PageHdl         ));
     m_pMakeBox->SetSelectHdl(LINK(this, SwLabPage, MakeHdl         ));
@@ -343,7 +347,14 @@ IMPL_LINK( SwLabPage, DatabaseHdl, ListBox&, rListBox, 
void )
     if (&rListBox == m_pDatabaseLB)
         GetDBManager()->GetTableNames(m_pTableLB, sActDBName);
 
-    GetDBManager()->GetColumnNames(m_pDBFieldLB, sActDBName, 
m_pTableLB->GetSelectEntry());
+    if (&rListBox == m_pDatabaseLB || &rListBox == m_pTableLB)
+        GetDBManager()->GetColumnNames(m_pDBFieldLB, sActDBName, 
m_pTableLB->GetSelectEntry());
+
+    if (!m_pDatabaseLB->GetSelectEntry().isEmpty() && 
!m_pTableLB->GetSelectEntry().isEmpty()
+            && !m_pDBFieldLB->GetSelectEntry().isEmpty())
+        m_pInsertBT->Enable(true);
+    else
+        m_pInsertBT->Enable(false);
 }
 
 IMPL_LINK_NOARG(SwLabPage, FieldHdl, Button*, void)
commit 94c2f1b08339bc42d89229f5a8f525032ea1d6da
Author: Caolán McNamara <caol...@redhat.com>
Date:   Fri Feb 23 13:08:16 2018 +0000

    forcepoint #5 null deref
    
    Change-Id: I95b67f98b7028d7ca7c4a9d1c15100e42d359816
    Reviewed-on: https://gerrit.libreoffice.org/50243
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    Tested-by: Jenkins <c...@libreoffice.org>
    (cherry picked from commit 6ba5fc85224b8bb0b8e2a5c5013e83644c622e30)

diff --git a/xmloff/source/text/txtparai.cxx b/xmloff/source/text/txtparai.cxx
index 76d759f37f11..1c0d81d07161 100644
--- a/xmloff/source/text/txtparai.cxx
+++ b/xmloff/source/text/txtparai.cxx
@@ -1528,9 +1528,14 @@ XMLImpSpanContext_Impl::XMLImpSpanContext_Impl(
 
 XMLImpSpanContext_Impl::~XMLImpSpanContext_Impl()
 {
-    if( pHint )
-        pHint->SetEnd( GetImport().GetTextImport()
-                            ->GetCursorAsRange()->getStart() );
+    if (!pHint)
+        return;
+
+    Reference<XTextRange> 
xCrsrRange(GetImport().GetTextImport()->GetCursorAsRange());
+    if (!xCrsrRange.is())
+        return; // Robust (defective file)
+
+    pHint->SetEnd(xCrsrRange->getStart());
 }
 
 SvXMLImportContext *XMLImpSpanContext_Impl::CreateChildContext(
@@ -1926,7 +1931,7 @@ XMLParaContext::~XMLParaContext()
         GetImport().GetTextImport());
     Reference < XTextRange > xCrsrRange( xTxtImport->GetCursorAsRange() );
     if( !xCrsrRange.is() )
-        return; // Robust (defect file)
+        return; // Robust (defective file)
     Reference < XTextRange > xEnd(xCrsrRange->getStart());
 
     // if we have an id set for this paragraph, get a cursor for this
@@ -1952,7 +1957,7 @@ XMLParaContext::~XMLParaContext()
     try {
         xAttrCursor = xTxtImport->GetText()->createTextCursorByRange( xStart );
         if( !xAttrCursor.is() )
-            return; // Robust (defect file)
+            return; // Robust (defective file)
     } catch (const uno::Exception &) {
         // createTextCursorByRange() likes to throw runtime exception, even
         // though it just means 'we were unable to create the cursor'
commit 913dd203b662b8b8b8725acef090109761b1e8a5
Author: Caolán McNamara <caol...@redhat.com>
Date:   Fri Feb 23 12:53:34 2018 +0000

    forcepoint #5 check for short read
    
    a zip file within a structured storage stream. underlying storage stream
    claims larger size that it can satisfy on read
    
    Change-Id: I8516b12df33ad78b2525192826f5e3aef2622eb8
    Reviewed-on: https://gerrit.libreoffice.org/50240
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    Tested-by: Jenkins <c...@libreoffice.org>
    (cherry picked from commit 942e23ac0cf885c8d26884fa1fb17d430f42a5f5)

diff --git a/package/source/zipapi/ZipFile.cxx 
b/package/source/zipapi/ZipFile.cxx
index 3f40df8a0a5f..b855859d4610 100644
--- a/package/source/zipapi/ZipFile.cxx
+++ b/package/source/zipapi/ZipFile.cxx
@@ -821,11 +821,14 @@ sal_Int32 ZipFile::findEND( )
         nEnd = nPos >= 0 ? nPos : 0 ;
 
         aGrabber.seek( nEnd );
-        aGrabber.readBytes ( aBuffer, nLength - nEnd );
+
+        auto nSize = nLength - nEnd;
+        if (nSize != aGrabber.readBytes(aBuffer, nSize))
+            throw ZipException("Zip END signature not found!" );
 
         const sal_Int8 *pBuffer = aBuffer.getConstArray();
 
-        nPos = nLength - nEnd - ENDHDR;
+        nPos = nSize - ENDHDR;
         while ( nPos >= 0 )
         {
             if (pBuffer[nPos] == 'P' && pBuffer[nPos+1] == 'K' && 
pBuffer[nPos+2] == 5 && pBuffer[nPos+3] == 6 )
commit 0b98d9e7e3d37154359142a64e0341eb6cf67373
Author: Caolán McNamara <caol...@redhat.com>
Date:   Sun Feb 18 21:16:06 2018 +0000

    ofz#6450 use the rule name, not the rule itself
    
    Change-Id: I62541dc48b7e9d5a906f32791437a86a8283a7bf
    Reviewed-on: https://gerrit.libreoffice.org/49954
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit 744c267f8f6de0ba4a829874992c1404b5b79e28)

diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index 8d35e28f689a..e292b4690511 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -976,7 +976,7 @@ struct ANLDRuleMap
     OUString msOutlineNumRule;    // WinWord 6 numbering, variant 1
     OUString msNumberingNumRule;  // WinWord 6 numbering, variant 2
     SwNumRule* GetNumRule(SwDoc& rDoc, sal_uInt8 nNumType);
-    void SetNumRule(SwNumRule*, sal_uInt8 nNumType);
+    void SetNumRule(const OUString& rNumRule, sal_uInt8 nNumType);
 };
 
 struct SprmReadInfo;
diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index 659ce0b4c0cd..021cf85b3d94 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -1028,13 +1028,12 @@ SwNumRule *ANLDRuleMap::GetNumRule(SwDoc& rDoc, 
sal_uInt8 nNumType)
     return rDoc.FindNumRulePtr(rNumRule);
 }
 
