external/poppler/UnpackedTarball_poppler.mk |    8 ++++++++
 external/poppler/sanitizer.patch            |   18 ++++++++++++++++++
 sw/source/core/frmedt/fews.cxx              |    2 ++
 sw/source/filter/html/svxcss1.cxx           |    5 ++---
 4 files changed, 30 insertions(+), 3 deletions(-)

New commits:
commit 62aac0c4b892cebde3d341c8a34a02b0ef09ef6a
Author:     Stephan Bergmann <[email protected]>
AuthorDate: Tue Nov 2 23:49:23 2021 +0100
Commit:     Stephan Bergmann <[email protected]>
CommitDate: Fri Mar 28 08:04:04 2025 +0100

    Avoid float-cast-overflow
    
    > Testing load file:///~/lo/core//sw/qa/core/data/html/pass/ofz40593-1.html:
    > sw/source/filter/html/svxcss1.cxx:2869:44: runtime error: 1.70141e+38 is 
outside the range of representable values of type 'long'
    
    during CppunitTest_sw_filters_test with test file newly added with
    2f01faaf88b6d172d7293f0c9e2a061d99b8ceb5 "ofz#40593 remove Objects from
    m_xResizeDrawObjects if deleted during parse"
    
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/124623
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <[email protected]>
    (cherry picked from commit de39e35b21134e9a0f946aabe4859b16a62b248d)
    Conflicts:
            sw/source/filter/html/svxcss1.cxx
    
    Change-Id: Ida97b886c254272fd2a506a8d7ad2319fed72dcc
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/183380
    Reviewed-by: Stephan Bergmann <[email protected]>
    Tested-by: allotropia jenkins <[email protected]>

diff --git a/sw/source/filter/html/svxcss1.cxx 
b/sw/source/filter/html/svxcss1.cxx
index c1a6f7312d30..7109fe03540b 100644
--- a/sw/source/filter/html/svxcss1.cxx
+++ b/sw/source/filter/html/svxcss1.cxx
@@ -19,6 +19,7 @@
 
 #include <sal/config.h>
 
+#include <algorithm>
 #include <cmath>
 #include <memory>
 #include <stdlib.h>
@@ -2855,9 +2856,7 @@ static void ParseCSS1_length( const CSS1Expression *pExpr,
         break;
 
     case CSS1_PERCENTAGE:
-        rLength = static_cast<long>(pExpr->GetNumber());
-        if( rLength > 100 )
-            rLength = 100;
+        rLength = static_cast<long>(std::min(pExpr->GetNumber(), 100.0));
         rLengthType = SVX_CSS1_LTYPE_PERCENTAGE;
         break;
 
commit ad48ad100c173f76bd44ece830f5a2670740f034
Author:     Stephan Bergmann <[email protected]>
AuthorDate: Sun Dec 15 10:03:56 2019 +0100
Commit:     Stephan Bergmann <[email protected]>
CommitDate: Fri Mar 28 08:03:54 2025 +0100

    Fix use of uninitialized SwFEShell::bTableCopied
    
    ...which had been introduced with 1e278d1d0cfb1d5375195aa764739f00633f21e8
    "tdf#37156 Writer menu: Paste as Nested table", during
    `make CppunitTest_sw_uiwriter CPPUNIT_TEST_NAME=SwUiWriterTest::testDde
    VALGRIND=memcheck`:
    
