From 87d003eb1e16a84e0bb478cb4ffc20ba9c2b2182 Mon Sep 17 00:00:00 2001
From: Marc-André Laverdière <marc-andre@atc.tcs.com>
Date: Tue, 21 Jun 2011 12:16:57 +0100
Subject: switch to using a vector for styles, and add many range checks
 (cherry picked from commit 28a56883c2887c44d8892d80bf0ee90ebdc58b48)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Caolán McNamara <caolanm@redhat.com>
---
 sw/source/filter/ww8/ww8par.cxx  |  92 ++++++++++++++------------
 sw/source/filter/ww8/ww8par.hxx  | 135 +++++++++++++++++++++++++++++++++++++--
 sw/source/filter/ww8/ww8par2.cxx |  71 +++++++++++---------
 sw/source/filter/ww8/ww8par2.hxx | 121 -----------------------------------
 sw/source/filter/ww8/ww8par3.cxx |  15 +++--
 sw/source/filter/ww8/ww8par5.cxx |   8 +--
 sw/source/filter/ww8/ww8par6.cxx |  76 +++++++++++-----------
 7 files changed, 274 insertions(+), 244 deletions(-)

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index f1f2745071..ce86fd2cc9 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -958,9 +958,9 @@ void SwWW8ImplReader::Read_StyleCode( sal_uInt16, const sal_uInt8* pData, short
         nColl = *pData;
     else
         nColl = SVBT16ToShort(pData);
-    if (nColl < nColls)
+    if (nColl < vColl.size())
     {
-        SetTxtFmtCollAndListLevel( *pPaM, pCollA[nColl] );
+        SetTxtFmtCollAndListLevel( *pPaM, vColl[nColl] );
         bCpxStyle = true;
     }
 }
@@ -1210,8 +1210,8 @@ const SfxPoolItem* SwWW8FltControlStack::GetFmtAttr(const SwPosition& rPos,
                 SfxItemState eState = SFX_ITEM_DEFAULT;
                 if (const SfxItemSet *pSet = pNd->GetpSwAttrSet())
                     eState = pSet->GetItemState(RES_LR_SPACE, false);
-                if (eState != SFX_ITEM_SET && rReader.pCollA != NULL)
-                    pItem = &(rReader.pCollA[rReader.nAktColl].maWordLR);
+                if (eState != SFX_ITEM_SET && !rReader.vColl.empty() && rReader.nAktColl < rReader.vColl.size())
+                    pItem = &(rReader.vColl[rReader.nAktColl].maWordLR);
             }
 
             /*
@@ -1371,16 +1371,18 @@ void SwWW8ImplReader::Read_Tab(sal_uInt16 , const sal_uInt8* pData, short nLen)
 
     const SwTxtFmtColl* pSty = 0;
     sal_uInt16 nTabBase;
-    if (pAktColl)               // StyleDef
+    if (pAktColl && nAktColl < vColl.size())               // StyleDef
     {
-        nTabBase = pCollA[nAktColl].nBase;
-        if (nTabBase < nColls)              // Based On
-            pSty = (const SwTxtFmtColl*)pCollA[nTabBase].pFmt;
+        nTabBase = vColl[nAktColl].nBase;
+        if (nTabBase < vColl.size())              // Based On
+            pSty = (const SwTxtFmtColl*)vColl[nTabBase].pFmt;
     }
     else
     {                                       // Text
         nTabBase = nAktColl;
-        pSty = (const SwTxtFmtColl*)pCollA[nAktColl].pFmt;
+        if (nAktColl < vColl.size())
+            pSty = (const SwTxtFmtColl*)vColl[nAktColl].pFmt;
+        //TODO figure else here
     }
 
     bool bFound = false;
@@ -1397,11 +1399,11 @@ void SwWW8ImplReader::Read_Tab(sal_uInt16 , const sal_uInt8* pData, short nLen)
 
             sal_uInt16 nOldTabBase = nTabBase;
             // If based on another
-            if (nTabBase < nColls)
-                nTabBase = pCollA[nTabBase].nBase;
+            if (nTabBase < vColl.size())
+                nTabBase = vColl[nTabBase].nBase;
 
             if (
-                    nTabBase < nColls &&
+                    nTabBase < vColl.size() &&
                     nOldTabBase != nTabBase &&
                     nTabBase != ww::stiNil
                )
@@ -1409,7 +1411,9 @@ void SwWW8ImplReader::Read_Tab(sal_uInt16 , const sal_uInt8* pData, short nLen)
                 // #i61789: Stop searching when next style is the same as the
                 // current one (prevent loop)
                 aLoopWatch.insert(reinterpret_cast<size_t>(pSty));
-                pSty = (const SwTxtFmtColl*)pCollA[nTabBase].pFmt;
+                if (nTabBase < vColl.size())
+                   pSty = (const SwTxtFmtColl*)vColl[nTabBase].pFmt;
+                //TODO figure out the else branch
 