-void ANLDRuleMap::SetNumRule(SwNumRule *pRule, sal_uInt8 nNumType)
+void ANLDRuleMap::SetNumRule(const OUString& rNumRule, sal_uInt8 nNumType)
 {
-    OUString sNumRule = pRule ? pRule->GetName() : OUString();
     if (WW8_Numbering == nNumType)
-        msNumberingNumRule = sNumRule;
+        msNumberingNumRule = rNumRule;
     else
-        msOutlineNumRule = sNumRule;
+        msOutlineNumRule = rNumRule;
 }
 
 // StartAnl is called at the beginning of a row area that contains
@@ -1106,7 +1105,7 @@ void SwWW8ImplReader::StartAnl(const sal_uInt8* pSprm13)
     m_pCtrlStck->NewAttr(*m_pPaM->GetPoint(),
         SfxStringItem(RES_FLTR_NUMRULE, sNumRule));
 
-    m_aANLDRules.SetNumRule(pNumRule, m_nWwNumType);
+    m_aANLDRules.SetNumRule(sNumRule, m_nWwNumType);
 }
 
 // NextAnlLine() is called once for every row of a
commit 02a5fe7a6c7548f05ef5256e27fcb4ac0fa17c9d
Author: Caolán McNamara <caol...@redhat.com>
Date:   Tue Feb 13 21:16:56 2018 +0000

    ofz#6300 Abrt
    
    Change-Id: I814b0e4255894d909d29a9a301488a23acf418a0
    Reviewed-on: https://gerrit.libreoffice.org/49688
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit 6be2c684effd6732c92df7ef75581772adb6dac3)

diff --git a/filter/source/msfilter/msdffimp.cxx 
b/filter/source/msfilter/msdffimp.cxx
index eed33c576114..995527e73cc7 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -1107,7 +1107,8 @@ void ApplyRectangularGradientAsBitmap( const 
SvxMSDffManager& rManager, SvStream
 {
     Size aBitmapSizePixel( static_cast< sal_Int32 >( ( 
rObjData.aBoundRect.GetWidth() / 2540.0 ) * 90.0 ),      // we will create a 
bitmap with 90 dpi
                            static_cast< sal_Int32 >( ( 
rObjData.aBoundRect.GetHeight() / 2540.0 ) * 90.0 ) );
-    if ( aBitmapSizePixel.Width() && aBitmapSizePixel.Height() && ( 
aBitmapSizePixel.Width() <= 1024 ) && ( aBitmapSizePixel.Height() <= 1024 ) )
+    if (aBitmapSizePixel.Width() > 0 && aBitmapSizePixel.Height() > 0 &&
+        aBitmapSizePixel.Width() <= 1024 && aBitmapSizePixel.Height() <= 1024)
     {
         double fFocusX = rManager.GetPropertyValue( DFF_Prop_fillToRight, 0 ) 
/ 65536.0;
         double fFocusY = rManager.GetPropertyValue( DFF_Prop_fillToBottom, 0 ) 
/ 65536.0;
commit 8590119f660e45810d4c56d4c3451790e4a7efec
Author: Caolán McNamara <caol...@redhat.com>
Date:   Fri Feb 9 10:35:33 2018 +0000

    various sft fixes
    
    backport removing unneeded code
    
    use ptr diff rather than int
    
    (cherry picked from commit 5b426038a7befcaf0d05824ffb20200ff8833ad3)
    
    fix mem leak
    
    (cherry picked from commit 603cb6cf31a5212d03736a552770e5734b0e8066)
    
    check more table sizes
    
    (cherry picked from commit 1828490bb22f1c8273c4a9f5b1db819b173ca70d)
    
    check cmap offset
    
    (cherry picked from commit 683d9883ad8fd6568e6a7832e5bb347c1d043e4b)
    
    check tableoffset against size
    
    (cherry picked from commit ae73c3ff112e1ed38eb4678ac5745990661a2e66)
    
    check ntables offset
    
    (cherry picked from commit 75a171a405afd6eac236af93aa9d29a9c3ec9c64)
    
    use safeint on calculations
    
    (cherry picked from commit 139b6c6cf898467098f3a6f29fa84013a182285f)
    
    simplify returns
    
    (cherry picked from commit e8b2aad1cb2107304761e68aa380b5c29d8ef22f)
    
    extend to cover the last byte needed
    
    (cherry picked from commit c7b0117f26a386c98a721ff3897479c268103d74)
    
    bounds check
    
    (cherry picked from commit bb32616bdd6e3b327654bab0e1d790d8d50b893d)
    
    move largest bounds check to start
    
    (cherry picked from commit f832198e6a33052c7cc86b25843badfb962a2ae8)
    
    android:update safeint header to use the else implementation with clang
    
    Clang toolchain does not defines the __builtin_mul_overflow for 32-bit
    ARM. So, fallback to else implementation of checked_multiply when
    building Android with Clang
    
    Reviewed-on: https://gerrit.libreoffice.org/39005
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Miklos Vajna <vmik...@collabora.co.uk>
    (cherry picked from commit 2149d4a88e9dc88c30e7475f8ea317e5c7b78529)
    
    add checked_add
    
    Reviewed-on: https://gerrit.libreoffice.org/43779
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 9cfb27ae6cb94f0a853ff70e9ad9f3109d305a94)
    
    Change-Id: I0b59f1b93d31a7cb5b8db2a21736db11aed46536
    a174fd94c57cc3c899c10e1c0dc5968965a50427
    0d329357ac282d4652b0f7ebc401cbd51963461b
    004a6d322f60d916cc4635b362ce948e8a10d7c7
    5aae26c38f3645020f0e1d6d7b6877c2727af1b4
    a79be052dd3f6b6ed38fb326558924c853af5fff
    d75f5f4b578fd176c17e5763569f1403260c6594
    c063786ba41aa9a985f505e62b43d3d543a0d48f
    1a67cb2f1c686032438852fec1267a59fbd04d7f
    5177d42b47a4bca614878dce4a69ab16b5cfe163
    6d32a6b6f1dd91db42a3f154700ea55603f0e4dd
    03fe80f9568759b829fac4e9bcfd496efebe6a26
    6120606f521ce121541a5b7f1150229258012d55
    10cba898bba528f5f1bfbd583e27a6821c789ab9
    Reviewed-on: https://gerrit.libreoffice.org/49485
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    Tested-by: Jenkins <c...@libreoffice.org>
    
    (cherry picked from commit 9826e506a64260d577d463fe49fe46d1e10848e6)

diff --git a/include/o3tl/safeint.hxx b/include/o3tl/safeint.hxx
index ce144d22d9ea..5ebf353b6bd6 100644
--- a/include/o3tl/safeint.hxx
+++ b/include/o3tl/safeint.hxx
@@ -29,13 +29,23 @@ template<typename T> inline bool checked_multiply(T a, T b, 
T& result)
     return !msl::utilities::SafeMultiply(a, b, result);
 }
 
-#elif (defined __GNUC__ && __GNUC__ >= 5) || 
(__has_builtin(__builtin_mul_overflow))
+template<typename T> inline bool checked_add(T a, T b, T& result)
+{
+    return !msl::utilities::SafeAdd(a, b, result);
+}
+
+#elif (defined __GNUC__ && __GNUC__ >= 5) || 
(__has_builtin(__builtin_mul_overflow) && !(defined ANDROID && defined 
__clang__))
 
 template<typename T> inline bool checked_multiply(T a, T b, T& result)
 {
     return __builtin_mul_overflow(a, b, &result);
 }
 
