[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-04-04 Thread Caolán McNamara 
 filter/source/graphicfilter/icgm/cgm.cxx|8 
 filter/source/graphicfilter/icgm/class1.cxx |   17 +++--
 filter/source/graphicfilter/icgm/class4.cxx |   25 -
 3 files changed, 31 insertions(+), 19 deletions(-)

New commits:
commit bfb4717cb03eda40b9550ea2f8ab8ca7949f1e37
Author: Caolán McNamara 
Date:   Sun Apr 2 11:31:10 2017 +0100

ofz: check bounds on read

Change-Id: I07779bec876b90e36f20a81d6dbf06ae727edf85
(cherry picked from commit fb05611064e12c8eda09bc32c42544cde8c2ab49)
Reviewed-on: https://gerrit.libreoffice.org/36019
Tested-by: Jenkins 
Reviewed-by: Michael Stahl 

diff --git a/filter/source/graphicfilter/icgm/cgm.cxx 
b/filter/source/graphicfilter/icgm/cgm.cxx
index 30804b06845f..d15923084ccc 100644
--- a/filter/source/graphicfilter/icgm/cgm.cxx
+++ b/filter/source/graphicfilter/icgm/cgm.cxx
@@ -101,7 +101,7 @@ sal_uInt32 CGM::GetBackGroundColor()
 sal_uInt32 CGM::ImplGetUI16( sal_uInt32 /*nAlign*/ )
 {
 sal_uInt8* pSource = mpSource + mnParaSize;
-if (pSource + 2 > mpEndValidSource)
+if (mpEndValidSource - pSource < 2)
 throw css::uno::Exception("attempt to read past end of input", 
nullptr);
 mnParaSize += 2;
 return ( pSource[ 0 ] << 8 ) +  pSource[ 1 ];
@@ -115,7 +115,7 @@ sal_uInt8 CGM::ImplGetByte( sal_uInt32 nSource, sal_uInt32 
nPrecision )
 sal_Int32 CGM::ImplGetI( sal_uInt32 nPrecision )
 {
 sal_uInt8* pSource = mpSource + mnParaSize;
-if (pSource + nPrecision > mpEndValidSource)
+if (static_cast(mpEndValidSource - pSource) < nPrecision)
 throw css::uno::Exception("attempt to read past end of input", 
nullptr);
 mnParaSize += nPrecision;
 switch( nPrecision )
@@ -147,7 +147,7 @@ sal_Int32 CGM::ImplGetI( sal_uInt32 nPrecision )
 sal_uInt32 CGM::ImplGetUI( sal_uInt32 nPrecision )
 {
 sal_uInt8* pSource = mpSource + mnParaSize;
-if (pSource + nPrecision > mpEndValidSource)
+if (static_cast(mpEndValidSource - pSource) < nPrecision)
 throw css::uno::Exception("attempt to read past end of input", 
nullptr);
 mnParaSize += nPrecision;
 switch( nPrecision )
@@ -202,7 +202,7 @@ double CGM::ImplGetFloat( RealPrecision eRealPrecision, 
sal_uInt32 nRealSize )
 const bool bCompatible = false;
 #endif
 
-if (mpSource + mnParaSize + nRealSize > mpEndValidSource)
+if (static_cast(mpEndValidSource - (mpSource + mnParaSize)) < 
nRealSize)
 throw css::uno::Exception("attempt to read past end of input", 
nullptr);
 
 if ( bCompatible )
diff --git a/filter/source/graphicfilter/icgm/class1.cxx 
b/filter/source/graphicfilter/icgm/class1.cxx
index 641355924f74..895dd8247d0b 100644
--- a/filter/source/graphicfilter/icgm/class1.cxx
+++ b/filter/source/graphicfilter/icgm/class1.cxx
@@ -176,8 +176,11 @@ void CGM::ImplDoClass1()
 {
 while ( mnParaSize < mnElementSize )
 {
-sal_uInt32 nSize;
-nSize = ImplGetUI( 1 );
+sal_uInt32 nSize = ImplGetUI(1);
+
+if (static_cast(mpEndValidSource - (mpSource + 
mnParaSize)) < nSize)
+throw css::uno::Exception("attempt to read past end of 
input", nullptr);
+
 pElement->aFontList.InsertName( mpSource + mnParaSize, nSize );
 mnParaSize += nSize;
 }
@@ -187,10 +190,12 @@ void CGM::ImplDoClass1()
 {
 while ( mnParaSize < mnElementSize )
 {
-sal_uInt32 nCharSetType;
-sal_uInt32 nSize;
-nCharSetType = ImplGetUI16();
-nSize = ImplGetUI( 1 );
+sal_uInt32 nCharSetType = ImplGetUI16();
+sal_uInt32 nSize = ImplGetUI(1);
+
+if (static_cast(mpEndValidSource - (mpSource + 
mnParaSize)) < nSize)
+throw css::uno::Exception("attempt to read past end of 
input", nullptr);
+
 pElement->aFontList.InsertCharSet( (CharSetType)nCharSetType, 
mpSource + mnParaSize, nSize );
 mnParaSize += nSize;
 }
diff --git a/filter/source/graphicfilter/icgm/class4.cxx 
b/filter/source/graphicfilter/icgm/class4.cxx
index 442f10dc087d..ff574c4eece4 100644
--- a/filter/source/graphicfilter/icgm/class4.cxx
+++ b/filter/source/graphicfilter/icgm/class4.cxx
@@ -178,15 +178,18 @@ void CGM::ImplDoClass4()
 case 0x04 : /*Text*/
 {
 FloatPoint  aFloatPoint;
-sal_uInt32  nType, nSize;
 
 if ( mbFigure )
 mpOutAct->CloseRegion();
 
 ImplGetPoint ( aFloatPoint, true );
-nType = ImplGetUI16( 4 );
-nSize = ImplGetUI( 1 );
-mpSource[ mnParaSize + nSize ] = 0;
+sal_uInt32 nType = ImplGetUI16( 4 );
+sal_uInt32 nSize = ImplGetUI( 1 );
+

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-03-28 Thread Caolán McNamara 
 filter/source/msfilter/msdffimp.cxx |   48 ++--
 1 file changed, 24 insertions(+), 24 deletions(-)

New commits:
commit 4d63ab138024d41223db48829660cf42148f0f4b
Author: Caolán McNamara 
Date:   Tue Mar 28 14:45:00 2017 +0100

valgrind: use of uninitialized values

Change-Id: I5b8c6d4d4576fd88dbffdfc710cbd9b2e9429942
(cherry picked from commit b7152aff51665bc802af66e6e599a89e0344c92f)
Reviewed-on: https://gerrit.libreoffice.org/35808
Tested-by: Jenkins 
Reviewed-by: Michael Stahl 

diff --git a/filter/source/msfilter/msdffimp.cxx 
b/filter/source/msfilter/msdffimp.cxx
index 1728f90553a0..8a8ffa3a5608 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -1937,9 +1937,8 @@ void 
DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
 for ( sal_uInt16 i = 0; i < nNumElem; i++ )
 {
 PropVec aHandlePropVec;
-sal_uInt32  nFlagsTmp;
-SvxMSDffHandleFlags nFlags;
-sal_Int32   nPositionX, nPositionY, nCenterX, nCenterY, 
nRangeXMin, nRangeXMax, nRangeYMin, nRangeYMax;
+sal_uInt32 nFlagsTmp(0);
+sal_Int32  nPositionX(0), nPositionY(0), nCenterX(0), 
nCenterY(0), nRangeXMin(0), nRangeXMax(0), nRangeYMin(0), nRangeYMax(0);
 rIn.ReadUInt32( nFlagsTmp )
.ReadInt32( nPositionX )
.ReadInt32( nPositionY )
@@ -1949,7 +1948,7 @@ void 
DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
.ReadInt32( nRangeXMax )
.ReadInt32( nRangeYMin )
.ReadInt32( nRangeYMax );
-nFlags = static_cast(nFlagsTmp);
+SvxMSDffHandleFlags nFlags = 
static_cast(nFlagsTmp);
 if ( nPositionX == 2 )  // replacing center position with 
absolute value
 nPositionX = nCoordWidth / 2;
 if ( nPositionY == 2 )
@@ -2206,7 +2205,6 @@ void 
DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
 {
 css::uno::Sequence< css::drawing::EnhancedCustomShapeSegment > 
aSegments;
 