                 if (aLoopWatch.find(reinterpret_cast<size_t>(pSty)) !=
                     aLoopWatch.end())
@@ -2393,10 +2397,10 @@ CharSet SwWW8ImplReader::GetCurrentCharSet()
     {
         if (!maFontSrcCharSets.empty())
             eSrcCharSet = maFontSrcCharSets.top();
-        if ((eSrcCharSet == RTL_TEXTENCODING_DONTKNOW) && (nCharFmt != -1))
-            eSrcCharSet = pCollA[nCharFmt].GetCharSet();
-        if ((eSrcCharSet == RTL_TEXTENCODING_DONTKNOW) && StyleExists(nAktColl))
-            eSrcCharSet = pCollA[nAktColl].GetCharSet();
+        if ((eSrcCharSet == RTL_TEXTENCODING_DONTKNOW) && (nCharFmt != -1) && nCharFmt >= 0 && (size_t)nCharFmt < vColl.size() )
+            eSrcCharSet = vColl[nCharFmt].GetCharSet();
+        if ((eSrcCharSet == RTL_TEXTENCODING_DONTKNOW) && StyleExists(nAktColl) && nAktColl < vColl.size())
+            eSrcCharSet = vColl[nAktColl].GetCharSet();
         if (eSrcCharSet == RTL_TEXTENCODING_DONTKNOW)
         { // patch from cmc for #i52786#
             /*
@@ -2453,12 +2457,12 @@ CharSet SwWW8ImplReader::GetCurrentCJKCharSet()
     {
         if (!maFontSrcCJKCharSets.empty())
             eSrcCharSet = maFontSrcCJKCharSets.top();
-        if (pCollA != NULL)
+        if (!vColl.empty())
         {
-            if ((eSrcCharSet == RTL_TEXTENCODING_DONTKNOW) && (nCharFmt != -1))
-                eSrcCharSet = pCollA[nCharFmt].GetCJKCharSet();
-            if (eSrcCharSet == RTL_TEXTENCODING_DONTKNOW)
-                eSrcCharSet = pCollA[nAktColl].GetCJKCharSet();
+            if ((eSrcCharSet == RTL_TEXTENCODING_DONTKNOW) && (nCharFmt != -1) && nCharFmt >= 0 && (size_t)nCharFmt < vColl.size() )
+                eSrcCharSet = vColl[nCharFmt].GetCJKCharSet();
+            if (eSrcCharSet == RTL_TEXTENCODING_DONTKNOW && nAktColl < vColl.size())
+                eSrcCharSet = vColl[nAktColl].GetCJKCharSet();
         }
         if (eSrcCharSet == RTL_TEXTENCODING_DONTKNOW)
         { // patch from cmc for #i52786#
@@ -3179,7 +3183,7 @@ void SwWW8ImplReader::ProcessAktCollChange(WW8PLCFManResult& rRes,
     nAktColl = pPlcxMan->GetColl();
 
     // Invalid Style-Id
-    if (nAktColl >= nColls || !pCollA[nAktColl].pFmt || !pCollA[nAktColl].bColl)
+    if (nAktColl >= vColl.size() || !vColl[nAktColl].pFmt || !vColl[nAktColl].bColl)
     {
         nAktColl = 0;
         bParaAutoBefore = false;
@@ -3187,10 +3191,13 @@ void SwWW8ImplReader::ProcessAktCollChange(WW8PLCFManResult& rRes,
     }
     else
     {
-        bParaAutoBefore = pCollA[nAktColl].bParaAutoBefore;
-        bParaAutoAfter = pCollA[nAktColl].bParaAutoAfter;
+        bParaAutoBefore = vColl[nAktColl].bParaAutoBefore;
+        bParaAutoAfter = vColl[nAktColl].bParaAutoAfter;
     }
 
+    if (nOldColl >= vColl.size())
+        nOldColl = 0; //guess! TODO make sure this is what we want
+
     bool bTabRowEnd = false;
     if( pStartAttr && bCallProcessSpecial && !bInHyperlink )
     {
@@ -3203,10 +3210,10 @@ void SwWW8ImplReader::ProcessAktCollChange(WW8PLCFManResult& rRes,
 
     if (!bTabRowEnd && StyleExists(nAktColl))
     {
-        SetTxtFmtCollAndListLevel( *pPaM, pCollA[ nAktColl ]);
-        ChkToggleAttr(pCollA[ nOldColl ].n81Flags, pCollA[ nAktColl ].n81Flags);
-        ChkToggleBiDiAttr(pCollA[nOldColl].n81BiDiFlags,
-            pCollA[nAktColl].n81BiDiFlags);
+        SetTxtFmtCollAndListLevel( *pPaM, vColl[ nAktColl ]);
+        ChkToggleAttr(vColl[ nOldColl ].n81Flags, vColl[ nAktColl ].n81Flags);
+        ChkToggleBiDiAttr(vColl[nOldColl].n81BiDiFlags,
+            vColl[nAktColl].n81BiDiFlags);
     }
 }
 
@@ -3342,8 +3349,8 @@ void SwWW8ImplReader::ReadAttrs(WW8_CP& rNext, WW8_CP& rTxtPos, bool& rbStartLin
 // nicht im Plcx.Fkp.papx eingetragen, d.h. ( nFlags & MAN_MASK_NEW_PAP )
 // ist false. Deshalb muss als Sonderbehandlung hier die Vorlage gesetzt
 // werden.
-        if (!bCpxStyle && nAktColl < nColls)
-            SetTxtFmtCollAndListLevel(*pPaM, pCollA[nAktColl]);
+        if (!bCpxStyle && nAktColl < vColl.size())
+            SetTxtFmtCollAndListLevel(*pPaM, vColl[nAktColl]);
         rbStartLine = false;
     }
 }
@@ -3598,7 +3605,6 @@ SwWW8ImplReader::SwWW8ImplReader(sal_uInt8 nVersionPara, SvStorage* pStorage,
     pAktColl = 0;
     pLstManager = 0;
     pAktItemSet = 0;
-    pCollA = 0;
     pDfltTxtFmtColl = 0;
     pStandardFmtColl = 0;
     pHdFt = 0;
@@ -3608,7 +3614,7 @@ SwWW8ImplReader::SwWW8ImplReader(sal_uInt8 nVersionPara, SvStorage* pStorage,
     pFmtOfJustInsertedApo = 0;
     pPreviousNumPaM = 0;
     pPrevNumRule = 0;
-    nColls = nAktColl = 0;
+    nAktColl = 0;
     nObjLocFc = nPicLocFc = 0;
     nInTable=0;
     bReadNoTbl = bPgSecBreak = bSpec = bObj = bTxbxFlySection
@@ -4427,7 +4433,7 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss, const SwPosition &rPos)
     ::SetProgressState(nProgress, mpDocShell);    // Update
     pStyles->PostProcessStyles();
 