+template<typename T> inline bool checked_add(T a, T b, T& result)
+{
+    return __builtin_add_overflow(a, b, &result);
+}
+
 #else
 
 
//https://www.securecoding.cert.org/confluence/display/c/INT32-C.+Ensure+that+operations+on+signed+integers+do+not+result+in+overflow
@@ -80,6 +90,31 @@ template<typename T> inline typename 
std::enable_if<std::is_unsigned<T>::value,
     return false;
 }
 
+//https://www.securecoding.cert.org/confluence/display/c/INT32-C.+Ensure+that+operations+on+signed+integers+do+not+result+in+overflow
+template<typename T> inline typename std::enable_if<std::is_signed<T>::value, 
bool>::type checked_add(T a, T b, T& result)
+{
+    if (((b > 0) && (a > (std::numeric_limits<T>::max() - b))) ||
+        ((b < 0) && (a < (std::numeric_limits<T>::min() - b)))) {
+        return true;
+    }
+
+    result = a + b;
+
+    return false;
+}
+
+//https://www.securecoding.cert.org/confluence/display/c/INT30-C.+Ensure+that+unsigned+integer+operations+do+not+wrap
+template<typename T> inline typename 
std::enable_if<std::is_unsigned<T>::value, bool>::type checked_add(T a, T b, T& 
result)
+{
+    if (std::numeric_limits<T>::max() - a < b) {
+        return true;/* Handle error */
+    }
+
+    result = a + b;
+
+    return false;
+}
+
 #endif
 
 }
diff --git a/vcl/inc/sft.hxx b/vcl/inc/sft.hxx
index 2efe115c7ccd..a000c59443f8 100644
--- a/vcl/inc/sft.hxx
+++ b/vcl/inc/sft.hxx
@@ -190,19 +190,12 @@ namespace vcl
         int   descender;          /**< typographic descent.                    
                */
         int   linegap;            /**< typographic line gap.\ Negative values 
are treated as
                                      zero in Win 3.1, System 6 and System 7.   
              */
-        int   vascent;            /**< typographic ascent for vertical writing 
mode            */
-        int   vdescent;           /**< typographic descent for vertical 
writing mode           */
         int   typoAscender;       /**< OS/2 portable typographic ascender      
                */
         int   typoDescender;      /**< OS/2 portable typographic descender     
                */
         int   typoLineGap;        /**< OS/2 portable typographic line gap      
                 */
         int   winAscent;          /**< ascender metric for Windows             
                */
         int   winDescent;         /**< descender metric for Windows            
                */
         bool  symbolEncoded;      /**< true: MS symbol encoded */
-        int   rangeFlag;          /**< if set to 1 Unicode Range flags are 
applicable          */
-        sal_uInt32 ur1;           /**< bits 0 - 31 of Unicode Range flags      
                */
-        sal_uInt32 ur2;           /**< bits 32 - 63 of Unicode Range flags     
                */
-        sal_uInt32 ur3;           /**< bits 64 - 95 of Unicode Range flags     
                */
-        sal_uInt32 ur4;           /**< bits 96 - 127 of Unicode Range flags    
                */
         sal_uInt8  panose[10];    /**< PANOSE classification number            
                */
         sal_uInt32 typeFlags;     /**< type flags (copyright bits + 
PS-OpenType flag)       */
         sal_uInt16 fsSelection;   /**< OS/2 fsSelection */
@@ -537,8 +530,6 @@ namespace vcl
 /*- private definitions */
 
     struct TrueTypeFont {
-        sal_uInt32 tag;
-
         char        *fname;
         sal_Int32   fsize;
         sal_uInt8   *ptr;
diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 52e9cf540fd3..a12ad83dccec 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -39,7 +39,7 @@
 #include "xlat.hxx"
 #include <rtl/crc.h>
 #include <rtl/ustring.hxx>
-
+#include <o3tl/safeint.hxx>
 #include <osl/endian.h>
 #include <algorithm>
 
@@ -104,9 +104,6 @@ typedef struct {
     sal_uInt32 *offs;             /* array of nGlyphs offsets */
 } GlyphOffsets;
 
-/* private tags */
-static const sal_uInt32 TTFontClassTag = 0x74746663;  /* 'ttfc' */
-
 static const sal_uInt32 T_true = 0x74727565;        /* 'true' */
 static const sal_uInt32 T_ttcf = 0x74746366;        /* 'ttcf' */
 static const sal_uInt32 T_otto = 0x4f54544f;        /* 'OTTO' */
@@ -1328,6 +1325,13 @@ static void FindCmap(TrueTypeFont *ttf)
     }
 
     if (ttf->cmapType != CMAP_NOT_USABLE) {
+        if( (ttf->cmap - ttf->ptr + 2U) > static_cast<sal_uInt32>(ttf->fsize) 
) {
+            ttf->cmapType = CMAP_NOT_USABLE;
+            ttf->cmap = nullptr;
+        }
+    }
+
+    if (ttf->cmapType != CMAP_NOT_USABLE) {
         switch (GetUInt16(ttf->cmap, 0)) {
             case 0: ttf->mapper = getGlyph0; break;
             case 2: ttf->mapper = getGlyph2; break;
@@ -1448,7 +1452,6 @@ static void allocTrueTypeFont( TrueTypeFont** ttf )
     *ttf = static_cast<TrueTypeFont*>(calloc(1,sizeof(TrueTypeFont)));
     if( *ttf != nullptr )
     {
-        (*ttf)->tag = 0;
         (*ttf)->fname = nullptr;
         (*ttf)->fsize = -1;
         (*ttf)->ptr = nullptr;
@@ -1533,10 +1536,41 @@ int OpenTTFontBuffer(const void* pBuffer, sal_uInt32 
nLen, sal_uInt32 facenum, T
     return doOpenTTFont( facenum, *ttf );
 }
 
+namespace {
+
+bool withinBounds(sal_uInt32 tdoffset, sal_uInt32 moreoffset, sal_uInt32 len, 
sal_uInt32 available)
+{
+    sal_uInt32 result;
+    if (o3tl::checked_add(tdoffset, moreoffset, result))
+        return false;
+    if (o3tl::checked_add(result, len, result))
+        return false;
+    return result <= available;
+}
+
+class TTFontCloser
+{
+    TrueTypeFont* m_font;
+public:
+    TTFontCloser(TrueTypeFont* t)
+        : m_font(t)
+    {
+    }
+    void clear() { m_font = nullptr; }
+    ~TTFontCloser()
+    {
+        if (m_font)
+            CloseTTFont(m_font);
+    }
+};
+
+}
+
 static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
 {
+    TTFontCloser aCloseGuard(t);
+
     if (t->fsize < 4) {
-        CloseTTFont(t);
         return SF_TTFORMAT;
     }
     int i;
@@ -1550,27 +1584,28 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
     } else if (TTCTag == T_otto) {                         /* PS-OpenType font 
*/
         tdoffset = 0;
     } else if (TTCTag == T_ttcf) {                         /* TrueType 
collection */
+        if (!withinBounds(12, 4 * facenum, sizeof(sal_uInt32), t->fsize)) {
+            return SF_FONTNO;
+        }
         sal_uInt32 Version = GetUInt32(t->ptr, 4);
         if (Version != 0x00010000 && Version != 0x00020000) {
-            CloseTTFont(t);
             return SF_TTFORMAT;
         }
         if (facenum >= GetUInt32(t->ptr, 8)) {
-            CloseTTFont(t);
             return SF_FONTNO;
         }
         tdoffset = GetUInt32(t->ptr, 12 + 4 * facenum);
     } else {
-        CloseTTFont(t);
         return SF_TTFORMAT;
     }
 