-sal_uInt16 i, nTmp;
 sal_uInt16 nNumElemSeg = 0;
 
 if ( SeekToContent( DFF_Prop_pSegmentInfo, rIn ) )
@@ -2223,14 +2221,13 @@ void 
DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
 }
 if ( nNumElemSeg )
 {
-sal_Int16 nCommand;
-sal_Int16 nCnt;
 aSegments.realloc( nNumElemSeg );
-for ( i = 0; i < nNumElemSeg; i++ )
+for (sal_uInt16 i = 0; i < nNumElemSeg; ++i)
 {
+sal_uInt16 nTmp(0);
 rIn.ReadUInt16( nTmp );
-nCommand = EnhancedCustomShapeSegmentCommand::UNKNOWN;
-nCnt = (sal_Int16)( nTmp & 0x1fff );//Last 13 bits for 
segment points number
+sal_Int16 nCommand = 
EnhancedCustomShapeSegmentCommand::UNKNOWN;
+sal_Int16 nCnt = (sal_Int16)( nTmp & 0x1fff );//Last 13 
bits for segment points number
 switch( nTmp >> 13 )//First 3 bits for command type
 {
 case 0x0:
@@ -3201,7 +3198,7 @@ bool SvxMSDffManager::SeekToShape( SvStream& rSt, void* 
/* pClientData */, sal_u
 if ( !maFidcls.empty() )
 {
 sal_uInt32 nMerk = rSt.Tell();
-sal_uInt32 nShapeId, nSec = ( nId >> 10 ) - 1;
+sal_uInt32 nSec = ( nId >> 10 ) - 1;
 if ( nSec < mnIdClusters )
 {
 OffsetMap::const_iterator it = maDgOffsetTable.find( maFidcls[ 
nSec ].dgid );
@@ -3224,6 +3221,7 @@ bool SvxMSDffManager::SeekToShape( SvStream& rSt, void* 
/* pClientData */, sal_u
 DffRecordHeader aShapeHd;
 if ( SeekToRec( rSt, DFF_msofbtSp, 
aEscherObjListHd.GetRecEndFilePos(),  ) )
 {
+sal_uInt32 nShapeId(0);
 rSt.ReadUInt32( nShapeId );
 if ( nId == nShapeId )
 {
@@ -4232,7 +4230,7 @@ SdrObject* SvxMSDffManager::ImportShape( const 
DffRecordHeader& rHd, SvStream& r
 aObjData.bChildAnchor = maShapeRecords.SeekToContent( rSt, 
DFF_msofbtChildAnchor, SEEK_FROM_CURRENT_AND_RESTART );
 if ( aObjData.bChildAnchor )
 {
-sal_Int32 l, o, r, u;
+sal_Int32 l(0), o(0), r(0), u(0);
 rSt.ReadInt32( l ).ReadInt32( o ).ReadInt32( r ).ReadInt32( u );
 Scale( l );
 Scale( o );
@@ -4864,14 +4862,14 @@ Rectangle SvxMSDffManager::GetGlobalChildAnchor( const 
DffRecordHeader& rHd, SvS
 {
 if ( GetSvxMSDffSettings() &

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-03-21 Thread Caolán McNamara 
 filter/source/msfilter/svdfppt.cxx |   28 ++--
 1 file changed, 18 insertions(+), 10 deletions(-)

New commits:
commit 8a9d3e26ded4a0971413d9ccb9ca9a321ff164fb
Author: Caolán McNamara 
Date:   Thu Mar 16 09:53:19 2017 +

ofz#875 limit depth to max legal depth

Change-Id: Icbe9339148dc4aeb31c160e976385e3bcaef75b6
(cherry picked from commit 30e2b7203963af215c9aaaec12383e0d5e1f6a7f)
Reviewed-on: https://gerrit.libreoffice.org/35260
Tested-by: Jenkins 
Reviewed-by: Michael Stahl 

diff --git a/filter/source/msfilter/svdfppt.cxx 
b/filter/source/msfilter/svdfppt.cxx
index a64ff32d6db0..8b95a67dca28 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -5939,6 +5939,14 @@ bool PPTParagraphObj::GetAttrib( sal_uInt32 nAttr, 
sal_uInt32& rRetValue, TSS_Ty
 
 bool bIsHardAttribute = ( ( pParaSet->mnAttrSet & nMask ) != 0 );
 
+sal_uInt16 nDepth = pParaSet->mnDepth;
+
+if (nDepth >= nMaxPPTLevels)
+{
+SAL_WARN("filter.ms", "Para Style Sheet depth " << nDepth << " but " 
<< nMaxPPTLevels - 1 << " is max possible");
+nDepth = nMaxPPTLevels - 1;
+}
+
 if ( bIsHardAttribute )
 {
 if ( nAttr == PPT_ParaAttr_BulletColor )
@@ -5947,7 +5955,7 @@ bool PPTParagraphObj::GetAttrib( sal_uInt32 nAttr, 
sal_uInt32& rRetValue, TSS_Ty
 if ( pParaSet->mnAttrSet & ( 1 << PPT_ParaAttr_BuHardColor ) )
 bHardBulletColor = pParaSet->mpArry[ PPT_ParaAttr_BuHardColor 
] != 0;
 else
-bHardBulletColor = ( mrStyleSheet.mpParaSheet[ mnInstance 
]->maParaLevel[ pParaSet->mnDepth ].mnBuFlags
+bHardBulletColor = ( mrStyleSheet.mpParaSheet[ mnInstance 
]->maParaLevel[nDepth].mnBuFlags
 & ( 1 << PPT_ParaAttr_BuHardColor ) ) 
!= 0;
 if ( bHardBulletColor )
 rRetValue = pParaSet->mnBulletColor;
@@ -5963,7 +5971,7 @@ bool PPTParagraphObj::GetAttrib( sal_uInt32 nAttr, 
sal_uInt32& rRetValue, TSS_Ty
 }
 else
 {
-rRetValue = mrStyleSheet.mpCharSheet[ 
nDestinationInstance ]->maCharLevel[ pParaSet->mnDepth ].mnFontColor;
+rRetValue = mrStyleSheet.mpCharSheet[ 
nDestinationInstance ]->maCharLevel[nDepth].mnFontColor;
 }
 }
 }
@@ -5974,7 +5982,7 @@ bool PPTParagraphObj::GetAttrib( sal_uInt32 nAttr, 
sal_uInt32& rRetValue, TSS_Ty
 if ( pParaSet->mnAttrSet & ( 1 << PPT_ParaAttr_BuHardFont ) )
 bHardBuFont = pParaSet->mpArry[ PPT_ParaAttr_BuHardFont ] != 0;
 else
-bHardBuFont = ( mrStyleSheet.mpParaSheet[ mnInstance 
]->maParaLevel[ pParaSet->mnDepth ].mnBuFlags
+bHardBuFont = ( mrStyleSheet.mpParaSheet[ mnInstance 
]->maParaLevel[nDepth].mnBuFlags
 & ( 1 << PPT_ParaAttr_BuHardFont ) ) 
!= 0;
 if ( bHardBuFont )
 rRetValue = pParaSet->mpArry[ PPT_ParaAttr_BulletFont ];
@@ -5991,7 +5999,7 @@ bool PPTParagraphObj::GetAttrib( sal_uInt32 nAttr, 
sal_uInt32& rRetValue, TSS_Ty
 }
 else
 {
-rRetValue = mrStyleSheet.mpCharSheet[ 
nDestinationInstance ]->maCharLevel[ pParaSet->mnDepth ].mnFont;
+rRetValue = mrStyleSheet.mpCharSheet[ 
nDestinationInstance ]->maCharLevel[nDepth].mnFont;
 }
 }
 }
@@ -6001,14 +6009,14 @@ bool PPTParagraphObj::GetAttrib( sal_uInt32 nAttr, 
sal_uInt32& rRetValue, TSS_Ty
 }
 else
 {
-const PPTParaLevel& rParaLevel = mrStyleSheet.mpParaSheet[ mnInstance 
]->maParaLevel[ pParaSet->mnDepth ];
+const PPTParaLevel& rParaLevel = mrStyleSheet.mpParaSheet[ mnInstance 
]->maParaLevel[nDepth];
 
 PPTParaLevel* pParaLevel = nullptr;
 if ( ( nDestinationInstance == TSS_Type::Unknown )
-|| ( pParaSet->mnDepth && ( ( mnInstance == TSS_Type::Subtitle ) 
|| ( mnInstance == TSS_Type::TextInShape ) ) ) )
+|| ( nDepth && ( ( mnInstance == TSS_Type::Subtitle ) || ( 
mnInstance == TSS_Type::TextInShape ) ) ) )
 bIsHardAttribute = true;
 else if ( nDestinationInstance != mnInstance )
-pParaLevel = [ nDestinationInstance 
]->maParaLevel[ pParaSet->mnDepth ];
+pParaLevel = [ nDestinationInstance 
]->maParaLevel[nDepth];
 switch ( nAttr )
 {
 case PPT_ParaAttr_BulletOn :
@@ -6056,7 +6064,7 @@ bool PPTParagraphObj::GetAttrib( sal_uInt32 nAttr, 
sal_uInt32& rRetValue, TSS_Ty
 }
 else
 {
-rRetValue = mrStyleSheet.mpCharSheet[ mnInstance 
]->maCharLevel[

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-03-21 Thread Caolán McNamara 
 filter/source/graphicfilter/itiff/itiff.cxx |   65 +---
 1 file changed, 40 insertions(+), 25 deletions(-)

New commits:
commit 820b921230f5a56b327e178f6d8f65edc66e24a8
Author: Caolán McNamara 
Date:   Sun Mar 12 17:37:05 2017 +

ofz#829 ensure palette can fulfil largest index used

Change-Id: I95aa4796875ee71e8b06a2bb8985845f270b8817
Reviewed-on: https://gerrit.libreoffice.org/35105
Tested-by: Jenkins 
Reviewed-by: Michael Stahl 

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx 
b/filter/source/graphicfilter/itiff/itiff.cxx
index f744baf91fc6..41807c739df3 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -53,6 +53,7 @@ private:
 Bitmap  aBitmap;
 BitmapWriteAccess*  pAcc;
 sal_uInt16  nDstBitsPerPixel;
+int nLargestPixelIndex;
 AlphaMask*  pAlphaMask;
 BitmapWriteAccess*  pMaskAcc;
 
@@ -121,6 +122,9 @@ private:
 // converts a Scanline to the Windows-BMP format
 
 bool HasAlphaChannel() const;
+
+void SetPixelIndex(BitmapWriteAccess *pAcc, long nY, long nX, sal_uInt8 
cIndex);
+
 public:
 