-    if (pCollA)
+    if (!vColl.empty())
         SetOutLineStyles();
 
     pSBase = new WW8ScannerBase(pStrm,pTableStream,pDataStream,pWwFib);
@@ -4654,8 +4660,7 @@ sal_uLong SwWW8ImplReader::CoreLoad(WW8Glossary *pGloss, const SwPosition &rPos)
     maInsertedTables.DelAndMakeTblFrms();
     maSectionManager.InsertSegments();
 
-    if (pCollA)
-        delete[] pCollA;
+    vColl.clear();
 
     DELETEZ( pStyles );
 
@@ -5149,16 +5154,16 @@ void SwWW8ImplReader::SetOutLineStyles()
         pick the one that affects most styles. If we're not importing a new
         document, we got to stick with what is already there.
         */
-        // use index in text format collection array <pCollA>
+        // use index in text format collection array <vColl>
         // as key of the outline numbering map <aRuleMap>
         // instead of the memory pointer of the outline numbering rule
         // to assure that, if two outline numbering rule affect the same
         // count of text formats, always the same outline numbering rule is chosen.
         std::map<sal_uInt16, int>aRuleMap;
         typedef std::map<sal_uInt16, int>::iterator myIter;
-        for (sal_uInt16 nI = 0; nI < nColls; ++nI)
+        for (sal_uInt16 nI = 0; nI < vColl.size(); ++nI)
         {
-            SwWW8StyInf& rSI = pCollA[ nI ];
+            SwWW8StyInf& rSI = vColl[ nI ];
             if (
                 (MAXLEVEL > rSI.nOutlineLevel) && rSI.pOutlineNumrule &&
                 rSI.pFmt
@@ -5181,7 +5186,10 @@ void SwWW8ImplReader::SetOutLineStyles()
             if (aIter->second > nMax)
             {
                 nMax = aIter->second;
-                mpChosenOutlineNumRule = pCollA[ aIter->first ].pOutlineNumrule;
+                if(aIter->first < vColl.size())
+                    mpChosenOutlineNumRule = vColl[ aIter->first ].pOutlineNumrule;
+                else
+                    mpChosenOutlineNumRule = 0; //TODO make sure this is what we want
             }
         }
         // <--
@@ -5208,9 +5216,9 @@ void SwWW8ImplReader::SetOutLineStyles()
 
     sal_uInt16 nOldFlags = nFlagsStyleOutlLevel;
 
-    for (sal_uInt16 nI = 0; nI < nColls; ++nI)
+    for (sal_uInt16 nI = 0; nI < vColl.size(); ++nI)
     {
-        SwWW8StyInf& rSI = pCollA[nI];
+        SwWW8StyInf& rSI = vColl[nI];
 
         if (rSI.IsOutlineNumbered())
         {
diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index e666861893..2fb1cee578 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -50,6 +50,12 @@
 #include <xmloff/odffields.hxx>
 #include <IMark.hxx>
 
+#include <swtypes.hxx>  // enum RndStdIds
+#include <fmtfsize.hxx>
+#include <fmtornt.hxx>
+#include <fmtsrnd.hxx>
+#include <editeng/lrspitem.hxx>
+
 class SwDoc;
 class SwPaM;
 class SfxPoolItem;
@@ -64,7 +70,6 @@ class SwNumRule;
 class SwFrmFmt;
 class Writer;
 class SwFmtFld;
-class SwWW8StyInf;
 class WW8Fib;
 class WW8PLCFMan;
 struct WW8PLCFManResult;
@@ -177,6 +182,7 @@ struct WW8OleMap
     }
 };
 
+
 class SwWW8ImplReader;
 struct WW8LSTInfo;
 class WW8ListManager
@@ -223,6 +229,128 @@ private:
     sal_uInt16 nLastLFOPosition;
 };
 