-    /* magic number */
-    t->tag = TTFontClassTag;
+    if (withinBounds(tdoffset, 0, 4 + sizeof(sal_uInt16), t->fsize)) {
+        t->ntables = GetUInt16(t->ptr + tdoffset, 4);
+    }
 
-    t->ntables = GetUInt16(t->ptr + tdoffset, 4);
-    if( t->ntables >= 128 )
+    if (t->ntables >= 128 || t->ntables == 0) {
         return SF_TTFORMAT;
+    }
 
     t->tables = static_cast<const sal_uInt8**>(calloc(NUM_TAGS, 
sizeof(sal_uInt8 *)));
     assert(t->tables != nullptr);
@@ -1582,7 +1617,7 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
         int nIndex;
         const sal_uInt32 nStart = tdoffset + 12;
         const sal_uInt32 nOffset = 16 * i;
-        if (nStart + nOffset + sizeof(sal_uInt32) <=  
static_cast<sal_uInt32>(t->fsize))
+        if (withinBounds(nStart, nOffset, sizeof(sal_uInt32), t->fsize))
             tag = GetUInt32(t->ptr + nStart, nOffset);
         else
             tag = static_cast<sal_uInt32>(-1);
@@ -1607,9 +1642,10 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
             case T_CFF:  nIndex = O_CFF; break;
             default: nIndex = -1; break;
         }
-        if( nIndex >= 0 ) {
-            sal_uInt32 nTableOffset = GetUInt32(t->ptr + tdoffset + 12, 16 * i 
+ 8);
-            length = GetUInt32(t->ptr + tdoffset + 12, 16 * i + 12);
+
+        if ((nIndex >= 0) && withinBounds(nStart, nOffset, 12 + 
sizeof(sal_uInt32), t->fsize)) {
+            sal_uInt32 nTableOffset = GetUInt32(t->ptr + nStart, nOffset + 8);
+            length = GetUInt32(t->ptr + nStart, nOffset + 12);
             t->tables[nIndex] = t->ptr + nTableOffset;
             t->tlens[nIndex] = length;
         }
@@ -1618,8 +1654,9 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
     /* Fixup offsets when only a TTC extract was provided */
     if( facenum == (sal_uInt32)~0 ) {
         sal_uInt8* pHead = const_cast<sal_uInt8*>(t->tables[O_head]);
-        if( !pHead )
+        if (!pHead) {
             return SF_TTFORMAT;
+        }
         /* limit Head candidate to TTC extract's limits */
         if( pHead > t->ptr + (t->fsize - 54) )
             pHead = t->ptr + (t->fsize - 54);
@@ -1635,8 +1672,9 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
                 break;
             }
         }
-        if( p <= t->ptr )
+        if (p <= t->ptr) {
             return SF_TTFORMAT;
+        }
     }
 
     /* Check the table offsets after TTC correction */
@@ -1658,7 +1696,7 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
         }
         else if( const_cast<sal_uInt8*>(t->tables[i]) + t->tlens[i] > t->ptr + 
t->fsize )
         {
-            int nMaxLen = (t->ptr + t->fsize) - t->tables[i];
+            sal_PtrDiff nMaxLen = (t->ptr + t->fsize) - t->tables[i];
             if( nMaxLen < 0 )
                 nMaxLen = 0;
             t->tlens[i] = nMaxLen;
@@ -1676,7 +1714,6 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
      */
 
     if( !(getTable(t, O_maxp) && getTable(t, O_head) && getTable(t, O_name) && 
getTable(t, O_cmap)) ) {
-        CloseTTFont(t);
         return SF_TTFORMAT;
     }
 
@@ -1687,14 +1724,12 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
     table = getTable(t, O_head);
     table_size = getTableSize(t, O_head);
     if (table_size < 52) {
-        CloseTTFont(t);
         return SF_TTFORMAT;
     }
     t->unitsPerEm = GetUInt16(table, 18);
     int indexfmt = GetInt16(table, 50);
 
     if( ((indexfmt != 0) && (indexfmt != 1)) || (t->unitsPerEm <= 0) ) {
-        CloseTTFont(t);
         return SF_TTFORMAT;
     }
 
@@ -1718,7 +1753,6 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
         /* TODO: implement to get subsetting */
         assert(t->goffsets != nullptr);
     } else {
-        CloseTTFont(t);
         return SF_TTFORMAT;
     }
 
@@ -1735,6 +1769,8 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
     GetKern(t);
     ReadGSUB( t, 0, 0 );
 
+    aCloseGuard.clear();
+
     return SF_OK;
 }
 
@@ -2605,13 +2641,6 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, 
TTGlobalFontInfo *info)
             if( info->winDescent > 5*UPEm )
                 info->winDescent = XUnits(UPEm, GetInt16(table, 76));
         }
-        if (ttf->cmapType == CMAP_MS_Unicode) {
-            info->rangeFlag = 1;
-            info->ur1 = GetUInt32(table, 42);
-            info->ur2 = GetUInt32(table, 46);
-            info->ur3 = GetUInt32(table, 50);
-            info->ur4 = GetUInt32(table, 54);
-        }
         memcpy(info->panose, table + 32, 10);
         info->typeFlags = GetUInt16( table, 8 );
         if( getTable(ttf, O_CFF) )
@@ -2625,24 +2654,24 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, 
TTGlobalFontInfo *info)
     }
 
     table = getTable(ttf, O_head);      /* 'head' tables is always there */
-    info->xMin = XUnits(UPEm, GetInt16(table, 36));
-    info->yMin = XUnits(UPEm, GetInt16(table, 38));
-    info->xMax = XUnits(UPEm, GetInt16(table, 40));
-    info->yMax = XUnits(UPEm, GetInt16(table, 42));
-    info->macStyle = GetInt16(table, 44);
+    table_size = getTableSize(ttf, O_head);
+    if (table_size >= 46) {
+        info->xMin = XUnits(UPEm, GetInt16(table, 36));
+        info->yMin = XUnits(UPEm, GetInt16(table, 38));
+        info->xMax = XUnits(UPEm, GetInt16(table, 40));
+        info->yMax = XUnits(UPEm, GetInt16(table, 42));
+        info->macStyle = GetInt16(table, 44);
+    }
 
     table = getTable(ttf, O_hhea);
-    if (table) {
+    table_size = getTableSize(ttf, O_hhea);
+    if (table && table_size >= 10) {
         info->ascender  = XUnits(UPEm, GetInt16(table, 4));
         info->descender = XUnits(UPEm, GetInt16(table, 6));
         info->linegap   = XUnits(UPEm, GetInt16(table, 8));
     }
 
     table = getTable(ttf, O_vhea);
-    if (table) {
-        info->vascent  = XUnits(UPEm, GetInt16(table, 4));
-        info->vdescent = XUnits(UPEm, GetInt16(table, 6));
-    }
 }
 