 TIFFReader()
@@ -129,6 +133,7 @@ public:
 , pTIFF(nullptr)
 , pAcc(nullptr)
 , nDstBitsPerPixel(0)
+, nLargestPixelIndex(-1)
 , pAlphaMask(nullptr)
 , pMaskAcc(nullptr)
 , nOrigPos(0)
@@ -785,6 +790,11 @@ sal_uLong TIFFReader::GetBits( const sal_uInt8 * pSrc, 
sal_uLong nBitsPos, sal_u
 return nRes;
 }
 
+void TIFFReader::SetPixelIndex(BitmapWriteAccess *pWriteAcc, long nY, long nX, 
sal_uInt8 cIndex)
+{
+pWriteAcc->SetPixelIndex(nY, nX, cIndex);
+nLargestPixelIndex = std::max(nLargestPixelIndex, cIndex);
+}
 
 bool TIFFReader::ConvertScanline(sal_Int32 nY)
 {
@@ -947,7 +957,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
 for (sal_Int32 nx = 0; nx < nImageWidth; ++nx)
 {
 nLast += nx == 0 ? BYTESWAP( (sal_uInt8)*pt++ 
) : *pt++;
-pAcc->SetPixelIndex( nY, nx, nLast );
+SetPixelIndex(pAcc, nY, nx, nLast);
 }
 }
 else
@@ -955,7 +965,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
 for (sal_Int32 nx = 0; nx < nImageWidth; ++nx)
 {
 sal_uInt8 nLast = *pt++;
-pAcc->SetPixelIndex( nY, nx, 
static_cast( (BYTESWAP((sal_uLong)nLast) - nMinSampleValue) * 
nMinMax ) );
+SetPixelIndex(pAcc, nY, nx, 
static_cast( (BYTESWAP((sal_uLong)nLast) - nMinSampleValue) * 
nMinMax ));
 }
 }
 }
@@ -967,15 +977,14 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
 for (sal_Int32 nx = 0; nx < nImageWidth; ++nx)
 {
 nLast += *pt++;
-pAcc->SetPixelIndex( nY, nx, nLast );
+SetPixelIndex(pAcc, nY, nx, nLast);
 }
 }
 else
 {
 for (sal_Int32 nx = 0; nx < nImageWidth; ++nx)
 {
-pAcc->SetPixelIndex( nY, nx, 
static_cast( ((sal_uLong)*pt++ - nMinSampleValue) * nMinMax ) );
-
+SetPixelIndex(pAcc, nY, nx, 
static_cast( ((sal_uLong)*pt++ - nMinSampleValue) * nMinMax ));
 }
 }
 }
@@ -992,7 +1001,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
 for (sal_Int32 nx = 0; nx < nImageWidth; ++nx)
 {
 nVal = ( GetBits( pt, nx * nBitsPerSample, 
nBitsPerSample ) - nMinSampleValue ) * nMinMax;
-pAcc->SetPixelIndex( nY, nx, 
static_cast(nVal));
+SetPixelIndex(pAcc, nY, nx, 
static_cast(nVal));
 }
 }
 break;
@@ -1013,28 +1022,28 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
 while (nByteCount--)
 {
 nByteVal = *pt++;
-pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
+SetPixelIndex(pAcc, nY, nx++, nByteVal & 1);
 nByteVal >>= 1;
-pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
+SetPixelIndex(pAcc, nY, nx++, nByteVal & 1);

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-03-21 Thread Caolán McNamara 
 filter/source/msfilter/svdfppt.cxx |4 
 1 file changed, 4 insertions(+)

New commits:
commit 2f0e14de089b9da350444bddb5baf6ba9baac338
Author: Caolán McNamara 
Date:   Thu Mar 16 09:13:13 2017 +

ofz#876 avoid accessing empty rows

(cherry picked from commit b9892037c303e645ee1a987d80734361700d91ac)

Change-Id: Iba539fb03611bbe5627cc7976c1146d08a2ab5fd
Reviewed-on: https://gerrit.libreoffice.org/35257
Tested-by: Jenkins 
Reviewed-by: Michael Stahl 

diff --git a/filter/source/msfilter/svdfppt.cxx 
b/filter/source/msfilter/svdfppt.cxx
index 2c05ce0d7403..a64ff32d6db0 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -7631,6 +7631,10 @@ SdrObject* SdrPowerPointImport::CreateTable( SdrObject* 
pGroup, sal_uInt32* pTab
 aColumns.insert( aSnapRect.Left() );
 }
 }
+
+if (aRows.empty())
+return pRet;
+
 sdr::table::SdrTableObj* pTable = new sdr::table::SdrTableObj( 
pSdrModel );
 pTable->uno_lock();
 Reference< XTable > xTable( pTable->getTable() );
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-03-21 Thread Caolán McNamara 
 filter/source/msfilter/svdfppt.cxx |   13 -
 1 file changed, 12 insertions(+), 1 deletion(-)

New commits:
commit 248aec4e966a99e411f46950722f0684b6286b2c
Author: Caolán McNamara 
Date:   Thu Mar 16 21:22:36 2017 +

ofz: use after free

Change-Id: I6d3f9108b02149165b020fc9c6677880456a1ef4
Reviewed-on: https://gerrit.libreoffice.org/35300
Tested-by: Jenkins 
Reviewed-by: Michael Stahl 

diff --git a/filter/source/msfilter/svdfppt.cxx 
b/filter/source/msfilter/svdfppt.cxx
index 4bd7a4f58ea8..2c05ce0d7403 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -2904,7 +2904,18 @@ void SdrPowerPointImport::ImportPage( SdrPage* pRet, 
const PptSlidePersistEntry*
 // obsolete here, too.
 pRet->getSdrPageProperties().ClearItem();
 
pRet->getSdrPageProperties().PutItemSet(rSlidePersist.pBObj->GetMergedItemSet());
-SdrObject::Free( rSlidePersist.pBObj );
+if (rSlidePersist.pSolverContainer)
+{
+for (SvxMSDffConnectorRule* pPtr : 
rSlidePersist.pSolverContainer->aCList)
+{
+// check connections to the group object
+if (pPtr->pAObj == rSlidePersist.pBObj)
+pPtr->pAObj = nullptr;
+if (pPtr->pBObj == rSlidePersist.pBObj)
+pPtr->pBObj = nullptr;
+}
+}
+SdrObject::Free(rSlidePersist.pBObj);
 }
 }
 }
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-03-03 Thread Caolán McNamara 
 filter/source/graphicfilter/ipsd/ipsd.cxx |   14 +++---
 1 file changed, 7 insertions(+), 7 deletions(-)

New commits:
commit f96840d17562250aa7ac55f99934ee938008ce0c
Author: Caolán McNamara 
Date:   Thu Mar 2 09:48:42 2017 +

ofz: init vars

Change-Id: Ie35617997845de25af9e528668bce4c332ac408a
(cherry picked from commit 1c29456c9c9007b788297aebea58a1a765f77c84)
Reviewed-on: https://gerrit.libreoffice.org/34786
Reviewed-by: Markus Mohrhard 
Tested-by: Jenkins 

diff --git a/filter/source/graphicfilter/ipsd/ipsd.cxx 
b/filter/source/graphicfilter/ipsd/ipsd.cxx
index 5b68a17..b91b848 100644
--- a/filter/source/graphicfilter/ipsd/ipsd.cxx
+++ b/filter/source/graphicfilter/ipsd/ipsd.cxx
@@ -279,17 +279,17 @@ bool PSDReader::ImplReadHeader()
 // this is a loop over the resource entries to get the resolution info
 while( m_rPSD.Tell() < nLayerPos )
 {
-sal_uInt8 n8;
-sal_uInt32 nType, nPStringLen, nResEntryLen;
-sal_uInt16 nUniqueID;
-
-m_rPSD.ReadUInt32( nType ).ReadUInt16( nUniqueID ).ReadUChar( n8 );
-nPStringLen = n8;
-if ( nType != 0x3842494d )
+sal_uInt32 nType(0);
+sal_uInt16 nUniqueID(0);
+sal_uInt8 n8(0);
+m_rPSD.ReadUInt32(nType).ReadUInt16(nUniqueID).ReadUChar(n8);
+if (nType != 0x3842494d)
 break;
+sal_uInt32 nPStringLen = n8;
 if ( ! ( nPStringLen & 1 ) )
 nPStringLen++;
 m_rPSD.SeekRel( nPStringLen );  // skipping the pstring
+sal_uInt32 nResEntryLen(0);
 m_rPSD.ReadUInt32( nResEntryLen );
 if ( nResEntryLen & 1 )
 nResEntryLen++; // the resource entries are padded
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-03-02 Thread Caolán McNamara 
 filter/source/graphicfilter/itiff/ccidecom.cxx |5 -
 1 file changed, 4 insertions(+), 1 deletion(-)

New commits:
commit aa5efe3ca9167c60049292e32b2b7c731e799e42
Author: Caolán McNamara 
Date:   Tue Feb 28 16:43:44 2017 +

ofz#668: check nTargetBits size

Change-Id: I5cc7499cfdee58ffa480bb31dfc262d5b781180d
(cherry picked from commit 99c361be16eb3a21aa679a103db2d07ecd0f5d3c)
Reviewed-on: https://gerrit.libreoffice.org/34724
Reviewed-by: Markus Mohrhard 
Tested-by: Markus Mohrhard 

diff --git a/filter/source/graphicfilter/itiff/ccidecom.cxx 
b/filter/source/graphicfilter/itiff/ccidecom.cxx
index 1cb7d7d..4fcb6b9 100644
--- a/filter/source/graphicfilter/itiff/ccidecom.cxx
+++ b/filter/source/graphicfilter/itiff/ccidecom.cxx
@@ -627,7 +627,9 @@ void CCIDecompressor::StartDecompression( SvStream & 
rIStream )
 
 bool CCIDecompressor::DecompressScanline( sal_uInt8 * pTarget, sal_uLong 
nTargetBits, bool bLastLine )
 {
-bool b2D;
+//Read[1|2]DScanlineData take a sal_uInt16, so its either limit here or 
expand there
+if (nTargetBits > SAL_MAX_UINT16)
+return false;
 
 if ( nEOLCount >= 5 )   // RTC (Return To Controller)
 return true;
@@ -682,6 +684,7 @@ bool CCIDecompressor::DecompressScanline( sal_uInt8 * 
pTarget, sal_uLong nTarget
 if ( nOptions & CCI_OPTION_BYTEALIGNROW )
 nInputBitsBufSize &= 0xfff8;
 