+struct WW8FlyPara
+{                       // WinWord-Attribute
+                        // Achtung: *Nicht* umsortieren, da Teile mit
+                        // memcmp verglichen werden
+    bool bVer67;
+    sal_Int16 nSp26, nSp27;         // rohe Position
+    sal_Int16 nSp45, nSp28;         // Breite / Hoehe
+    sal_Int16 nLeMgn, nRiMgn, nUpMgn, nLoMgn;           // Raender
+    sal_uInt8 nSp29;                 // rohe Bindung + Alignment
+    sal_uInt8 nSp37;                 // Wrap-Mode ( 1 / 2; 0 = no Apo ? )
+    WW8_BRC5 brc;               // Umrandung Top, Left, Bottom, Right, Between
+    bool bBorderLines;          // Umrandungslinien
+    bool bGrafApo;              // true: Dieser Rahmen dient allein dazu, die
+                                // enthaltene Grafik anders als zeichengebunden
+                                // zu positionieren
+    bool mbVertSet;             // true if vertical positioning has been set
+    sal_uInt8 nOrigSp29;
+
+    WW8FlyPara(bool bIsVer67, const WW8FlyPara* pSrc = 0);
+    bool operator==(const WW8FlyPara& rSrc) const;
+    void Read(const sal_uInt8* pSprm29, WW8PLCFx_Cp_FKP* pPap);
+    void ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo);
+    void Read(const sal_uInt8* pSprm29, WW8RStyle* pStyle);
+    void ApplyTabPos(const WW8_TablePos *pTabPos);
+    bool IsEmpty() const;
+};
+
+class SwWW8StyInf
+{
+    String      sWWStyleName;
+    sal_uInt16      nWWStyleId;
+public:
+    rtl_TextEncoding eLTRFontSrcCharSet;    // rtl_TextEncoding fuer den Font
+    rtl_TextEncoding eRTLFontSrcCharSet;    // rtl_TextEncoding fuer den Font
+    rtl_TextEncoding eCJKFontSrcCharSet;    // rtl_TextEncoding fuer den Font
+    SwFmt*      pFmt;
+    WW8FlyPara* pWWFly;
+    SwNumRule*  pOutlineNumrule;
+    long        nFilePos;
+    sal_uInt16      nBase;
+    sal_uInt16      nFollow;
+    sal_uInt16      nLFOIndex;
+    sal_uInt8        nListLevel;
+    sal_uInt8        nOutlineLevel;      // falls Gliederungs-Style
+    sal_uInt16  n81Flags;           // Fuer Bold, Italic, ...
+    sal_uInt16  n81BiDiFlags;       // Fuer Bold, Italic, ...
+    SvxLRSpaceItem maWordLR;
+    bool bValid;            // leer oder Valid
+    bool bImported;         // fuers rekursive Importieren
+    bool bColl;             // true-> pFmt ist SwTxtFmtColl
+    bool bImportSkipped;    // nur true bei !bNewDoc && vorh. Style
+    bool bHasStyNumRule;    // true-> Benannter NumRule in Style
+    bool bHasBrokenWW6List; // true-> WW8+ style has a WW7- list
+    bool bListReleventIndentSet; //true if this style's indent has
+                                 //been explicitly set, it's set to the value
+                                 //of pFmt->GetItemState(RES_LR_SPACE, false)
+                                 //if it was possible to get the ItemState
+                                 //for L of the LR space independantly
+    bool bParaAutoBefore;   // For Auto spacing before a paragraph
+    bool bParaAutoAfter;    // For Auto Spacing after a paragraph
+
+    SwWW8StyInf() :
+        sWWStyleName( aEmptyStr ),
+        nWWStyleId( 0 ),
+        eLTRFontSrcCharSet(0),
+        eRTLFontSrcCharSet(0),
+        eCJKFontSrcCharSet(0),
+        pFmt( 0 ),
+        pWWFly( 0 ),
+        pOutlineNumrule( 0 ),
+        nFilePos( 0 ),
+        nBase( 0 ),
+        nFollow( 0 ),
+        nLFOIndex( USHRT_MAX ),
+        nListLevel(WW8ListManager::nMaxLevel),
+        nOutlineLevel( MAXLEVEL ),
+        n81Flags( 0 ),
+        n81BiDiFlags(0),
+        maWordLR( RES_LR_SPACE ),
+        bValid(false),
+        bImported(false),
+        bColl(false),
+        bImportSkipped(false),
+        bHasStyNumRule(false),
+        bHasBrokenWW6List(false),
+        bListReleventIndentSet(false),
+        bParaAutoBefore(false),
+        bParaAutoAfter(false)
+
+    {}
+
+    ~SwWW8StyInf()
+    {
+        delete pWWFly;
+    }
+
+    void SetOrgWWIdent( const String& rName, const sal_uInt16 nId )
+    {
+        sWWStyleName = rName;
+        nWWStyleId = nId;
+    }
+    sal_uInt16 GetWWStyleId() const { return nWWStyleId; }
+    const String& GetOrgWWName() const
+    {
+        return sWWStyleName;
+    }
+    bool IsOutline() const
+    {
+        return (pFmt && (MAXLEVEL > nOutlineLevel));
+    }
+    bool IsOutlineNumbered() const
+    {
+        return pOutlineNumrule && IsOutline();
+    }
+    const SwNumRule* GetOutlineNumrule() const
+    {
+        return pOutlineNumrule;
+    }
+    CharSet GetCharSet() const;
+    CharSet GetCJKCharSet() const;
+};
+
 //-----------------------------------------
 //            Stack
 //-----------------------------------------
@@ -948,7 +1076,7 @@ private:
                             // ( ist ausserhalb einer Style-Def immer 0 )
     SfxItemSet* pAktItemSet;// gerade einzulesende Zeichenattribute
                             // (ausserhalb des WW8ListManager Ctor's immer 0)
-    SwWW8StyInf* pCollA;    // UEbersetzungs-Array der Styles
+    std::vector<SwWW8StyInf> vColl;
     const SwTxtFmtColl* pDfltTxtFmtColl;    // Default
     SwFmt* pStandardFmtColl;// "Standard"
 
@@ -1000,7 +1128,6 @@ private:
     rtl_TextEncoding eStructCharSet;  // rtl_TextEncoding for structures
     rtl_TextEncoding eHardCharSet;    // Hard rtl_TextEncoding-Attribute
     sal_uInt16 nProgress;           // %-Angabe fuer Progressbar
-    sal_uInt16 nColls;              // Groesse des Arrays
     sal_uInt16 nAktColl;            // gemaess WW-Zaehlung
     sal_uInt16 nFldNum;             // laufende Nummer dafuer
     sal_uInt16 nLFOPosition;
@@ -1089,7 +1216,7 @@ private:
 
     const SprmReadInfo& GetSprmReadInfo(sal_uInt16 nId) const;
 