 GlyphData *GetTTRawGlyphData(TrueTypeFont *ttf, sal_uInt32 glyphID)
commit 0c98cfe6159f4c3b4d980d81e3c19b591c29f9a1
Author: Caolán McNamara <caol...@redhat.com>
Date:   Fri Feb 9 10:49:39 2018 +0000

    ofz#6173 check index before use
    
    Change-Id: I09d15ab324af0a8b3566f11868eb3266a68c4afe
    Reviewed-on: https://gerrit.libreoffice.org/49500
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit e355d7d691cfe9719b06e15129d86ec22a2bd7a4)

diff --git a/sw/source/filter/ww8/ww8toolbar.cxx 
b/sw/source/filter/ww8/ww8toolbar.cxx
index 15c0abb63c94..3686a73b3a5a 100644
--- a/sw/source/filter/ww8/ww8toolbar.cxx
+++ b/sw/source/filter/ww8/ww8toolbar.cxx
@@ -167,7 +167,9 @@ bool SwCTBWrapper::Read( SvStream& rS )
     std::vector< sal_Int16 >::iterator it_end = dropDownMenuIndices.end();
     for ( std::vector< sal_Int16 >::iterator it = dropDownMenuIndices.begin(); 
it != it_end; ++it )
     {
-        rCustomizations[ *it ].bIsDroppedMenuTB = true;
+        if (*it < 0 || static_cast<size_t>(*it) >= rCustomizations.size())
+            continue;
+        rCustomizations[*it].bIsDroppedMenuTB = true;
     }
     return rS.good();
 }
commit 42c15701158271aa1920d3a85a3e57872d7c4a90
Author: Caolán McNamara <caol...@redhat.com>
Date:   Wed Feb 7 15:50:35 2018 +0000

    check O_head size
    
    Change-Id: Idf5d30eaed0196cfa9266e35131c538c606a0960
    Reviewed-on: https://gerrit.libreoffice.org/49365
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit b10ae2faae6f3c448bbab71585550387e18cc248)
    Reviewed-on: https://gerrit.libreoffice.org/49367
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit 9c8fb5055e49f31a179477937f7820f34a04ca33)

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 2a47232e34d7..52e9cf540fd3 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1542,7 +1542,6 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
     int i;
     sal_uInt32 length, tag;
     sal_uInt32 tdoffset = 0;        /* offset to TableDirectory in a TTC file. 
For TTF files is 0 */
-    int indexfmt;
 
     sal_uInt32 TTCTag = GetInt32(t->ptr, 0);
 
@@ -1686,8 +1685,13 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
     t->nglyphs = table_size >= 6 ? GetUInt16(table, 4) : 0;
 
     table = getTable(t, O_head);
+    table_size = getTableSize(t, O_head);
+    if (table_size < 52) {
+        CloseTTFont(t);
+        return SF_TTFORMAT;
+    }
     t->unitsPerEm = GetUInt16(table, 18);
-    indexfmt = GetInt16(table, 50);
+    int indexfmt = GetInt16(table, 50);
 
     if( ((indexfmt != 0) && (indexfmt != 1)) || (t->unitsPerEm <= 0) ) {
         CloseTTFont(t);
commit 67884703c09faf0d9c991b326e1e7741fba97a21
Author: Caolán McNamara <caol...@redhat.com>
Date:   Wed Feb 7 16:44:43 2018 +0000

    check O_hhea and O_vhea sizes
    
    Change-Id: I82e47732815f0112801c8c3a3e5b0b09ac25610a
    Reviewed-on: https://gerrit.libreoffice.org/49439
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    Tested-by: Jenkins <c...@libreoffice.org>
    (cherry picked from commit e3308146244efb1985e1d84a5ddfb8ac1754d5c5)

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 11620beda5ae..2a47232e34d7 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1535,8 +1535,10 @@ int OpenTTFontBuffer(const void* pBuffer, sal_uInt32 
nLen, sal_uInt32 facenum, T
 
 static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
 {
-    if (t->fsize < 4)
+    if (t->fsize < 4) {
+        CloseTTFont(t);
         return SF_TTFORMAT;
+    }
     int i;
     sal_uInt32 length, tag;
     sal_uInt32 tdoffset = 0;        /* offset to TableDirectory in a TTC file. 
For TTF files is 0 */
@@ -1717,10 +1719,12 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
     }
 
     table = getTable(t, O_hhea);
-    t->numberOfHMetrics = (table != nullptr) ? GetUInt16(table, 34) : 0;
+    table_size = getTableSize(t, O_hhea);
+    t->numberOfHMetrics = (table && table_size >= 36) ? GetUInt16(table, 34) : 
0;
 
     table = getTable(t, O_vhea);
-    t->numOfLongVerMetrics = (table != nullptr) ? GetUInt16(table, 34) : 0;
+    table_size = getTableSize(t, O_vhea);
+    t->numOfLongVerMetrics = (table && table_size >= 36) ? GetUInt16(table, 
34) : 0;
 
     GetNames(t);
     FindCmap(t);
commit d563e2dd11b0baf88466e600da62c478d1cb6add
Author: Caolán McNamara <caol...@redhat.com>
Date:   Wed Feb 7 15:33:36 2018 +0000

    check table size before reading nglyphs
    
    Change-Id: Ib511fdf16006877ca76085137eb9200601b2f8f7
    Reviewed-on: https://gerrit.libreoffice.org/49363
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit 08dd51bfcaa6b493e134bcc7787cc18c36ad5db1)
    Reviewed-on: https://gerrit.libreoffice.org/49436
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit 419361ac5c0eacfb1c766a4fa042a6000d96ba7d)

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index dd134305bc95..11620beda5ae 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1680,7 +1680,8 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
     }
 
     const sal_uInt8* table = getTable(t, O_maxp);
-    t->nglyphs = GetUInt16(table, 4);
+    sal_uInt32 table_size = getTableSize(t, O_maxp);
+    t->nglyphs = table_size >= 6 ? GetUInt16(table, 4) : 0;
 
     table = getTable(t, O_head);
     t->unitsPerEm = GetUInt16(table, 18);
commit a1eb200e14c21882df3f8f7c4f1607014e029c39
Author: Caolán McNamara <caol...@redhat.com>
Date:   Thu Feb 8 17:05:11 2018 +0000

    ofz#6112 wrong start off sets for korean KSC5601 table
    
    Change-Id: If986352478f34f54015f1969c97c26e2ef05c06c
    Reviewed-on: https://gerrit.libreoffice.org/49446
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Stephan Bergmann <sberg...@redhat.com>
    (cherry picked from commit a704756d92d0dcb4822e7115a293192378151859)