+bool b2D;
 // is it a 2D row?
 if ( nOptions & CCI_OPTION_2D )
 {
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-02-23 Thread Caolán McNamara 
 filter/source/graphicfilter/itiff/itiff.cxx |   16 +++-
 1 file changed, 11 insertions(+), 5 deletions(-)

New commits:
commit 4c9383e1354be0954c5f7cf8906f334ae079baeb
Author: Caolán McNamara 
Date:   Thu Feb 23 11:01:00 2017 +

ofz: don't read data that isn't there

Change-Id: I7fdcb78bde8f650c1a57d34177d8993a6d8a0a2f
(cherry picked from commit ee619fb344c7e8f491e09bd256df7f8567af9bef)

improve scoping

Change-Id: Ic79d46da4e322a0f52981c3a3df65f7f0294fdd8
(cherry picked from commit 840ad0a88045021c58644404a099a3678a371020)

make this a little clearer

no logic change intended

Change-Id: Ibfc46d0aba9e220be54270734e0cdfbc123be9a5
(cherry picked from commit 46b1b5dd2a5368663fd56434160fa126f1a54d84)
Reviewed-on: https://gerrit.libreoffice.org/34573
Tested-by: Jenkins 
Reviewed-by: Michael Stahl 

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx 
b/filter/source/graphicfilter/itiff/itiff.cxx
index c5438d1..f744baf 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -788,7 +788,7 @@ sal_uLong TIFFReader::GetBits( const sal_uInt8 * pSrc, 
sal_uLong nBitsPos, sal_u
 
 bool TIFFReader::ConvertScanline(sal_Int32 nY)
 {
-sal_uInt32  nRed, nGreen, nBlue, ns, nVal, nByteCount;
+sal_uInt32  nRed, nGreen, nBlue, ns, nVal;
 sal_uInt8   nByteVal;
 
 if ( nDstBitsPerPixel == 24 )
@@ -999,11 +999,18 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
 
 case 1 :
 {
+sal_uInt32 nByteCount = nImageWidth >> 3;
+
+sal_uInt32 nBytesNeeded = nByteCount;
+if (nImageWidth & 7)
+++nBytesNeeded;
+if (pt + nBytesNeeded > ptend)
+return false;
+
 if ( bByteSwap )
 {
 sal_Int32 nx = 0;
-nByteCount = ( nImageWidth >> 3 ) + 1;
-while ( --nByteCount )
+while (nByteCount--)
 {
 nByteVal = *pt++;
 pAcc->SetPixelIndex( nY, nx++, nByteVal & 1 );
@@ -1035,8 +1042,7 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
 else
 {
 sal_Int32 nx = 7;
-nByteCount = ( nImageWidth >> 3 ) + 1;
-while ( --nByteCount )
+while (nByteCount--)
 {
 nByteVal = *pt++;
 pAcc->SetPixelIndex( nY, nx, nByteVal & 1 );
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-02-23 Thread Caolán McNamara 
 filter/source/graphicfilter/itiff/itiff.cxx |   20 +++-
 1 file changed, 15 insertions(+), 5 deletions(-)

New commits:
commit 2a0b6d152839e4b4cb26abbdabbc2ec77528f365
Author: Caolán McNamara 
Date:   Thu Feb 23 12:02:06 2017 +

Resolves: ofz#668 check for massive row lengths before trying to allocate 
them

Change-Id: I7b3f1abf5dcf457e8ff7d04a7cf48ffee70817a2
Reviewed-on: https://gerrit.libreoffice.org/34575
Reviewed-by: Markus Mohrhard 
Tested-by: Markus Mohrhard 

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx 
b/filter/source/graphicfilter/itiff/itiff.cxx
index 0ef0081..c5438d1 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -68,7 +68,7 @@ private:
 sal_uLong   nSubFile;
 sal_Int32   nImageWidth;// picture width in 
pixels
 sal_Int32   nImageLength;   // picture height in 
pixels
-sal_uLong   nBitsPerSample; // bits per pixel per 
layer
+sal_uInt32  nBitsPerSample; // bits per pixel per 
layer
 sal_uLong   nCompression;   // kind of compression
 sal_uLong   nPhotometricInterpretation;
 sal_uLong   nThresholding;
@@ -78,7 +78,7 @@ private:
 sal_uLong*  pStripOffsets;  // field of offsets to 
the Bitmap-Data-"Strips"
 sal_uLong   nNumStripOffsets;   // size of the field 
above
 sal_uLong   nOrientation;
-sal_uLong   nSamplesPerPixel;   // number of layers
+sal_uInt32  nSamplesPerPixel;   // number of layers
 sal_uLong   nRowsPerStrip;  // if it's not 
compressed: number of rows per Strip
 sal_uLong*  pStripByteCounts;   // if compressed (in a 
certain way): size of the strips
 sal_uLong   nNumStripByteCounts;// number of entries 
in the field above
@@ -94,9 +94,9 @@ private:
 sal_uLong*  pColorMap;  // color palette
 sal_uLong   nNumColors; // number of colors 
within the color palette
 
-sal_uLong   nPlanes;// number of layers 
within the Tiff file
+sal_uInt32  nPlanes;// number of layers 
within the Tiff file
 sal_uLong   nStripsPerPlane;// number of Strips 
per layer
-sal_uLong   nBytesPerRow;   // Bytes per line per 
Layer in the Tiff file ( uncompressed )
+sal_uInt32  nBytesPerRow;   // Bytes per line per 
Layer in the Tiff file ( uncompressed )
 sal_uInt8*  pMap[ 4 ];  // temporary Scanline
 
 
@@ -1371,8 +1371,18 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & 
rGraphic )
 
 if (bStatus)
 {
-nBytesPerRow = ( nImageWidth * nSamplesPerPixel / 
nPlanes * nBitsPerSample + 7 ) >> 3;
+sal_uInt64 nRowSize = 
(static_cast(nImageWidth) * nSamplesPerPixel / nPlanes * 
nBitsPerSample + 7) >> 3;
+if (nRowSize > SAL_MAX_INT32 / SAL_N_ELEMENTS(pMap))
+{
+SAL_WARN("filter.tiff", "Ludicrous row size of: " 
<< nRowSize << " required");
+bStatus = false;
+}
+else
+nBytesPerRow = nRowSize;
+}
 
+if (bStatus)
+{
 for (sal_uInt8*& j : pMap)
 {
 try
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-02-23 Thread Caolán McNamara 
 filter/source/graphicfilter/itiff/itiff.cxx |4 
 1 file changed, 4 insertions(+)

New commits:
commit 2166fd06156c8f31948e755b5893911d93fcb6a2
Author: Caolán McNamara 
Date:   Wed Feb 22 20:39:13 2017 +

ofz: don't read data that isn't there

Change-Id: I9f730c321755cde169d940b49fc93bbe057ead57
(cherry picked from commit c5b1a01ddfa54156b4fa8e542d6936908257ca93)

diff --git a/filter/source/graphicfilter/itiff/itiff.cxx 
b/filter/source/graphicfilter/itiff/itiff.cxx
index d7a26ea..0ef0081 100644
--- a/filter/source/graphicfilter/itiff/itiff.cxx
+++ b/filter/source/graphicfilter/itiff/itiff.cxx
@@ -929,12 +929,16 @@ bool TIFFReader::ConvertScanline(sal_Int32 nY)
 {
 sal_uLong nMinMax = ( ( 1 << nDstBitsPerPixel ) - 1 ) / ( 
nMaxSampleValue - nMinSampleValue );
 sal_uInt8* pt = pMap[ 0 ];
+sal_uInt8* ptend = pt + nBytesPerRow;
 sal_uInt8 nShift;
 
 switch ( nDstBitsPerPixel )
 {
 case 8 :
 {
+if (pt + nImageWidth > ptend)
+return false;
+
 if ( bByteSwap )
 {
 if ( nPredictor == 2 )
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-02-01 Thread Caolán McNamara 
 filter/source/graphicfilter/ieps/ieps.cxx |   82 +++---
 1 file changed, 54 insertions(+), 28 deletions(-)

New commits:
commit 9176d089b6a65649f136e20ec260311535d26948
Author: Caolán McNamara 
Date:   Sun Jan 29 20:54:56 2017 +

Resolves: ofz#488 check remaining size while parsing

Change-Id: Ibb2b6c59a159f9fafa6a065be438b59a6d2d3f21
Reviewed-on: https://gerrit.libreoffice.org/33666
Reviewed-by: Michael Stahl 
Tested-by: Michael Stahl 

diff --git a/filter/source/graphicfilter/ieps/ieps.cxx 
b/filter/source/graphicfilter/ieps/ieps.cxx
index a62c15a..0de5327 100644
--- a/filter/source/graphicfilter/ieps/ieps.cxx
+++ b/filter/source/graphicfilter/ieps/ieps.cxx
@@ -36,6 +36,7 @@
 #include 
 #include 
 #include 
+#include 
 
 class FilterConfigItem;
 