    > Conditional jump or move depends on uninitialised value(s)
    >    at 0x1EBBFAF8: SwTransferable::PrepareForCopy(bool) 
(sw/source/uibase/dochdl/swdtflvr.cxx:896)
    >    by 0x1EBC22BA: SwTransferable::Copy(bool) 
(sw/source/uibase/dochdl/swdtflvr.cxx:1144)
    >    by 0x1ECB552D: SwBaseShell::ExecClpbrd(SfxRequest&) 
(sw/source/uibase/shells/basesh.cxx:277)
    >    by 0x1C0D0BB0: SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, 
SfxRequest&, bool) (include/sfx2/shell.hxx:197)
    >    by 0x1C0D72EB: SfxDispatcher::Execute_(SfxShell&, SfxSlot const&, 
SfxRequest&, SfxCallMode) (sfx2/source/control/dispatch.cxx:764)
    >    by 0x1C153977: 
SfxDispatchController_Impl::dispatch(com::sun::star::util::URL const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, 
com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> 
const&) (sfx2/source/control/unoctitm.cxx:760)
    >    by 0x1C154916: 
SfxOfficeDispatch::dispatchWithNotification(com::sun::star::util::URL const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, 
com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> 
const&) (sfx2/source/control/unoctitm.cxx:245)
    >    by 0x21FDE395: 
framework::DispatchHelper::executeDispatch(com::sun::star::uno::Reference<com::sun::star::frame::XDispatch>
 const&, com::sun::star::util::URL const&, bool, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(framework/source/services/dispatchhelper.cxx:151)
    >    by 0x21FDEC95: 
framework::DispatchHelper::executeDispatch(com::sun::star::uno::Reference<com::sun::star::frame::XDispatchProvider>
 const&, rtl::OUString const&, rtl::OUString const&, int, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(framework/source/services/dispatchhelper.cxx:109)
    >    by 0x19BF89C7: 
lcl_dispatchCommand(com::sun::star::uno::Reference<com::sun::star::lang::XComponent>
 const&, rtl::OUString const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(sw/qa/extras/uiwriter/uiwriter.cxx:4048)
    >    by 0x19C1F3EC: SwUiWriterTest::testDde() 
(sw/qa/extras/uiwriter/uiwriter.cxx:4060)
    >  Uninitialised value was created by a heap allocation
    >    at 0x4839E86: operator new(unsigned long) 
(/builddir/build/BUILD/valgrind-3.15.0/coregrind/m_replacemalloc/vg_replace_malloc.c:344)
    >    by 0x1ED6DA43: SwView::SwView(SfxViewFrame*, SfxViewShell*) 
(sw/source/uibase/uiview/view.cxx:864)
    >    by 0x1ED70065: SwView::CreateInstance(SfxViewFrame*, SfxViewShell*) 
(sw/source/uibase/uiview/view0.cxx:79)
    >    by 0x1C347941: SfxBaseModel::createViewController(rtl::OUString 
const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> 
const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) 
(sfx2/source/doc/sfxbasemodel.cxx:4233)
    >    by 0x1C458D81: (anonymous 
namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue>
 const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) 
(sfx2/source/view/frmload.cxx:587)
    >    by 0x2401FAD0: framework::LoadEnv::impl_loadContent() 
(framework/source/loadenv/loadenv.cxx:1159)
    >    by 0x24020735: framework::LoadEnv::start() 
(framework/source/loadenv/loadenv.cxx:392)
    >    by 0x24020F89: framework::LoadEnv::startLoading(rtl::OUString const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, 
com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&, 
rtl::OUString const&, int, LoadEnvFeatures) 
(framework/source/loadenv/loadenv.cxx:297)
    >    by 0x2402175B: 
framework::LoadEnv::loadComponentFromURL(com::sun::star::uno::Reference<com::sun::star::frame::XComponentLoader>
 const&, com::sun::star::uno::Reference<com::sun::star::uno::XComponentContext> 
const&, rtl::OUString const&, rtl::OUString const&, int, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(framework/source/loadenv/loadenv.cxx:166)
    >    by 0x24058172: framework::Desktop::loadComponentFromURL(rtl::OUString 
const&, rtl::OUString const&, int, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(framework/source/services/desktop.cxx:610)
    >    by 0x1F5F7306: unotest::MacrosTest::loadFromDesktop(rtl::OUString 
const&, rtl::OUString const&, 
com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) 
(unotest/source/cpp/macros_test.cxx:48)
    >    by 0x19C646A7: SwModelTestBase::loadURL(rtl::OUString const&, char 
const*, char const*) (sw/qa/inc/swmodeltestbase.hxx:764)
    >    by 0x19BD3792: SwUiWriterTest::createDoc(char const*) 
(sw/qa/extras/uiwriter/uiwriter.cxx:576)
    >    by 0x19C1F352: SwUiWriterTest::testDde() 
(sw/qa/extras/uiwriter/uiwriter.cxx:4055)
    
    (produced with a --enable-optimized build, so some inline frames are 
elided; see
    also <https://ci.libreoffice.org//job/lo_ubsan/1480/> for the same issue
    detected with UBSan).
    