diff --git a/sal/textenc/tcvtkr6.tab b/sal/textenc/tcvtkr6.tab
index fab6c6131a5f..776c15dbcf5e 100644
--- a/sal/textenc/tcvtkr6.tab
+++ b/sal/textenc/tcvtkr6.tab
@@ -401,13 +401,13 @@ static ImplUniToDBCSHighTab const 
aKSC5601DBCSHighTab[256] =
     { 0x02, 0xFB, aImplUniToDBCSTab_KSC5601_6A },               /* 0x6A */
     { 0x04, 0xEC, aImplUniToDBCSTab_KSC5601_6B },               /* 0x6B */
     { 0x08, 0xF3, aImplUniToDBCSTab_KSC5601_6C },               /* 0x6C */
-    { 0x03, 0xFB, aImplUniToDBCSTab_KSC5601_6D },               /* 0x6D */
+    { 0x0B, 0xFB, aImplUniToDBCSTab_KSC5601_6D },               /* 0x6D */
     { 0x17, 0xFF, aImplUniToDBCSTab_KSC5601_6E },               /* 0x6E */
     { 0x01, 0xFE, aImplUniToDBCSTab_KSC5601_6F },               /* 0x6F */
     { 0x01, 0xFD, aImplUniToDBCSTab_KSC5601_70 },               /* 0x70 */
     { 0x04, 0xFF, aImplUniToDBCSTab_KSC5601_71 },               /* 0x71 */
     { 0x00, 0xFD, aImplUniToDBCSTab_KSC5601_72 },               /* 0x72 */
-    { 0x02, 0xFE, aImplUniToDBCSTab_KSC5601_73 },               /* 0x73 */
+    { 0x0A, 0xFE, aImplUniToDBCSTab_KSC5601_73 },               /* 0x73 */
     { 0x01, 0xF7, aImplUniToDBCSTab_KSC5601_74 },               /* 0x74 */
     { 0x01, 0xFC, aImplUniToDBCSTab_KSC5601_75 },               /* 0x75 */
     { 0x00, 0xFE, aImplUniToDBCSTab_KSC5601_76 },               /* 0x76 */
commit 5bb01ce2f7d57ec117f22d2b2726fab67c68588b
Author: Caolán McNamara <caol...@redhat.com>
Date:   Wed Feb 7 16:20:54 2018 +0000

    return early on short stream
    
    Change-Id: Ia9cb4dec5358281322a2428c5f2153836a1ee1af
    Reviewed-on: https://gerrit.libreoffice.org/49375
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit 43b1e91ec376ae69c843e576cf7352f085d356b6)

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 14f0ec956b20..dd134305bc95 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1535,6 +1535,8 @@ int OpenTTFontBuffer(const void* pBuffer, sal_uInt32 
nLen, sal_uInt32 facenum, T
 
 static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t )
 {
+    if (t->fsize < 4)
+        return SF_TTFORMAT;
     int i;
     sal_uInt32 length, tag;
     sal_uInt32 tdoffset = 0;        /* offset to TableDirectory in a TTC file. 
For TTF files is 0 */
commit 330abe33c290e81ecb383ccb72939ca7957dd490
Author: Caolán McNamara <caol...@redhat.com>
Date:   Wed Feb 7 16:05:08 2018 +0000

    stay within font bounds
    
    Change-Id: Ie8ed610b71cb1b20963827c2be97155d2d8aa22c
    Reviewed-on: https://gerrit.libreoffice.org/49371
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit 358808aeb353e9d17e54c6255dd10be4a7517136)

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index f1fb0d361d01..14f0ec956b20 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1577,7 +1577,12 @@ static int doOpenTTFont( sal_uInt32 facenum, 
TrueTypeFont* t )
     /* parse the tables */
     for (i=0; i<(int)t->ntables; i++) {
         int nIndex;
-        tag = GetUInt32(t->ptr + tdoffset + 12, 16 * i);
+        const sal_uInt32 nStart = tdoffset + 12;
+        const sal_uInt32 nOffset = 16 * i;
+        if (nStart + nOffset + sizeof(sal_uInt32) <=  
static_cast<sal_uInt32>(t->fsize))
+            tag = GetUInt32(t->ptr + nStart, nOffset);
+        else
+            tag = static_cast<sal_uInt32>(-1);
         switch( tag ) {
             case T_maxp: nIndex = O_maxp; break;
             case T_glyf: nIndex = O_glyf; break;
commit 1b86b7bde8a311c40ff4e7384e302d722b2fbf6c
Author: Caolán McNamara <caol...@redhat.com>
Date:   Wed Feb 7 16:51:32 2018 +0000

    what matters is the availability of the last element, not the first
    
    Change-Id: I23d3abdbe62b735d66261fb337613da88cc4206b
    Reviewed-on: https://gerrit.libreoffice.org/49380
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    Tested-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit f975fbf50ef6da9d610885eb7ca46d93ef779481)

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 3d34c9e253b7..f1fb0d361d01 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -2569,7 +2569,8 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, 
TTGlobalFontInfo *info)
     info->symbolEncoded = (ttf->cmapType == CMAP_MS_Symbol);
 
     const sal_uInt8* table = getTable(ttf, O_OS2);
-    if (table) {
+    sal_uInt32 table_size = getTableSize(ttf, O_OS2);
+    if (table && table_size >= 42) {
         info->weight = GetUInt16(table, 4);
         info->width  = GetUInt16(table, 6);
 
@@ -2577,7 +2578,7 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, 
TTGlobalFontInfo *info)
          * Microsoft old (78 bytes long) and Microsoft new (86 bytes long,)
          * Apple's documentation recommends looking at the table length.
          */
-        if (getTableSize(ttf, O_OS2) > 68) {
+        if (table_size >= 78) {
             info->typoAscender = XUnits(UPEm,GetInt16(table, 68));
             info->typoDescender = XUnits(UPEm, GetInt16(table, 70));
             info->typoLineGap = XUnits(UPEm, GetInt16(table, 72));
commit e2bca0ccad594a6db7d8125b7c1960a631092b15
Author: Caolán McNamara <caol...@redhat.com>
Date:   Wed Feb 7 16:57:27 2018 +0000

    check kern table size
    
    Change-Id: I65b5f0a8950d54c00d6fd7c385ca1c5dca2ef2c8
    Reviewed-on: https://gerrit.libreoffice.org/49384
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit d566c200995d2124fb76adc9484cb8ef58ab78ae)

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index 3da8634196b5..3d34c9e253b7 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1355,7 +1355,7 @@ static void GetKern(TrueTypeFont *ttf)
     if( !table )
         goto badtable;
 
-    if (GetUInt16(table, 0) == 0) {                                /* 
Traditional Microsoft style table with sal_uInt16 version and nTables fields */
+    if (nTableSize >= 4 && GetUInt16(table, 0) == 0) { /* Traditional 
Microsoft style table with sal_uInt16 version and nTables fields */
         ttf->nkern = GetUInt16(table, 2);
         ttf->kerntype = KT_MICROSOFT;
         ptr = table + 4;
@@ -1387,7 +1387,7 @@ static void GetKern(TrueTypeFont *ttf)
         return;
     }
 