@@ -459,7 +460,6 @@ void MakePreview(sal_uInt8* pBuf, sal_uInt32 nBytesRead,
 pVDev->SetFillColor();
 
 aFont.SetColor( COL_LIGHTRED );
-//  aFont.SetSize( Size( 0, 32 ) );
 
 pVDev->Push( PushFlags::FONT );
 pVDev->SetFont( aFont );
@@ -470,51 +470,77 @@ void MakePreview(sal_uInt8* pBuf, sal_uInt32 nBytesRead,
 OUString aString;
 int nLen;
 sal_uInt8* pDest = ImplSearchEntry( pBuf, reinterpret_cast("%%Title:"), nBytesRead - 32, 8 );
-if ( pDest )
+sal_uInt32 nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf)) : 0;
+if (nRemainingBytes >= 8)
 {
 pDest += 8;
-if ( *pDest == ' ' )
-pDest++;
-nLen = ImplGetLen( pDest, 32 );
-sal_uInt8 aOldValue(pDest[ nLen ]); pDest[ nLen ] = 0;
-if ( strcmp( reinterpret_cast(pDest), "none" ) != 0 )
+nRemainingBytes -= 8;
+if (nRemainingBytes && *pDest == ' ')
 {
-aString += " Title:" + OUString::createFromAscii( 
reinterpret_cast(pDest) ) + "\n";
+++pDest;
+--nRemainingBytes;
+}
+nLen = ImplGetLen(pDest, std::min(nRemainingBytes, 32));
+if (static_cast(nLen) < nRemainingBytes)
+{
+sal_uInt8 aOldValue(pDest[ nLen ]); pDest[ nLen ] = 0;
+if ( strcmp( reinterpret_cast(pDest), "none" ) != 0 )
+{
+aString += " Title:" + OUString::createFromAscii( 
reinterpret_cast(pDest) ) + "\n";
+}
+pDest[ nLen ] = aOldValue;
 }
-pDest[ nLen ] = aOldValue;
 }
 pDest = ImplSearchEntry( pBuf, reinterpret_cast("%%Creator:"), nBytesRead - 32, 10 );
-if ( pDest )
+nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf)) : 0;
+if (nRemainingBytes >= 10)
 {
 pDest += 10;
-if ( *pDest == ' ' )
-pDest++;
-nLen = ImplGetLen( pDest, 32 );
-sal_uInt8 aOldValue(pDest[ nLen ]); pDest[ nLen ] = 0;
-aString += " Creator:" + OUString::createFromAscii( 
reinterpret_cast(pDest) ) + "\n";
-pDest[ nLen ] = aOldValue;
+nRemainingBytes -= 10;
+if (nRemainingBytes && *pDest == ' ')
+{
+++pDest;
+--nRemainingBytes;
+}
+nLen = ImplGetLen(pDest, std::min(nRemainingBytes, 32));
+if (static_cast(nLen) < nRemainingBytes)
+{
+sal_uInt8 aOldValue(pDest[nLen]); pDest[nLen] = 0;
+aString += " Creator:" + OUString::createFromAscii( 
reinterpret_cast(pDest) ) + "\n";
+pDest[nLen] = aOldValue;
+}
 }
 pDest = ImplSearchEntry( pBuf, reinterpret_cast("%%CreationDate:"), nBytesRead - 32, 15 );
-if ( pDest )
+nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf)) : 0;
+if (nRemainingBytes >= 15)
 {
 pDest += 15;
-if ( *pDest == ' ' )
-pDest++;
-nLen = ImplGetLen( pDest, 32 );
-sal_uInt8 aOldValue(pDest[ nLen ]); pDest[ nLen ] = 0;
-if ( strcmp( reinterpret_cast(pDest), "none" ) != 0 )
+nRemainingBytes -= 15;
+if (nRemainingBytes && *pDest == ' ')
+{
+++pDest;
+--nRemainingBytes;
+}
+nLen = ImplGetLen(pDest, std::min(nRemainingBytes, 32));
+if (static_cast(nLen) < nRemainingBytes)
 {
-aString += " CreationDate:" + OUString::createFromAscii( 
reinterpret_cast(pDest) ) + "\n";
+sal_uInt8 aOldValue(pDest[ nLen ]); pDest[ nLen ] = 0;
+if ( strcmp( reinterpret_cast(pDest), "none" ) != 0 )
+{
+aString += " CreationDate:" + OUString::createFromAscii( 
reinterpret_cast(pDest) ) + "\n";
+}
+pDest[ nLen ] = aOldValue;
 }
-pDest[ nLen ] = aOldValue;
 }
 pDest = ImplSearchEntry( pBuf, reinterpret_cast("%%LanguageLevel:"), nBytesRead - 4, 16 );
-if ( pDest )
+nRemainingBytes = pDest ? (nBytesRead - (pDest - pBuf)) : 0;
+if (nRemainingBytes >= 16)
 {
 pDest

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source include/sal

2017-02-01 Thread Caolán McNamara 
 filter/source/graphicfilter/ieps/ieps.cxx |   88 +-
 include/sal/log-areas.dox |1 
 2 files changed, 52 insertions(+), 37 deletions(-)

New commits:
commit 390c730b460054ec41e0ab1b807ea0c2bba4ecbd
Author: Caolán McNamara 
Date:   Thu Jan 26 16:01:57 2017 +

ofz: tidy up eps preview import

a) check that the remaining stream length is >= the 14 bytes that are
unconditionally skipped
b) make the initial security count the min of the arbitrary 100 and the
remaining stream len less that 14 bytes
c) tweak ImplGetNumber not to reduce nSecurityCount if its already 0

(cherry picked from commit 94ffb720b889c51665ebb789d84aee3b3bacb456)

ofz: check eps seeks are sane and succeeded

(cherry picked from commit f85fb724d52a0fff9c64365cd202ae8975492c05)

ofz: check if the stream is able to meet the eps len claim before reading

(cherry picked from commit e17a34e957c21a8cd2977b1b0e1c9a427c244aed)

ofz: check if the stream is able to meet the eps len claim before reading

(cherry picked from commit d1f31681623696e99b0bd9e98570cb1ebac518cc)

make this a little more readable

(cherry picked from commit cf06348d9d4be8b8460d202cebf0d995fd4f6abf)

move deref inside (laughable) nSecurityCount check

(cherry picked from commit 521723b1180a32c02a88ed47137d4242c06eaca7)

Change-Id: Ifffa6d02d492affd578fb48007704457ad635b39
0eb45e1c1ffd91682ed0ce6a6a74eab54666d715
65407bffb67449e203b8ead23554a4e88387d214
440c7f38d6588c570a411f2a97c0164e5d7d646f
83b6b0bd636b639ce0892f22f216410ce79dee03
df9a83ffa80137967d8c77d7a9b5133529fc2858
Reviewed-on: https://gerrit.libreoffice.org/33635
Tested-by: Jenkins 
Reviewed-by: Miklos Vajna 

diff --git a/filter/source/graphicfilter/ieps/ieps.cxx 
b/filter/source/graphicfilter/ieps/ieps.cxx
index ef132bb..a62c15a 100644
--- a/filter/source/graphicfilter/ieps/ieps.cxx
+++ b/filter/source/graphicfilter/ieps/ieps.cxx
@@ -69,17 +69,19 @@ static sal_uInt8* ImplSearchEntry( sal_uInt8* pSource, 
sal_uInt8 const * pDest,
 
 
 // SecurityCount is the buffersize of the buffer in which we will parse for a 
number
-static long ImplGetNumber( sal_uInt8 **pBuf, sal_uInt32& nSecurityCount )
+static long ImplGetNumber(sal_uInt8* , sal_uInt32& nSecurityCount)
 {
 boolbValid = true;
 boolbNegative = false;
 longnRetValue = 0;
-while ( ( --nSecurityCount ) && ( ( **pBuf == ' ' ) || ( **pBuf == 0x9 ) ) 
)
-(*pBuf)++;
-sal_uInt8 nByte = **pBuf;
-while ( nSecurityCount && ( nByte != ' ' ) && ( nByte != 0x9 ) && ( nByte 
!= 0xd ) && ( nByte != 0xa ) )
+while (nSecurityCount && (*rBuf == ' ' || *rBuf == 0x9))
 {
-switch ( nByte )
+++rBuf;
+--nSecurityCount;
+}
+while ( nSecurityCount && ( *rBuf != ' ' ) && ( *rBuf != 0x9 ) && ( *rBuf 
!= 0xd ) && ( *rBuf != 0xa ) )
+{
+switch ( *rBuf )
 {
 case '.' :
 // we'll only use the integer format
@@ -89,17 +91,17 @@ static long ImplGetNumber( sal_uInt8 **pBuf, sal_uInt32& 
nSecurityCount )
 bNegative = true;
 break;
 default :
-if ( ( nByte < '0' ) || ( nByte > '9' ) )
+if ( ( *rBuf < '0' ) || ( *rBuf > '9' ) )
 nSecurityCount = 1; // error parsing the bounding 
box values
 else if ( bValid )
 {
 nRetValue *= 10;
-nRetValue += nByte - '0';
+nRetValue += *rBuf - '0';
 }
 break;
 }
 nSecurityCount--;
-nByte = *(++(*pBuf));
+++rBuf;
 }
 if ( bNegative )
 nRetValue = -nRetValue;
@@ -399,6 +401,15 @@ static bool RenderAsBMP(const sal_uInt8* pBuf, sal_uInt32 
nBytesRead, Graphic 
 return RenderAsBMPThroughConvert(pBuf, nBytesRead, rGraphic);
 }
 
