oox/source/ppt/pptgraphicshapecontext.cxx |    8 +++++---
 oox/source/ppt/pptshapecontext.cxx        |   22 ++++++++++++++--------
 2 files changed, 19 insertions(+), 11 deletions(-)

New commits:
commit 771eca5fc2ca88d931f4935f4a5ac74136096df9
Author:     Mohit Marathe <[email protected]>
AuthorDate: Fri Feb 27 17:15:42 2026 +0530
Commit:     Mohit Marathe <[email protected]>
CommitDate: Fri Mar 13 08:22:51 2026 +0100

    tdf#163741 pptx import: skip placeholder matching for idx=UINT32_MAX
    
    Placeholders with idx="4294967295" (SAL_MAX_UINT32) are sentinel values
    meaning "no specific placeholder link." Previously, getInteger() silently
    overflowed this to 0, causing the shape to wrongly match a layout
    placeholder and inherit incorrect text properties (e.g. 10pt instead of
    the expected 18pt from the master's bodyStyle).
    
    Parse idx as unsigned via getUnsigned() to detect the sentinel, then skip
    setSubTypeIndex(), findPlaceholderByIndex(), and findPlaceholder() entirely
    so the shape falls through to the master text style cascade.
    
    Signed-off-by: Mohit Marathe <[email protected]>
    Change-Id: Ib8b0c068720440695bffe25bc23d3f28406fea60
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/200622
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/201435
    Tested-by: Jenkins

diff --git a/oox/source/ppt/pptgraphicshapecontext.cxx 
b/oox/source/ppt/pptgraphicshapecontext.cxx
index 7d9fc0a2289d..b918c6b0e8b2 100644
--- a/oox/source/ppt/pptgraphicshapecontext.cxx
+++ b/oox/source/ppt/pptgraphicshapecontext.cxx
@@ -60,11 +60,13 @@ ContextHandlerRef PPTGraphicShapeContext::onCreateContext( 
sal_Int32 aElementTok
         mpShapePtr->setSubType( nSubType );
         OUString sIdx( rAttribs.getStringDefaulted( XML_idx ) );
         bool bHasIdx = !sIdx.isEmpty();
-        sal_Int32 nIdx = sIdx.toInt32();
-        if( rAttribs.hasAttribute( XML_idx ) )
+        sal_uInt32 nUnsignedIdx = rAttribs.getUnsigned( XML_idx, 0 );
+        bool bSkipPlaceholderLookup = (bHasIdx && nUnsignedIdx == 
SAL_MAX_UINT32);
+        sal_Int32 nIdx = static_cast<sal_Int32>(nUnsignedIdx);
+        if( rAttribs.hasAttribute( XML_idx ) && !bSkipPlaceholderLookup )
             mpShapePtr->setSubTypeIndex( nIdx );
 
-        if ( nSubType || bHasIdx )
+        if ( (nSubType || bHasIdx) && !bSkipPlaceholderLookup )
         {
             PPTShape* pPPTShapePtr = dynamic_cast< PPTShape* >( 
mpShapePtr.get() );
             if ( pPPTShapePtr )
diff --git a/oox/source/ppt/pptshapecontext.cxx 
b/oox/source/ppt/pptshapecontext.cxx
index 6caed1728d01..40ade6a2ca05 100644
--- a/oox/source/ppt/pptshapecontext.cxx
+++ b/oox/source/ppt/pptshapecontext.cxx
@@ -72,17 +72,23 @@ ContextHandlerRef PPTShapeContext::onCreateContext( 
sal_Int32 aElementToken, con
 
             mpShapePtr->setSubType( nSubType );
 
+            bool bSkipPlaceholderLookup = false;
             if( rAttribs.hasAttribute( XML_idx ) )
             {
-                sal_Int32 nSubTypeIndex = rAttribs.getInteger( XML_idx, 0 );
-                mpShapePtr->setSubTypeIndex( nSubTypeIndex );
-
-                if(!oSubType.has_value() && pMasterPersist)
+                sal_uInt32 nUnsignedIdx = rAttribs.getUnsigned( XML_idx, 0 );
+                bSkipPlaceholderLookup = (nUnsignedIdx == SAL_MAX_UINT32);
+                sal_Int32 nSubTypeIndex = static_cast<sal_Int32>(nUnsignedIdx);
+                if (!bSkipPlaceholderLookup)
                 {
-                    pTmpPlaceholder = PPTShape::findPlaceholderByIndex( 
nSubTypeIndex, pMasterPersist->getShapes()->getChildren() );
+                    mpShapePtr->setSubTypeIndex( nSubTypeIndex );
+
+                    if(!oSubType.has_value() && pMasterPersist)
+                    {
+                        pTmpPlaceholder = PPTShape::findPlaceholderByIndex( 
nSubTypeIndex, pMasterPersist->getShapes()->getChildren() );
 
-                    if(pTmpPlaceholder)
-                        nSubType = pTmpPlaceholder->getSubType(); // When we 
don't have type attribute on slide but have on slidelayout we have to use it 
instead of default type
+                        if(pTmpPlaceholder)
+                            nSubType = pTmpPlaceholder->getSubType(); // When 
we don't have type attribute on slide but have on slidelayout we have to use it 
instead of default type
+                    }
                 }
             }
 
@@ -132,7 +138,7 @@ ContextHandlerRef PPTShapeContext::onCreateContext( 
sal_Int32 aElementToken, con
                               default:
                                   break;
                         }
-                        if ( nFirstPlaceholder )
+                        if ( nFirstPlaceholder && !bSkipPlaceholderLookup )
                         {
                               oox::drawingml::ShapePtr pPlaceholder;
                               if ( eShapeLocation == Layout )       // for 
layout objects the referenced object can be found within the same shape tree

Reply via email to