    Change-Id: I080d296006bad4726942fb95a1338ea46c12bed4
    Reviewed-on: https://gerrit.libreoffice.org/85162
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <[email protected]>
    (cherry picked from commit bcc74f619bf87ab97ffc48ab33e031d357952a70)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/183378
    Reviewed-by: Stephan Bergmann <[email protected]>
    Tested-by: allotropia jenkins <[email protected]>

diff --git a/sw/source/core/frmedt/fews.cxx b/sw/source/core/frmedt/fews.cxx
index 2ad7ec20a86f..0c4e097287c2 100644
--- a/sw/source/core/frmedt/fews.cxx
+++ b/sw/source/core/frmedt/fews.cxx
@@ -665,6 +665,7 @@ SwFEShell::SwFEShell( SwDoc& rDoc, vcl::Window *pWindow, 
const SwViewOption *pOp
     , m_bCheckForOLEInCaption(false)
     , m_aPasteListeners(GetPasteMutex())
     , m_eTableInsertMode(SwTable::SEARCH_NONE)
+    , bTableCopied(false)
 {
 }
 
@@ -673,6 +674,7 @@ SwFEShell::SwFEShell( SwEditShell& rShell, vcl::Window 
*pWindow )
     , m_bCheckForOLEInCaption(false)
     , m_aPasteListeners(GetPasteMutex())
     , m_eTableInsertMode(SwTable::SEARCH_NONE)
+    , bTableCopied(false)
 {
 }
 
commit b9991ba7b284aa8e8da9bb86a516dfb6d513542b
Author:     Stephan Bergmann <[email protected]>
AuthorDate: Thu Nov 11 20:49:13 2021 +0100
Commit:     Stephan Bergmann <[email protected]>
CommitDate: Fri Mar 28 08:03:47 2025 +0100

    external/poppler: Avoid missing typeinfo in UBSan builds
    
    After 03bc0f97205593547ddf1fc8d4fb396479bcab6d "poppler: upgrade to release
    21.11.0", my Linux Clang UBSan build started to fail to link
    Executable_xpdfimport with
    
    > ld.lld: error: undefined symbol: 
SplashOutputDev::SplashOutputDev(SplashColorMode, int, bool, unsigned char*, 
bool, SplashThinLineMode, bool)
    > >>> referenced by PSOutputDev.cc:3197 
(workdir/UnpackedTarball/poppler/poppler/PSOutputDev.cc:3197)
    > >>>               PSOutputDev.o:(PSOutputDev::checkPageSlice(Page*, 
double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), 
void*, bool (*)(Annot*, void*), void*)) in archive 
workdir/LinkTarget/StaticLibrary/libpoppler.a
    >
    > ld.lld: error: undefined symbol: SplashOutputDev::startDoc(PDFDoc*)
    > >>> referenced by PSOutputDev.cc:3206 
(workdir/UnpackedTarball/poppler/poppler/PSOutputDev.cc:3206)
    > >>>               PSOutputDev.o:(PSOutputDev::checkPageSlice(Page*, 
double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), 
void*, bool (*)(Annot*, void*), void*)) in archive 
workdir/LinkTarget/StaticLibrary/libpoppler.a
    >
    > ld.lld: error: undefined symbol: typeinfo for SplashOutputDev
    > >>> referenced by PSOutputDev.cc
    > >>>               PSOutputDev.o:(.data+0x16208) in archive 
workdir/LinkTarget/StaticLibrary/libpoppler.a
    > >>> referenced by PSOutputDev.cc
    > >>>               PSOutputDev.o:(.data+0x162A8) in archive 
workdir/LinkTarget/StaticLibrary/libpoppler.a
    > >>> referenced by PSOutputDev.cc
    > >>>               PSOutputDev.o:(.data+0x16348) in archive 
workdir/LinkTarget/StaticLibrary/libpoppler.a
    > >>> referenced 6 more times
    
    because external/poppler/StaticLibrary_poppler.mk apparently only builds a
    curated subset of poppler source files, but in a UBSan build the 
implementation
    of
    
      GfxFontLoc *GfxFont::locateFont(XRef *xref, PSOutputDev *ps)
    
    in workdir/UnpackedTarball/poppler/poppler/GfxFont.cc (being the only place 
in
    Executable_xpdfimport that mentions PSOutputDev, i.e., which is
    apparently never instantiated in Executable_xpdfimport, and that ps 
argument is
    apparently always null) needs the PSOutputDev typeinfo, thus pulling in
    PSOutputDev.o from StaticLibrary_poppler (which contains the virtual 
PSOutputDev
    dtor and thus its typeinfo), which in turn needs the SplashOutputDev ctor 
and
    SplashOutputDev::startDoc from within PSOutputDev::checkPageSlice.
    