+namespace
+{
+bool checkSeek(SvStream , sal_uInt32 nOffset)
+{
+const sal_uInt64 nMaxSeek(rSt.Tell() + rSt.remainingSize());
+return (nOffset <= nMaxSeek && rSt.Seek(nOffset) == nOffset);
+}
+}
+
 // this method adds a replacement action containing the original wmf or tiff 
replacement,
 // so the original eps can be written when storing to ODF.
 void CreateMtfReplacementAction( GDIMetaFile& rMtf, SvStream& rStrm, 
sal_uInt32 nOrigPos, sal_uInt32 nPSSize,
@@ -416,19 +427,17 @@ void CreateMtfReplacementAction( GDIMetaFile& rMtf, 
SvStream& rStrm, sal_uInt32
 aReplacement.WriteUInt32( nMagic ).WriteUInt32( nPPos ).WriteUInt32( 
nPSSize )
 .WriteUInt32( nWPos ).WriteUInt32( nSizeWMF )
 .WriteUInt32( nTPos ).WriteUInt32( nSizeTIFF );
-if ( nSizeWMF )
+if (nSizeWMF &&

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-01-18 Thread Caolán McNamara 
 filter/source/graphicfilter/idxf/dxfentrd.cxx |   15 ---
 filter/source/graphicfilter/idxf/dxfgrprd.cxx |4 
 filter/source/graphicfilter/idxf/dxfgrprd.hxx |1 +
 3 files changed, 17 insertions(+), 3 deletions(-)

New commits:
commit 0f213087f25853bbb0100f6496d5392ce708ab45
Author: Caolán McNamara 
Date:   Tue Jan 17 21:19:13 2017 +

ofz#414 crash in DXFHatchEntity::EvaluateGroup

(cherry picked from commit 5434d51d12611eb2726ce1394eb01921d008fa89)

ofz#415 crash in DXFVector::DXFVector

(cherry picked from commit 2a9b4363ca190f1d783d540e95a031357f852858)

Change-Id: I15c8cb7aeb8c45f32357afd0ea2f550ffe11dbf7
Reviewed-on: https://gerrit.libreoffice.org/33235
Tested-by: Jenkins 
Reviewed-by: Michael Stahl 

diff --git a/filter/source/graphicfilter/idxf/dxfentrd.cxx 
b/filter/source/graphicfilter/idxf/dxfentrd.cxx
index 85508ac..d4f7e30 100644
--- a/filter/source/graphicfilter/idxf/dxfentrd.cxx
+++ b/filter/source/graphicfilter/idxf/dxfentrd.cxx
@@ -422,8 +422,11 @@ void DXFLWPolyLineEntity::EvaluateGroup( DXFGroupReader & 
rDGR )
 case 90 :
 {
 nCount = rDGR.GetI();
-if ( nCount )
+// limit alloc to max reasonable size based on remaining data in 
stream
+if (nCount > 0 && static_cast(nCount) <= 
rDGR.remainingSize())
 pP = new DXFVector[ nCount ];
+else
+nCount = 0;
 }
 break;
 case 70: nFlags = rDGR.GetI(); break;
@@ -600,8 +603,11 @@ bool DXFBoundaryPathData::EvaluateGroup( DXFGroupReader & 
rDGR )
 case 93 :
 {
 nPointCount = rDGR.GetI();
-if ( nPointCount )
+// limit alloc to max reasonable size based on remaining data 
in stream
+if (nPointCount > 0 && static_cast(nPointCount) <= 
rDGR.remainingSize())
 pP = new DXFVector[ nPointCount ];
+else
+nPointCount = 0;
 }
 break;
 case 72 : nHasBulgeFlag = rDGR.GetI(); break;
@@ -679,8 +685,11 @@ void DXFHatchEntity::EvaluateGroup( DXFGroupReader & rDGR )
 {
 bIsInBoundaryPathContext = true;
 nBoundaryPathCount = rDGR.GetI();
-if ( nBoundaryPathCount )
+// limit alloc to max reasonable size based on remaining data in 
stream
+if (nBoundaryPathCount > 0 && 
static_cast(nBoundaryPathCount) <= rDGR.remainingSize())
 pBoundaryPathData = new DXFBoundaryPathData[ 
nBoundaryPathCount ];
+else
+nBoundaryPathCount = 0;
 }
 break;
 case 75 :
diff --git a/filter/source/graphicfilter/idxf/dxfgrprd.cxx 
b/filter/source/graphicfilter/idxf/dxfgrprd.cxx
index ac1ca2d..f4669fd 100644
--- a/filter/source/graphicfilter/idxf/dxfgrprd.cxx
+++ b/filter/source/graphicfilter/idxf/dxfgrprd.cxx
@@ -222,5 +222,9 @@ void DXFGroupReader::ReadS()
 S = DXFReadLine(rIS);
 }
 
+sal_uInt64 DXFGroupReader::remainingSize() const
+{
+return rIS.remainingSize();
+}
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/filter/source/graphicfilter/idxf/dxfgrprd.hxx 
b/filter/source/graphicfilter/idxf/dxfgrprd.hxx
index 8228208..6064a7e 100644
--- a/filter/source/graphicfilter/idxf/dxfgrprd.hxx
+++ b/filter/source/graphicfilter/idxf/dxfgrprd.hxx
@@ -64,6 +64,7 @@ public:
 
 void SetS(); // (will be copied)
 
+sal_uInt64 remainingSize() const;
 private:
 
 long   ReadI();
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2017-01-17 Thread Caolán McNamara 
 filter/source/graphicfilter/ios2met/ios2met.cxx |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit 7deb0227ad0556e2c40231f26b637272e84f5d7e
Author: Caolán McNamara 
Date:   Mon Jan 16 17:00:06 2017 +

ofz: ensure nOldSize is > 0

Change-Id: Iaf385c9cd4fd37d56879908c00c7483762d66a0b
(cherry picked from commit dd70861fd7123c826feefa86f8af1da1f4877c97)
Reviewed-on: https://gerrit.libreoffice.org/33178
Tested-by: Jenkins 
Reviewed-by: Michael Stahl 

diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx 
b/filter/source/graphicfilter/ios2met/ios2met.cxx
index 253a5c8..f1fc8f3 100644
--- a/filter/source/graphicfilter/ios2met/ios2met.cxx
+++ b/filter/source/graphicfilter/ios2met/ios2met.cxx
@@ -510,7 +510,7 @@ void OS2METReader::AddPointsToArea(const tools::Polygon & 
rPoly)
 else {
 tools::Polygon aLastPoly(pPP->GetObject(pPP->Count()-1));
 nOldSize=aLastPoly.GetSize();
-if (aLastPoly.GetPoint(nOldSize-1)==rPoly.GetPoint(0)) nOldSize--;
+if (nOldSize && aLastPoly.GetPoint(nOldSize-1)==rPoly.GetPoint(0)) 
nOldSize--;
 nNewSize=nOldSize+rPoly.GetSize();
 aLastPoly.SetSize(nNewSize);
 for (i=nOldSize; iGetObject(pPP->Count()-1));
 nOldSize=aLastPoly.GetSize();
-if (aLastPoly.GetPoint(nOldSize-1)!=rPoly.GetPoint(0)) 
pPP->Insert(rPoly);
+if (nOldSize && aLastPoly.GetPoint(nOldSize-1)!=rPoly.GetPoint(0)) 
pPP->Insert(rPoly);
 else {
 nOldSize--;
 nNewSize=nOldSize+rPoly.GetSize();
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2016-11-28 Thread Stephan Bergmann 
 filter/source/msfilter/escherex.cxx |3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

New commits:
commit e2121e396c07111df985cff7b7a47586179cafe5
Author: Stephan Bergmann 
Date:   Mon Nov 28 11:22:55 2016 +0100

tdf#104144: Missing dashed border, "break" should be "fallthrough" after all

...5ffd2c1595d1f67f5e4b14e48188a1f37f1956b5 "Presumably missing break in 
switch"
apparently decided wrongly in favor of "break" over "fallthrough".