-    bool StyleExists(int nColl) const { return (nColl < nColls); }
+    bool StyleExists(unsigned int nColl) const { return (nColl < vColl.size()); }
     SwWW8StyInf *GetStyle(sal_uInt16 nColl) const;
     void AppendTxtNode(SwPosition& rPos);
 
diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index 9e8324b212..4ab1be3502 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -526,8 +526,8 @@ ApoTestResults SwWW8ImplReader::TestApo(int nCellLevel, bool bTableRowEnd,
     ApoTestResults aRet;
     // Frame in Style Definition (word appears to ignore them if inside an
     // text autoshape)
-    if (!bTxbxFlySection)
-        aRet.mpStyleApo = StyleExists(nAktColl) ? pCollA[nAktColl].pWWFly : 0;
+    if (!bTxbxFlySection && nAktColl < vColl.size())
+        aRet.mpStyleApo = StyleExists(nAktColl) ? vColl[nAktColl].pWWFly : 0;
 
     /*
     #i1140#
@@ -838,7 +838,7 @@ void SwWW8ImplReader::Read_ANLevelNo( sal_uInt16, const sal_uInt8* pData, short
 void SwWW8ImplReader::Read_ANLevelDesc( sal_uInt16, const sal_uInt8* pData, short nLen ) // Sprm 12
 {
     {
-        SwWW8StyInf * pStyInf = GetStyle(nAktColl);    
+        SwWW8StyInf * pStyInf = GetStyle(nAktColl);
         if( !pAktColl || nLen <= 0                  // nur bei Styledef
             || (pStyInf && !pStyInf->bColl)              // CharFmt -> ignorieren
             || ( nIniFlags & WW8FL_NO_OUTLINE ) ){
@@ -3664,11 +3664,11 @@ bool SwWW8ImplReader::IsInvalidOrToBeMergedTabCell() const
 sal_uInt16 SwWW8ImplReader::StyleUsingLFO( sal_uInt16 nLFOIndex ) const
 {
     sal_uInt16 nRes = USHRT_MAX;
-    if( pCollA )
+    if( !vColl.empty() )
     {
         for(sal_uInt16 nI = 0; nI < pStyles->GetCount(); nI++ )
-            if(    pCollA[ nI ].bValid
-                && (nLFOIndex == pCollA[ nI ].nLFOIndex) )
+            if(    vColl[ nI ].bValid
+                && (nLFOIndex == vColl[ nI ].nLFOIndex) )
                 nRes = nI;
     }
     return nRes;
@@ -3677,13 +3677,13 @@ sal_uInt16 SwWW8ImplReader::StyleUsingLFO( sal_uInt16 nLFOIndex ) const
 const SwFmt* SwWW8ImplReader::GetStyleWithOrgWWName( String& rName ) const
 {
     SwFmt* pRet = 0;
-    if( pCollA )
+    if( !vColl.empty() )
     {
         for(sal_uInt16 nI = 0; nI < pStyles->GetCount(); nI++ )
-            if(    pCollA[ nI ].bValid
-                && (rName.Equals( pCollA[ nI ].GetOrgWWName())) )
+            if(    vColl[ nI ].bValid
+                && (rName.Equals( vColl[ nI ].GetOrgWWName())) )
             {
-                pRet = pCollA[ nI ].pFmt;
+                pRet = vColl[ nI ].pFmt;
                 break;
             }
     }
@@ -3838,8 +3838,7 @@ WW8RStyle::WW8RStyle(WW8Fib& _rFib, SwWW8ImplReader* pI)
     : WW8Style(*pI->pTableStream, _rFib), maSprmParser(_rFib.GetFIBVersion()),
     pIo(pI), pStStrm(pI->pTableStream), pStyRule(0), nWwNumLevel(0)
 {
-    pIo->nColls = cstd;
-    pIo->pCollA = cstd ? new SwWW8StyInf[ cstd ] : NULL; // Style-UEbersetzung WW->SW
+    pIo->vColl.resize(cstd);
 }
 
 void WW8RStyle::Set1StyleDefaults()
@@ -3931,7 +3930,7 @@ bool WW8RStyle::PrepareStyle(SwWW8StyInf &rSI, ww::sti eSti, sal_uInt16 nThisSty
     sal_uInt16 j = rSI.nBase;
     if (j != nThisStyle && j < cstd )
     {
-        SwWW8StyInf* pj = &pIo->pCollA[j];
+        SwWW8StyInf* pj = &pIo->vColl[j];
         if (rSI.pFmt && pj->pFmt && rSI.bColl == pj->bColl)
         {
             rSI.pFmt->SetDerivedFrom( pj->pFmt );  // ok, Based on eintragen
@@ -3971,7 +3970,7 @@ void WW8RStyle::PostStyle(SwWW8StyInf &rSI, bool bOldNoImp)
     pIo->nCharFmt = -1;
 
     // If Style basiert auf Nichts oder Basis ignoriert
-    if ((rSI.nBase >= cstd || pIo->pCollA[rSI.nBase].bImportSkipped) && rSI.bColl)
+    if ((rSI.nBase >= cstd || pIo->vColl[rSI.nBase].bImportSkipped) && rSI.bColl)
     {
         //! Char-Styles funktionieren aus
         // unerfindlichen Gruenden nicht
@@ -3992,7 +3991,10 @@ void WW8RStyle::PostStyle(SwWW8StyInf &rSI, bool bOldNoImp)
 
 void WW8RStyle::Import1Style( sal_uInt16 nNr )
 {
-    SwWW8StyInf &rSI = pIo->pCollA[nNr];
+    if (nNr >= pIo->vColl.size())
+        return;
+
+    SwWW8StyInf &rSI = pIo->vColl[nNr];
 
     if( rSI.bImported || !rSI.bValid )
         return;
@@ -4002,7 +4004,7 @@ void WW8RStyle::Import1Style( sal_uInt16 nNr )
                                                 //
     // gueltig und nicht NIL und noch nicht Importiert
 