    The obvious fix would be to extend the curated list of source files to
    include the missing SplashOutputDev symbols, and any symbols recursively 
needed
    by those, but that would quickly lead to inclusion of
    workdir/UnpackedTarball/poppler/splash/SplashFontEngine.cc which would fail 
to
    compile due to a missing
    
      #include <ft2build.h>
    
    from FreeType.  So instead of going down that road of adding in ever more 
stuff,
    lets try to leave out the problematic definition of
    PSOutputDev::checkPageSlice (which is apparently never called anyway, see
    above).  But leaving that virtual function out completely would cause 
missing
    symbols in the PSOutputDev vtable emitted alongside the PSOputput dtor, but 
also
    leaving out that dtor (which is apparently never called anyway, either) 
would
    then suppress emission of the PSOutputDev typeinfo, which started this whole
    exercise.
    
    So, just for the UBSan builds, define PSOutputDev::checkPageSlice (never 
called
    anyway, see above) with an empty body, as the least invasive approach to 
avoid
    the missing typeinfo symbol.
    
    Change-Id: Ifcb80501b71f22d8f14ee29fd8e4480871ee36d1
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/125071
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <[email protected]>
    (cherry picked from commit c36fa9f86e54afa4e1876a9d296ebcbfcbd3a0ad)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/183377
    Tested-by: allotropia jenkins <[email protected]>
    Reviewed-by: Stephan Bergmann <[email protected]>

diff --git a/external/poppler/UnpackedTarball_poppler.mk 
b/external/poppler/UnpackedTarball_poppler.mk
index 4b92ef93be26..e5b1ed05c6c4 100644
--- a/external/poppler/UnpackedTarball_poppler.mk
+++ b/external/poppler/UnpackedTarball_poppler.mk
@@ -11,6 +11,8 @@ $(eval $(call gb_UnpackedTarball_UnpackedTarball,poppler))
 
 $(eval $(call 
gb_UnpackedTarball_set_tarball,poppler,$(POPPLER_TARBALL),,poppler))
 
+$(eval $(call gb_UnpackedTarball_set_patchlevel,poppler,0))
+
 $(eval $(call gb_UnpackedTarball_add_patches,poppler,\
        external/poppler/disable-freetype.patch.1 \
        external/poppler/gcc7-EntityInfo.patch.1 \
@@ -23,4 +25,10 @@ $(eval $(call gb_UnpackedTarball_add_patches,poppler,\
        external/poppler/poppler-config.patch.1 \
 ))
 
+ifneq ($(filter -fsanitize=%,$(CC)),)
+$(eval $(call gb_UnpackedTarball_add_patches,poppler, \
+    external/poppler/sanitizer.patch \
+))
+endif
+
 # vim: set noet sw=4 ts=4:
diff --git a/external/poppler/sanitizer.patch b/external/poppler/sanitizer.patch
new file mode 100644
index 000000000000..149361661b95
--- /dev/null
+++ b/external/poppler/sanitizer.patch
@@ -0,0 +1,18 @@
+--- poppler/PSOutputDev.cc
++++ poppler/PSOutputDev.cc
+@@ -3111,6 +3111,8 @@
+ bool PSOutputDev::checkPageSlice(Page *page, double /*hDPI*/, double 
/*vDPI*/, int rotateA, bool useMediaBox, bool crop, int sliceX, int sliceY, int 
sliceW, int sliceH, bool printing, bool (*abortCheckCbk)(void *data),
+                                  void *abortCheckCbkData, bool 
(*annotDisplayDecideCbk)(Annot *annot, void *user_data), void 
*annotDisplayDecideCbkData)
+ {
++    std::abort();
++#if 0
+     PreScanOutputDev *scan;
+     bool rasterize;
+     bool useFlate, useLZW;
+@@ -3593,5 +3595,6 @@
+ 
+     return false;
++#endif
+ }
+ 
+ void PSOutputDev::startPage(int pageNum, GfxState *state, XRef *xrefA)

Reply via email to