-    if (GetUInt32(table, 0) == 0x00010000) {                       /* MacOS 
style kern tables: fixed32 version and sal_uInt32 nTables fields */
+    if (nTableSize >= 8 && GetUInt32(table, 0) == 0x00010000) { /* MacOS style 
kern tables: fixed32 version and sal_uInt32 nTables fields */
         ttf->nkern = GetUInt32(table, 4);
         ttf->kerntype = KT_APPLE_NEW;
         ptr = table + 8;
commit ea64796e3dd72bf4ec9c88db9ef9e6be29a4b9e3
Author: Caolán McNamara <caol...@redhat.com>
Date:   Wed Feb 7 12:29:32 2018 +0000

    sanity check cmap table size
    
    Change-Id: I010c2fd221bcd86a62efd9996a0c34930828cb6d
    Reviewed-on: https://gerrit.libreoffice.org/49350
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit a39e2684d48046d18bd486d145b9d4a3d2044e8a)

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index d4a8b5a764a6..3da8634196b5 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -1232,6 +1232,12 @@ static void FindCmap(TrueTypeFont *ttf)
 {
     const sal_uInt8* table = getTable(ttf, O_cmap);
     sal_uInt32 table_size = getTableSize(ttf, O_cmap);
+    if (table_size < 4)
+    {
+        SAL_WARN("vcl.fonts", "Parsing error in " << 
OUString::createFromAscii(ttf->fname) <<
+                 "cmap table size too short");
+        return;
+    }
     sal_uInt16 ncmaps = GetUInt16(table, 2);
     sal_uInt32 AppleUni   = 0;              // Apple Unicode
     sal_uInt32 ThreeZero  = 0;              /* MS Symbol            */
commit f1a707fa9dd3795a38690d88e6eaf3b1553e6837
Author: Caolán McNamara <caol...@redhat.com>
Date:   Tue Feb 6 21:21:30 2018 +0000

    MemoryByteGrabber sequence has to exist for Grabber lifetime
    
    it just takes a c++ ref, so a temp is an unsuitable arg
    
    Change-Id: I40490e94d977df91b985bc4ae458b68ee85d5dfe
    Reviewed-on: https://gerrit.libreoffice.org/49323
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit a224d33cbf098c361a7244569d5088044561f3ee)

diff --git a/package/source/zipapi/ZipFile.cxx 
b/package/source/zipapi/ZipFile.cxx
index fb8fc3db3c66..3f40df8a0a5f 100644
--- a/package/source/zipapi/ZipFile.cxx
+++ b/package/source/zipapi/ZipFile.cxx
@@ -886,7 +886,7 @@ sal_Int32 ZipFile::readCEN()
         if ( static_cast < sal_Int64 > ( nCenLen ) != nRead )
             throw ZipException ("Error reading CEN into memory buffer!" );
 
-        MemoryByteGrabber aMemGrabber ( aCENBuffer );
+        MemoryByteGrabber aMemGrabber(aCENBuffer);
 
         ZipEntry aEntry;
         sal_Int16 nCommentLen;
@@ -998,7 +998,8 @@ void ZipFile::recover()
                 if ( nPos < nBufSize - 30 && pBuffer[nPos] == 'P' && 
pBuffer[nPos+1] == 'K' && pBuffer[nPos+2] == 3 && pBuffer[nPos+3] == 4 )
                 {
                     ZipEntry aEntry;
-                    MemoryByteGrabber aMemGrabber ( Sequence< sal_Int8 >( 
&(pBuffer[nPos+4]), 26 ) );
+                    Sequence<sal_Int8> aTmpBuffer(&(pBuffer[nPos+4]), 26);
+                    MemoryByteGrabber aMemGrabber(aTmpBuffer);
 
                     aEntry.nVersion = aMemGrabber.ReadInt16();
                     if ( ( aEntry.nVersion & 1 ) != 1 )
@@ -1068,7 +1069,8 @@ void ZipFile::recover()
                 else if (pBuffer[nPos] == 'P' && pBuffer[nPos+1] == 'K' && 
pBuffer[nPos+2] == 7 && pBuffer[nPos+3] == 8 )
                 {
                     sal_Int64 nCompressedSize, nSize;
-                    MemoryByteGrabber aMemGrabber ( Sequence< sal_Int8 >( 
&(pBuffer[nPos+4]), 12 ) );
+                    Sequence<sal_Int8> aTmpBuffer(&(pBuffer[nPos+4]), 12);
+                    MemoryByteGrabber aMemGrabber(aTmpBuffer);
                     sal_Int32 nCRC32 = aMemGrabber.ReadInt32();
                     sal_uInt32 nCompressedSize32 = aMemGrabber.ReadUInt32();
                     sal_uInt32 nSize32 = aMemGrabber.ReadUInt32();
commit f931d37c44eb5ce6621614f534bab54491866295
Author: Stephan Bergmann <sberg...@redhat.com>
Date:   Mon Feb 5 17:17:17 2018 +0100

    rhbz#1541486: Fix localized'ness of ooSetupFactoryUIName props
    
    8f44fb5ee0bd21d192820ffd359504f6d1c68a52 "Mark Base window titles for
    localisation" localized some uses of ooSetupFactoryUIName in
    officecfg/registry/data/org/openoffice/Setup.xcu, but failed to mark the 
prop as
    oor:localized="true" in officecfg/registry/schema/org/openoffice/Setup.xcs. 
 (So
    some arbitrary localized version of the prop would win at runtime, 
potentially
    displaying certain window titles in wrong languages.)
    
    Other uses of ooSetupFactoryUIName in Setup.xcu (for "Calc", "Impress",
    "Writer", etc.) have never been localized, and are probably not meant to be
    localized.  AFAICS, irrespective of oor:localized="true" in Setup.xcs, their
    values not being marked with xml:lang="en-US" in Setup.xcu will mean that 
they
    will not appear in
    translations/source/*/officecfg/registry/data/org/openoffice.po and will not
    accidentally start to be translated after this commit.
    
    (Theoretically, inconsistencies between oor:localized in xcs and uses of
    xml:lang in xcu could statically be caught at build time, e.g., with
    officecfg/util/sanity.xsl.  However, those checks work on each XML file
    individually, so don't have the schema information available when looking at
    the data in the xcu file.  And those checks are written in XSLT, which makes
    writing new checks rather, erm, unpleasant.)
    