-    if( rSI.nBase < cstd && !pIo->pCollA[rSI.nBase].bImported )
+    if( rSI.nBase < cstd && !pIo->vColl[rSI.nBase].bImported )
         Import1Style( rSI.nBase );
 
     pStStrm->Seek( rSI.nFilePos );
@@ -4045,13 +4047,16 @@ void WW8RStyle::Import1Style( sal_uInt16 nNr )
 
 void WW8RStyle::RecursiveReg(sal_uInt16 nNr)
 {
-    SwWW8StyInf &rSI = pIo->pCollA[nNr];
+    if (nNr >= pIo->vColl.size())
+        return;
+
+    SwWW8StyInf &rSI = pIo->vColl[nNr];
     if( rSI.bImported || !rSI.bValid )
         return;
 
     rSI.bImported = true;
 
-    if( rSI.nBase < cstd && !pIo->pCollA[rSI.nBase].bImported )
+    if( rSI.nBase < cstd && !pIo->vColl[rSI.nBase].bImported )
         RecursiveReg(rSI.nBase);
 
     pIo->RegisterNumFmtOnStyle(nNr);
@@ -4071,7 +4076,7 @@ void WW8RStyle::PostProcessStyles()
      formats and use it to mark handled ones
     */
     for (i=0; i < cstd; ++i)
-        pIo->pCollA[i].bImported = false;
+        pIo->vColl[i].bImported = false;
 
     /*
      Register the num formats and tabstop changes on the styles recursively.
@@ -4086,7 +4091,7 @@ void WW8RStyle::PostProcessStyles()
     */
     for (i=0; i < cstd; ++i)
     {
-        if (pIo->pCollA[i].bValid)
+        if (pIo->vColl[i].bValid)
         {
             RecursiveReg(i);
         }
@@ -4098,7 +4103,7 @@ void WW8RStyle::ScanStyles()        // untersucht Style-Abhaengigkeiten
     for (sal_uInt16 i = 0; i < cstd; ++i)
     {
         short nSkip;
-        SwWW8StyInf &rSI = pIo->pCollA[i];
+        SwWW8StyInf &rSI = pIo->vColl[i];
 
         rSI.nFilePos = pStStrm->Tell();        // merke FilePos
         WW8_STD* pStd = Read1Style( nSkip, 0, 0 );  // read STD
@@ -4355,9 +4360,9 @@ void WW8RStyle::ImportOldFormatStyles()
 {
     for (sal_uInt16 i=0; i < cstd; ++i)
     {
-        pIo->pCollA[i].bColl = true;
+        pIo->vColl[i].bColl = true;
         //every chain must end eventually at the null style (style code 222)
-        pIo->pCollA[i].nBase = 222;
+        pIo->vColl[i].nBase = 222;
     }
 
     rtl_TextEncoding eStructChrSet = WW8Fib::GetFIBCharset(
@@ -4377,7 +4382,10 @@ void WW8RStyle::ImportOldFormatStyles()
         nByteCount++;
 
         sal_uInt8 stc = static_cast< sal_uInt8 >((stcp - cstcStd) & 255);
-        SwWW8StyInf &rSI = pIo->pCollA[stc];
+        if (stc >=pIo->vColl.size())
+            continue;
+
+        SwWW8StyInf &rSI = pIo->vColl[stc];
         if (nCount != 0xFF)    // undefined style
         {
             String sName;
@@ -4507,7 +4515,7 @@ void WW8RStyle::ImportOldFormatStyles()
         if (stc == stcBase)
             stcBase = 222;
 
-        SwWW8StyInf &rSI = pIo->pCollA[stc];
+        SwWW8StyInf &rSI = pIo->vColl[stc];
         rSI.nBase = stcBase;
 
         ww::sti eSti = ww::GetCanonicalStiFromStc(stc);
@@ -4518,7 +4526,7 @@ void WW8RStyle::ImportOldFormatStyles()
         rSI.bValid = true;
 
         if (ww::StandardStiIsCharStyle(eSti) && !aPAPXOffsets[stcp].mnSize)
-            pIo->pCollA[stc].bColl = false;
+            pIo->vColl[stc].bColl = false;
 
         bool bOldNoImp = PrepareStyle(rSI, eSti, stc, stcNext);
 
@@ -4539,7 +4547,7 @@ void WW8RStyle::ImportNewFormatStyles()
     ScanStyles();                       // Scanne Based On
 
     for (sal_uInt16 i = 0; i < cstd; ++i) // import Styles
-        if (pIo->pCollA[i].bValid)
+        if (pIo->vColl[i].bValid)
             Import1Style( i );
 }
 
@@ -4565,11 +4573,11 @@ void WW8RStyle::Import()
     for (sal_uInt16 i = 0; i < cstd; ++i)
     {
         // Follow chain
-        SwWW8StyInf* pi = &pIo->pCollA[i];
+        SwWW8StyInf* pi = &pIo->vColl[i];
         sal_uInt16 j = pi->nFollow;
         if( j < cstd )
         {
-            SwWW8StyInf* pj = &pIo->pCollA[j];
+            SwWW8StyInf* pj = &pIo->vColl[j];
             if ( j != i                             // sinnvoller Index ?
                  && pi->pFmt                        // Format ok ?
                  && pj->pFmt                        // Derived-Format ok ?
@@ -4589,8 +4597,9 @@ void WW8RStyle::Import()
 //
     // fuer z.B. Tabellen wird ein immer gueltiger Std-Style gebraucht
 