Change-Id: I90372faac84a26514f5dc936e0e393a1ca12effa
(cherry picked from commit 787d31a94510ca3de9ce582d7b7402dfca584b23)
Reviewed-on: https://gerrit.libreoffice.org/31314
Tested-by: Jenkins 
Reviewed-by: Miklos Vajna 

diff --git a/filter/source/msfilter/escherex.cxx 
b/filter/source/msfilter/escherex.cxx
index fe04bc9..deeca03 100644
--- a/filter/source/msfilter/escherex.cxx
+++ b/filter/source/msfilter/escherex.cxx
@@ -1062,8 +1062,7 @@ void EscherPropertyContainer::CreateLineProperties(
 AddOpt( ESCHER_Prop_lineDashing, eDash );
 }
 }
-break;
-
+SAL_FALLTHROUGH;
 case css::drawing::LineStyle_SOLID :
 default:
 {
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2016-11-01 Thread Шиповський Роман 
 filter/source/xslt/import/spreadsheetml/spreadsheetml2ooo.xsl |4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit 4d23095123788928324976efda6a9a612a2fd9ef
Author: Шиповський Роман 
Date:   Fri Oct 28 18:01:44 2016 +0300

tdf#103552: Decrease SpreadsheetML import time to prevent "General 
input/output error"

Change-Id: I39ed8fff7ba88042c74a11ddc58eec014c0bc6bd
Reviewed-on: https://gerrit.libreoffice.org/30361
Tested-by: Jenkins 
Tested-by: Julien Nabet 
Reviewed-by: jan iversen 
(cherry picked from commit 458a9fd8065737af212bb6bbba285ecb9aad1bb8)
Reviewed-on: https://gerrit.libreoffice.org/30458
Reviewed-by: Adolfo Jayme Barrientos 
Tested-by: Adolfo Jayme Barrientos 

diff --git a/filter/source/xslt/import/spreadsheetml/spreadsheetml2ooo.xsl 
b/filter/source/xslt/import/spreadsheetml/spreadsheetml2ooo.xsl
index f48a7a5..6ee9114 100644
--- a/filter/source/xslt/import/spreadsheetml/spreadsheetml2ooo.xsl
+++ b/filter/source/xslt/import/spreadsheetml/spreadsheetml2ooo.xsl
@@ -6921,7 +6921,7 @@



-   
+   



@@ -7168,7 +7168,7 @@



-   
+   



___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source include/filter include/oox oox/source sc/source

2016-10-26 Thread Caolán McNamara 
 filter/source/msfilter/mscodec.cxx|  200 
 include/filter/msfilter/mscodec.hxx   |  213 --
 include/oox/crypto/CryptTools.hxx |3 
 include/oox/crypto/Standard2007Engine.hxx |   68 -
 oox/source/crypto/CryptTools.cxx  |   14 -
 oox/source/crypto/DocumentDecryption.cxx  |   22 +--
 oox/source/crypto/Standard2007Engine.cxx  |   67 +++--
 sc/source/filter/excel/xicontent.cxx  |  106 +++---
 sc/source/filter/excel/xistream.cxx   |   70 ++---
 sc/source/filter/inc/xistream.hxx |   67 +++--
 sc/source/filter/inc/xlcontent.hxx|2 
 11 files changed, 544 insertions(+), 288 deletions(-)

New commits:
commit a5ee76c9740836397a250174dc171b36a1c5a958
Author: Caolán McNamara 
Date:   Thu Oct 20 11:19:58 2016 +0100

implement CryptoAPI RC4+SHA1 encryption scheme for xls import

there might be other variants out there in practice, but this
works for default encrypted xls of excel 2013

(cherry picked from commit 1473ce030314027c01c98f513407ed0897328585)

contains...

be more c++y

Change-Id: I673b00e111a734bc626ba3d3f6ecf9692f1ce7db
(cherry picked from commit fcf7f503b64b2cf7dbef019fb43dde033e3538e8)

hash len is 20 for xls cryptoapi configuration

Change-Id: I6e06b8578959b8147043179db57e875b1d98d57d
(cherry picked from commit 491884350ce74f36044b3348bd66356ad1c234af)

clarify hash lengths a bit more

Change-Id: I66cea4b9efb82d29e6c052ac11a6f2eaca823ce0
(cherry picked from commit 8db1b13e721683d0263925c8e0300dd86a022814)

hash len isn't going to change depending on who implements it

Change-Id: Iee585cba4acad74c11d083085153e2af96c8894f
(cherry picked from commit fcc846e8f29839eaace7e1d28746abea8f4b598a)

move some useful header information to mscodec for reuse

Change-Id: Ic7adf3ed3c8279cc93a06975d6fb337210d1af87
(cherry picked from commit fc514cbf30be1613fdf4d4b7c12cbd55ca08b9b0)

rework things in light of now available documentation

Change-Id: If5f75e27191017a8c6a3929e2a70d21840f157c6
(cherry picked from commit 3fabbd0a22219464545f933fc28c869a6fa89546)

split MSCodec_Std97 into a baseclass MSCodec97

(cherry picked from commit 06916c839b16866b47235306d2db50850df0ad7c)

Change-Id: Ia3c41a048169c78684800def94e53fc9f3201e30

Change-Id: I91c0e1d1d95fbd1c68966650e7ac7d23276bcbe3
Reviewed-on: https://gerrit.libreoffice.org/30128
Tested-by: Jenkins 
Reviewed-by: Michael Stahl 

diff --git a/filter/source/msfilter/mscodec.cxx 
b/filter/source/msfilter/mscodec.cxx
index b6ac169..a8c8677 100644
--- a/filter/source/msfilter/mscodec.cxx
+++ b/filter/source/msfilter/mscodec.cxx
@@ -245,27 +245,37 @@ void MSCodec_Xor95::Skip( sal_Size nBytes )
 mnOffset = (mnOffset + nBytes) & 0x0F;
 }
 
+MSCodec97::MSCodec97(size_t nHashLen)
+: m_nHashLen(nHashLen)
+, m_hCipher(rtl_cipher_create(rtl_Cipher_AlgorithmARCFOUR, 
rtl_Cipher_ModeStream))
+, m_aDigestValue(nHashLen, 0)
+{
+assert(m_hCipher != nullptr);
+(void)memset (m_pDocId, 0, sizeof(m_pDocId));
+}
 
-MSCodec_Std97::MSCodec_Std97 ()
+MSCodec_Std97::MSCodec_Std97()
+: MSCodec97(RTL_DIGEST_LENGTH_MD5)
 {
-m_hCipher = rtl_cipher_create (
-rtl_Cipher_AlgorithmARCFOUR, rtl_Cipher_ModeStream);
-OSL_ASSERT(m_hCipher != nullptr);
+m_hDigest = rtl_digest_create(rtl_Digest_AlgorithmMD5);
+assert(m_hDigest != nullptr);
+}
 
-m_hDigest = rtl_digest_create (
-rtl_Digest_AlgorithmMD5);
-OSL_ASSERT(m_hDigest != nullptr);
+MSCodec_CryptoAPI::MSCodec_CryptoAPI()
+: MSCodec97(RTL_DIGEST_LENGTH_SHA1)
+{
+}
 
-(void)memset (m_pDigestValue, 0, sizeof(m_pDigestValue));
-(void)memset (m_pDocId, 0, sizeof(m_pDocId));
+MSCodec97::~MSCodec97()
+{
+(void)memset(m_aDigestValue.data(), 0, m_aDigestValue.size());
+(void)memset(m_pDocId, 0, sizeof(m_pDocId));
+rtl_cipher_destroy(m_hCipher);
 }
 
-MSCodec_Std97::~MSCodec_Std97 ()
+MSCodec_Std97::~MSCodec_Std97()
 {
-(void)memset (m_pDigestValue, 0, sizeof(m_pDigestValue));
-(void)memset (m_pDocId, 0, sizeof(m_pDocId));
-rtl_digest_destroy (m_hDigest);
-rtl_cipher_destroy (m_hCipher);
+rtl_digest_destroy(m_hDigest);
 }
 
 #if DEBUG_MSO_ENCRYPTION_STD97
@@ -282,7 +292,7 @@ static inline void lcl_PrintDigest(const sal_uInt8* 
/*pDigest*/, const char* /*m
 }
 #endif
 
-bool MSCodec_Std97::InitCodec( const uno::Sequence< beans::NamedValue >& aData 
)
+bool MSCodec97::InitCodec( const uno::Sequence< beans::NamedValue >& aData )
 {
 #if DEBUG_MSO_ENCRYPTION_STD97
 fprintf(stdout, "MSCodec_Std97::InitCodec: --begin\n");fflush(stdout);
@@ -291,16 +301,17 @@ bool MSCodec_Std97::InitCodec( const uno::Sequence< 
beans::NamedValue >& aData )

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2016-09-20 Thread Caolán McNamara 
 filter/source/msfilter/eschesdo.cxx |   13 +++--
 1 file changed, 11 insertions(+), 2 deletions(-)

New commits:
commit 097f34e6411248856cfc78ffe80571aa2a876bff
Author: Caolán McNamara 
Date:   Thu Jul 7 16:42:58 2016 +0100

Resolves: tdf#99273 can't save specific docx

crashtesting: assert on export of tdf99571-1.docx to docx

(cherry picked from commit fb045517532aababc06fb4b1112def53b03d9144)

Change-Id: I2c8d82ac21451a2d2cc748dc28ac210c8e5ddf5f
Reviewed-on: https://gerrit.libreoffice.org/29015
Tested-by: Jenkins 
Reviewed-by: Miklos Vajna 

diff --git a/filter/source/msfilter/eschesdo.cxx 
b/filter/source/msfilter/eschesdo.cxx
index 1a3e62a..b7d4c90 100644
--- a/filter/source/msfilter/eschesdo.cxx
+++ b/filter/source/msfilter/eschesdo.cxx
@@ -1224,8 +1224,17 @@ sal_uInt32 ImplEESdrObject::ImplGetText()
 {
 Reference< XText > xXText( mXShape, UNO_QUERY );
 mnTextSize = 0;
-if( xXText.is() )
-mnTextSize = xXText->getString().getLength();
+if (xXText.is())
+{
+try
+{
+mnTextSize = xXText->getString().getLength();
+}
+catch (const uno::RuntimeException& e)
+{
+SAL_WARN("filter.ms", "ImplGetText exception: " << e.Message);
+}
+}
 return mnTextSize;
 }
 
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2016-06-07 Thread Michael Stahl 
 filter/source/graphicfilter/itga/itga.cxx |   11 +--
 1 file changed, 9 insertions(+), 2 deletions(-)