    Change-Id: I9c61e8ebf75d3d54f7e5b6688eac47a6ed8dc5c3
    Reviewed-on: https://gerrit.libreoffice.org/49252
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Stephan Bergmann <sberg...@redhat.com>
    (cherry picked from commit ffd8369b909c86653ef30593fddf67c9f5308583)
    Reviewed-on: https://gerrit.libreoffice.org/49271
    Reviewed-by: Andras Timar <andras.ti...@collabora.com>
    (cherry picked from commit e9d8b260708bc12e00bf79ff436cb87e12922fab)

diff --git a/officecfg/registry/schema/org/openoffice/Setup.xcs 
b/officecfg/registry/schema/org/openoffice/Setup.xcs
index 3eecf9728b4c..bcb86849226f 100644
--- a/officecfg/registry/schema/org/openoffice/Setup.xcs
+++ b/officecfg/registry/schema/org/openoffice/Setup.xcs
@@ -149,7 +149,7 @@
           <desc>Specifies the short name of the factory.</desc>
         </info>
       </prop>
-      <prop oor:name="ooSetupFactoryUIName" oor:type="xs:string">
+      <prop oor:name="ooSetupFactoryUIName" oor:type="xs:string" 
oor:localized="true">
         <!-- UIHints: setup -->
         <info>
           <desc>Specifies the UI name of the factory.</desc>
commit 476795f929267644985ef52a0ec8e671ea5a226d
Author: Michael Stahl <mst...@redhat.com>
Date:   Fri Feb 2 15:11:25 2018 +0100

    ofz#5435 sw: fix SwCache::Insert() stale pointers
    
    If SwCache::Insert() happens to delete the object that m_pFirst or
    m_pRealFirst point to, which is unlikely as it means every other object
    is locked, then these pointers must be updated.
    
    This sometimes happens in the bugdoc after scrolling around for some
    time.
    
    Change-Id: I13f04d28c37969469efa4e1109c7f5b751ceba96
    Reviewed-on: https://gerrit.libreoffice.org/49151
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit 269d6d3366eea8541d965181dfdda1fdc5ef2d00)
    Reviewed-on: https://gerrit.libreoffice.org/49234
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>
    (cherry picked from commit e6c9b806cd4eaf166bfe8cfc1a4b6741f2be83f0)

diff --git a/sw/source/core/bastyp/swcache.cxx 
b/sw/source/core/bastyp/swcache.cxx
index 964eb96c1324..44fcf28d4102 100644
--- a/sw/source/core/bastyp/swcache.cxx
+++ b/sw/source/core/bastyp/swcache.cxx
@@ -367,16 +367,34 @@ bool SwCache::Insert( SwCacheObj *pNew )
 
         nPos = pObj->GetCachePos();
         if ( pObj == m_pLast )
-        { OSL_ENSURE( pObj->GetPrev(), "Last but no Prev" );
+        {
             m_pLast = pObj->GetPrev();
-            m_pLast->SetNext( nullptr );
+            assert(m_pLast); // must have capacity > 1
         }
-        else
+        if (pObj == m_pFirst)
         {
-            if ( pObj->GetPrev() )
-                pObj->GetPrev()->SetNext( pObj->GetNext() );
-            if ( pObj->GetNext() )
-                pObj->GetNext()->SetPrev( pObj->GetPrev() );
+            if (pObj->GetNext())
+            {
+                m_pFirst = pObj->GetNext();
+            }
+            else
+            {
+                m_pFirst = pObj->GetPrev();
+            }
+            assert(m_pFirst); // must have capacity > 1
+        }
+        if (pObj == m_pRealFirst)
+        {
+            m_pRealFirst = pObj->GetNext();
+            assert(m_pRealFirst); // must have capacity > 1
+        }
+        if (pObj->GetPrev())
+        {
+            pObj->GetPrev()->SetNext( pObj->GetNext() );
+        }
+        if (pObj->GetNext())
+        {
+            pObj->GetNext()->SetPrev( pObj->GetPrev() );
         }
         delete pObj;
         m_aCacheObjects[nPos] = pNew;
commit d9da8221e533ebed593f0ea8dc03d21811247e6c
Author: Michael Stahl <mst...@redhat.com>
Date:   Wed Jan 31 14:34:31 2018 +0100

    tdf#114596 dbaccess: fix mysterious dataloss bug
    
    OBookmarkContainer actually re-uses the reference count of
    ODatabaseSource, so converting ODatabaseSource::m_aBookmark to Reference
    created a cycle, which somehow causes the dataloss, because evidently
    something as important as storing the data must be done in the
    destructor.
    
    (regression from 2660d24a07866e083c5135ea263030f3e3a2e729)
    
    (cherry picked from commit 96ae2a3300811897c24cccb20f8c2faf382483df)
    
    tdf#114596 compilerplugins: add exception to [loplugin:refcounting]
    (cherry picked from commit e80da60895b45309fa1d018760d5f11cca4367f4)
    
    Change-Id: I4cad01dc9cdaf405c1eb31d6c0e161eb6712b78f
    Reviewed-on: https://gerrit.libreoffice.org/49026
    Reviewed-by: Noel Grandin <noel.gran...@collabora.co.uk>
    Tested-by: Michael Stahl <mst...@redhat.com>
    Reviewed-by: Michael Stahl <mst...@redhat.com>
    (cherry picked from commit b5440ce23b17d84f7971cb7ea35512d5cac69c9f)

diff --git a/compilerplugins/clang/refcounting.cxx 
b/compilerplugins/clang/refcounting.cxx
index cc3a56b76e21..62583181ec3c 100644
--- a/compilerplugins/clang/refcounting.cxx
+++ b/compilerplugins/clang/refcounting.cxx
@@ -146,6 +146,10 @@ bool containsXInterfaceSubclass(const Type* pType0) {
         if (isDerivedFrom(pRecordDecl, "XPropertyList")) { // module svx
             return false;
         }
+        // tdf#114596
+        if (isDerivedFrom(pRecordDecl, "dbaccess::OBookmarkContainer")) { // 
module dbaccess
+            return false;
+        }
     }
     if (pRecordDecl) {
         const ClassTemplateSpecializationDecl* pTemplate = 
dyn_cast<ClassTemplateSpecializationDecl>(pRecordDecl);
diff --git a/dbaccess/source/core/dataaccess/datasource.cxx 
b/dbaccess/source/core/dataaccess/datasource.cxx
index fbd4bc6fb137..975ea0a6393c 100644
--- a/dbaccess/source/core/dataaccess/datasource.cxx
+++ b/dbaccess/source/core/dataaccess/datasource.cxx
@@ -472,7 +472,7 @@ ODatabaseSource::ODatabaseSource(const 
::rtl::Reference<ODatabaseModelImpl>& _pI
             :ModelDependentComponent( _pImpl )
             ,ODatabaseSource_Base( getMutex() )
             ,OPropertySetHelper( ODatabaseSource_Base::rBHelper )
-            ,m_xBookmarks( new OBookmarkContainer( *this, getMutex() ) )
+            , m_Bookmarks(*this, getMutex())
             ,m_aFlushListeners( getMutex() )
 {
     // some kind of default
@@ -1162,7 +1162,8 @@ Reference< XConnection > 
ODatabaseSource::getConnection(const OUString& user, co
 Reference< XNameAccess > SAL_CALL ODatabaseSource::getBookmarks(  ) throw 
(RuntimeException, std::exception)
 {
     ModelMethodGuard aGuard( *this );
-    return static_cast< XNameContainer* >(m_xBookmarks.get());
+    // tdf#114596 this may look nutty but see OBookmarkContainer::aquire()
+    return static_cast<XNameContainer*>(&m_Bookmarks);
 }
 
 Reference< XNameAccess > SAL_CALL ODatabaseSource::getQueryDefinitions( ) 
throw(RuntimeException, std::exception)

... etc. - the rest is truncated
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

Reply via email to