-    if( pIo->StyleExists(0) && pIo->pCollA[0].pFmt && pIo->pCollA[0].bColl && pIo->pCollA[0].bValid )
-        pIo->pDfltTxtFmtColl = (SwTxtFmtColl*)pIo->pCollA[0].pFmt;
+    if( pIo->StyleExists(0) && !pIo->vColl.empty() &&
+        pIo->vColl[0].pFmt && pIo->vColl[0].bColl && pIo->vColl[0].bValid )
+        pIo->pDfltTxtFmtColl = (SwTxtFmtColl*)pIo->vColl[0].pFmt;
     else
         pIo->pDfltTxtFmtColl = pIo->rDoc.GetDfltTxtFmtColl();
 
diff --git a/sw/source/filter/ww8/ww8par2.hxx b/sw/source/filter/ww8/ww8par2.hxx
index 2dba225037..dae3e9537e 100644
--- a/sw/source/filter/ww8/ww8par2.hxx
+++ b/sw/source/filter/ww8/ww8par2.hxx
@@ -53,32 +53,6 @@ private:
     SfxItemSet aChrSet,aParSet;
 };
 
-struct WW8FlyPara
-{                       // WinWord-Attribute
-                        // Achtung: *Nicht* umsortieren, da Teile mit
-                        // memcmp verglichen werden
-    bool bVer67;
-    sal_Int16 nSp26, nSp27;         // rohe Position
-    sal_Int16 nSp45, nSp28;         // Breite / Hoehe
-    sal_Int16 nLeMgn, nRiMgn, nUpMgn, nLoMgn;           // Raender
-    sal_uInt8 nSp29;                 // rohe Bindung + Alignment
-    sal_uInt8 nSp37;                 // Wrap-Mode ( 1 / 2; 0 = no Apo ? )
-    WW8_BRC5 brc;               // Umrandung Top, Left, Bottom, Right, Between
-    bool bBorderLines;          // Umrandungslinien
-    bool bGrafApo;              // true: Dieser Rahmen dient allein dazu, die
-                                // enthaltene Grafik anders als zeichengebunden
-                                // zu positionieren
-    bool mbVertSet;             // true if vertical positioning has been set
-    sal_uInt8 nOrigSp29;
-
-    WW8FlyPara(bool bIsVer67, const WW8FlyPara* pSrc = 0);
-    bool operator==(const WW8FlyPara& rSrc) const;
-    void Read(const sal_uInt8* pSprm29, WW8PLCFx_Cp_FKP* pPap);
-    void ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo);
-    void Read(const sal_uInt8* pSprm29, WW8RStyle* pStyle);
-    void ApplyTabPos(const WW8_TablePos *pTabPos);
-    bool IsEmpty() const;
-};
 
 struct WW8SwFlyPara
 {
@@ -122,101 +96,6 @@ struct WW8SwFlyPara
     SwWW8FltAnchorStack *pOldAnchorStck;
 };
 
-class SwWW8StyInf
-{
-    String      sWWStyleName;
-    sal_uInt16      nWWStyleId;
-public:
-    rtl_TextEncoding eLTRFontSrcCharSet;    // rtl_TextEncoding fuer den Font
-    rtl_TextEncoding eRTLFontSrcCharSet;    // rtl_TextEncoding fuer den Font
-    rtl_TextEncoding eCJKFontSrcCharSet;    // rtl_TextEncoding fuer den Font
-    SwFmt*      pFmt;
-    WW8FlyPara* pWWFly;
-    SwNumRule*  pOutlineNumrule;
-    long        nFilePos;
-    sal_uInt16      nBase;
-    sal_uInt16      nFollow;
-    sal_uInt16      nLFOIndex;
-    sal_uInt8        nListLevel;
-    sal_uInt8        nOutlineLevel;      // falls Gliederungs-Style
-    sal_uInt16  n81Flags;           // Fuer Bold, Italic, ...
-    sal_uInt16  n81BiDiFlags;       // Fuer Bold, Italic, ...
-    SvxLRSpaceItem maWordLR;
-    bool bValid;            // leer oder Valid
-    bool bImported;         // fuers rekursive Importieren
-    bool bColl;             // true-> pFmt ist SwTxtFmtColl
-    bool bImportSkipped;    // nur true bei !bNewDoc && vorh. Style
-    bool bHasStyNumRule;    // true-> Benannter NumRule in Style
-    bool bHasBrokenWW6List; // true-> WW8+ style has a WW7- list
-    bool bListReleventIndentSet; //true if this style's indent has
-                                 //been explicitly set, it's set to the value
-                                 //of pFmt->GetItemState(RES_LR_SPACE, false)
-                                 //if it was possible to get the ItemState
-                                 //for L of the LR space independantly
-    bool bParaAutoBefore;   // For Auto spacing before a paragraph
-    bool bParaAutoAfter;    // For Auto Spacing after a paragraph
-
-    SwWW8StyInf() :
-        sWWStyleName( aEmptyStr ),
-        nWWStyleId( 0 ),
-        eLTRFontSrcCharSet(0),
-        eRTLFontSrcCharSet(0),
-        eCJKFontSrcCharSet(0),
-        pFmt( 0 ),
-        pWWFly( 0 ),
-        pOutlineNumrule( 0 ),
-        nFilePos( 0 ),
-        nBase( 0 ),
-        nFollow( 0 ),
-        nLFOIndex( USHRT_MAX ),
-        nListLevel(WW8ListManager::nMaxLevel),
-        nOutlineLevel( MAXLEVEL ),
-        n81Flags( 0 ),
-        n81BiDiFlags(0),
-        maWordLR( RES_LR_SPACE ),
-        bValid(false),
-        bImported(false),
-        bColl(false),
-        bImportSkipped(false),
-        bHasStyNumRule(false),
-        bHasBrokenWW6List(false),
-        bListReleventIndentSet(false),
-        bParaAutoBefore(false),
-        bParaAutoAfter(false)
-
-    {}
-
-    ~SwWW8StyInf()
-    {
-        delete pWWFly;
-    }
-
-    void SetOrgWWIdent( const String& rName, const sal_uInt16 nId )
-    {
-        sWWStyleName = rName;
-        nWWStyleId = nId;
-    }
-    sal_uInt16 GetWWStyleId() const { return nWWStyleId; }
-    const String& GetOrgWWName() const
-    {
-        return sWWStyleName;
-    }
-    bool IsOutline() const
-    {
-        return (pFmt && (MAXLEVEL > nOutlineLevel));
-    }
-    bool IsOutlineNumbered() const
-    {
-        return pOutlineNumrule && IsOutline();
-    }
-    const SwNumRule* GetOutlineNumrule() const
-    {
-        return pOutlineNumrule;
-    }
-    CharSet GetCharSet() const;
-    CharSet GetCJKCharSet() const;
-};
-
 class WW8RStyle: public WW8Style
 {
 friend class SwWW8ImplReader;
diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index e01547c1ce..c1062daedb 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -1702,7 +1702,10 @@ void SetStyleIndent(SwWW8StyInf &rStyle, const SwNumFmt &rFmt)
 void SwWW8ImplReader::SetStylesList(sal_uInt16 nStyle, sal_uInt16 nActLFO,
     sal_uInt8 nActLevel)
 {
-    SwWW8StyInf &rStyleInf = pCollA[nStyle];
+    if (nStyle >= vColl.size())
+        return;
+
+    SwWW8StyInf &rStyleInf = vColl[nStyle];
     if (rStyleInf.bValid)
     {
         OSL_ENSURE(pAktColl, "Cannot be called outside of style import");
@@ -1738,7 +1741,11 @@ void SwWW8ImplReader::SetStylesList(sal_uInt16 nStyle, sal_uInt16 nActLFO,
 