New commits:
commit a895d9868a637bf2a3c2ffd8d26828c99ea8f40f
Author: Michael Stahl 
Date:   Fri Jun 3 23:50:14 2016 +0200

filter: "tga" import: fix some endian issues in ImplReadPalette

Change-Id: Ia8ec7b7e19cf9b6b19497cbd77ae5a4e2fdccee7
(cherry picked from commit da4f7d5d76e054627b61521657d40141b9728e15)
Reviewed-on: https://gerrit.libreoffice.org/25993
Tested-by: Jenkins 
Reviewed-by: Miklos Vajna 

diff --git a/filter/source/graphicfilter/itga/itga.cxx 
b/filter/source/graphicfilter/itga/itga.cxx
index 20a9006..6bf858c 100644
--- a/filter/source/graphicfilter/itga/itga.cxx
+++ b/filter/source/graphicfilter/itga/itga.cxx
@@ -734,14 +734,21 @@ bool TGAReader::ImplReadPalette()
 break;
 
 case 32 :
-m_rTGA.Read( mpColorMap, 4 * nColors );
+for (sal_uInt16 i = 0; i < nColors; i++)
+{
+m_rTGA.ReadUInt32(mpColorMap[i]);
+}
 break;
 
 case 24 :
 {
 for ( sal_uLong i = 0; i < nColors; i++ )
 {
-m_rTGA.Read( [ i ], 3 );
+sal_uInt8 nBlue;
+sal_uInt8 nGreen;
+sal_uInt8 nRed;
+
m_rTGA.ReadUChar(nBlue).ReadUChar(nGreen).ReadUChar(nRed);
+mpColorMap[i] = (nRed << 16) | (nGreen << 8) | nBlue;
 }
 }
 break;
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source include/filter

2016-06-07 Thread Michael Stahl 
 filter/source/msfilter/svdfppt.cxx  |1 +
 include/filter/msfilter/svdfppt.hxx |4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

New commits:
commit 0480d6b366fb52d44b19545e3f9511750ad15abd
Author: Michael Stahl 
Date:   Fri Jun 3 22:00:12 2016 +0200

filter: PPT import: PptPlaceholder is 1 byte large

The array of 8 bytes corresponds to 8 enum values and is read directly
in ReadPptSlideLayoutAto(); this was wrongly converted to enum.

(regression from e5a03da8eb02c333502d6b427625e7bf554ff203)

Change-Id: I5757e06459467b3c84c4a404493fa3be23e4e9a0
(cherry picked from commit 6325cdb735effc5c9ff85819b20aec4271158519)
Reviewed-on: https://gerrit.libreoffice.org/25990
Tested-by: Jenkins 
Reviewed-by: Miklos Vajna 

diff --git a/filter/source/msfilter/svdfppt.cxx 
b/filter/source/msfilter/svdfppt.cxx
index 9d23b39..4bd7a4f 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -309,6 +309,7 @@ SvStream& ReadPptSlideLayoutAtom( SvStream& rIn, 
PptSlideLayoutAtom& rAtom )
 sal_Int32 nTmp;
 rIn.ReadInt32(nTmp);
 rAtom.eLayout = static_cast(nTmp);
+static_assert(sizeof(rAtom.aPlaceholderId) == 8, "wrong size of serialized 
array");
 rIn.Read( rAtom.aPlaceholderId, 8 );
 return rIn;
 }
diff --git a/include/filter/msfilter/svdfppt.hxx 
b/include/filter/msfilter/svdfppt.hxx
index 4bef189..42db74a 100644
--- a/include/filter/msfilter/svdfppt.hxx
+++ b/include/filter/msfilter/svdfppt.hxx
@@ -58,7 +58,7 @@ class PPTTextObj;
 class DffRecordHeader;
 class SvxBulletItem;
 enum class PptSlideLayout;
-enum class PptPlaceholder;
+enum class PptPlaceholder : sal_uInt8;
 
 #define PPT_IMPORTFLAGS_NO_TEXT_ASSERT  1
 
@@ -1459,7 +1459,7 @@ enum class PptSlideLayout
 };
 
 // the following table describes the placeholder id's (values from reality 
followed by values taken from the documentation)
-enum class PptPlaceholder
+enum class PptPlaceholder : sal_uInt8
 {
 NONE   = 0,   //  0 None
 MASTERTITLE= 1,   //  1 Master title
___
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

[Libreoffice-commits] core.git: Branch 'libreoffice-5-2' - filter/source

2016-05-30 Thread Caolán McNamara 
 filter/source/xsltfilter/LibXSLTTransformer.cxx |   26 ++---
 filter/source/xsltfilter/LibXSLTTransformer.hxx |   69 +++-
 2 files changed, 53 insertions(+), 42 deletions(-)

New commits:
commit bce5cdcc7f59da19c063205c6c79fc30874cb5ee
Author: Caolán McNamara 
Date:   Mon May 30 17:47:06 2016 +0100

Resolves: tdf#100057 force libxslt to give up when we cancel a 
transformation

we're already using libxslt internals, so using XSLT_STATE_STOPPED isn't an
additional exposure

This probably isn't all that useful to the original reporter in terms of
importing useful data, but it does turn a hopeless situation into something
that can be cancelled.

Change-Id: I08e9a1dcd9ee78e1804faec500bbcca36a546988
(cherry picked from commit 2805adb0d3cf68d7def01a93bf07fb2e8121ec10)

diff --git a/filter/source/xsltfilter/LibXSLTTransformer.cxx 
b/filter/source/xsltfilter/LibXSLTTransformer.cxx
index 3dbe7a4..55f1920 100644
--- a/filter/source/xsltfilter/LibXSLTTransformer.cxx
+++ b/filter/source/xsltfilter/LibXSLTTransformer.cxx
@@ -203,7 +203,8 @@ namespace XSLT
 
 Reader::Reader(LibXSLTTransformer* transformer) :
 Thread("LibXSLTTransformer"), m_transformer(transformer),
-m_readBuf(INPUT_BUFFER_SIZE), m_writeBuf(OUTPUT_BUFFER_SIZE)
+m_readBuf(INPUT_BUFFER_SIZE), m_writeBuf(OUTPUT_BUFFER_SIZE),
+m_tcontext(nullptr)
 {
 LIBXML_TEST_VERSION;
 }
@@ -288,7 +289,6 @@ namespace XSLT
 xsltStylesheetPtr styleSheet = xsltParseStylesheetFile(
 reinterpret_cast(m_transformer->getStyleSheetURL().getStr()));
 xmlDocPtr result = nullptr;
-xsltTransformContextPtr tcontext = nullptr;
 exsltRegisterAll();
 registerExtensionModule();
 #ifdef DEBUG_FILTER_LIBXSLTTRANSFORMER
@@ -298,11 +298,11 @@ namespace XSLT
 std::unique_ptr oh(new 
OleHandler(m_transformer->getComponentContext()));
 if (styleSheet)
 {
-tcontext = xsltNewTransformContext(styleSheet, doc);
-tcontext->_private = static_cast (oh.get());
-xsltQuoteUserParams(tcontext, [0]);
+m_tcontext = xsltNewTransformContext(styleSheet, doc);
+m_tcontext->_private = static_cast (oh.get());
+xsltQuoteUserParams(m_tcontext, [0]);
 result = xsltApplyStylesheetUser(styleSheet, doc, nullptr, 
nullptr, nullptr,
-tcontext);
+ m_tcontext);
 }
 
 if (result)
@@ -330,7 +330,8 @@ namespace XSLT
 closeOutput();
 oh.reset();
 xsltFreeStylesheet(styleSheet);
-xsltFreeTransformContext(tcontext);
+xsltFreeTransformContext(m_tcontext);
+m_tcontext = nullptr;
 xmlFreeDoc(doc);
 xmlFreeDoc(result);
 }
@@ -351,6 +352,16 @@ namespace XSLT
 
 }
 
+void Reader::forceStateStopped()
+{
+if (!m_tcontext)
+return;
+//tdf#100057 If we force a cancel, libxslt will of course just keep on 
going unless something
+//tells it to stop. Here we force the stopped state so that libxslt 
will stop processing
+//and so Reader::execute will complete and we can join cleanly
+m_tcontext->state = XSLT_STATE_STOPPED;
+}
+
 Reader::~Reader()
 {
 }
@@ -455,6 +466,7 @@ namespace XSLT
 if (m_Reader.is())
 {
 m_Reader->terminate();
+m_Reader->forceStateStopped();
 m_Reader->join();
 }
 m_Reader.clear();
diff --git a/filter/source/xsltfilter/LibXSLTTransformer.hxx 
b/filter/source/xsltfilter/LibXSLTTransformer.hxx
index d276018..9c4485b 100644
--- a/filter/source/xsltfilter/LibXSLTTransformer.hxx
+++ b/filter/source/xsltfilter/LibXSLTTransformer.hxx
@@ -47,6 +47,36 @@ using ::std::map;
 namespace XSLT
 {
 
+class LibXSLTTransformer;
+
+/*
+ * Reader provides a worker thread to perform the actual transformation.
+ * It pipes the streams provided by a LibXSLTTransformer
+ * instance through libxslt.
+ */
+class Reader : public salhelper::Thread
+{
+public:
+Reader(LibXSLTTransformer* transformer);
+int SAL_CALL read(char * buffer, int len);
+int SAL_CALL write(const char * buffer, int len);
+void forceStateStopped();
+int SAL_CALL closeOutput();
+
+private:
+virtual ~Reader();
+
+static const sal_Int32 OUTPUT_BUFFER_SIZE;
+static const sal_Int32 INPUT_BUFFER_SIZE;
+LibXSLTTransformer* m_transformer;
+Sequence m_readBuf;
+Sequence m_writeBuf;
+xsltTransformContextPtr m_tcontext;
+
+virtual void execute() override;
+static void SAL_CALL registerExtensionModule();
+};
+
 /*
  * LibXSLTTransformer provides an transforming pipe service to XSLTFilter.