 void SwWW8ImplReader::RegisterNumFmtOnStyle(sal_uInt16 nStyle)
 {
-    SwWW8StyInf &rStyleInf = pCollA[nStyle];
+
+    if (nStyle >= vColl.size())
+        return;
+
+    SwWW8StyInf &rStyleInf = vColl[nStyle];
     if (rStyleInf.bValid && rStyleInf.pFmt)
     {
         //Save old pre-list modified indent, which are the word indent values
@@ -2033,8 +2040,8 @@ void SwWW8ImplReader::Read_LFOPosition(sal_uInt16, const sal_uInt8* pData,
             indentation.  Setting this flag will allow us to recover from this
             braindeadness
             */
-            if (pAktColl && (nLFOPosition == 2047-1))
-                pCollA[nAktColl].bHasBrokenWW6List = true;
+            if (pAktColl && (nLFOPosition == 2047-1) && nAktColl < vColl.size())
+                vColl[nAktColl].bHasBrokenWW6List = true;
 
             // die Streamdaten sind hier 1 basiert, wir ziehen EINS ab
             if (USHRT_MAX > nLFOPosition)
diff --git a/sw/source/filter/ww8/ww8par5.cxx b/sw/source/filter/ww8/ww8par5.cxx
index 691fef91c8..50f27196ff 100644
--- a/sw/source/filter/ww8/ww8par5.cxx
+++ b/sw/source/filter/ww8/ww8par5.cxx
@@ -2777,9 +2777,9 @@ bool SwWW8ImplReader::AddExtraOutlinesAsExtraStyles(SwTOXBase& rBase)
     bool bExtras = false;
     //This is the case if the winword outline numbering is set while the
     //writer one is not
-    for (sal_uInt16 nI = 0; nI < nColls; ++nI)
+    for (sal_uInt16 nI = 0; nI < vColl.size(); ++nI)
     {
-        SwWW8StyInf& rSI = pCollA[nI];
+        SwWW8StyInf& rSI = vColl[nI];
         if (rSI.IsOutline())
         {
             const SwTxtFmtColl *pFmt = (const SwTxtFmtColl*)(rSI.pFmt);
@@ -3284,9 +3284,9 @@ eF_ResT SwWW8ImplReader::Read_F_Tox( WW8FieldDesc* pF, String& rStr )
                             // the entry correctly, but I currently have no clue how to obtain
                             // the tab stop position. It is _not_ set at the paragraph style.
                             SwForm* pForm = 0;
-                            for (sal_uInt16 nI = 0; nI < nColls; ++nI)
+                            for (sal_uInt16 nI = 0; nI < vColl.size(); ++nI)
                             {
-                                const SwWW8StyInf& rSI = pCollA[nI];
+                                const SwWW8StyInf& rSI = vColl[nI];
                                 if (rSI.IsOutlineNumbered())
                                 {
                                     sal_uInt16 nStyleLevel = rSI.nOutlineLevel;
diff --git a/sw/source/filter/ww8/ww8par6.cxx b/sw/source/filter/ww8/ww8par6.cxx
index 756f757c8c..01520a3b47 100644
--- a/sw/source/filter/ww8/ww8par6.cxx
+++ b/sw/source/filter/ww8/ww8par6.cxx
@@ -284,10 +284,10 @@ void SwWW8ImplReader::SetDocumentGrid(SwFrmFmt &rFmt, const wwSection &rSection)
     sal_uInt32 nCharWidth=240;
     for (sal_uInt16 nI = 0; nI < pStyles->GetCount(); ++nI)
     {
-        if (pCollA[nI].bValid && pCollA[nI].pFmt &&
-            pCollA[nI].GetWWStyleId() == 0)
+        if (vColl[nI].bValid && vColl[nI].pFmt &&
+            vColl[nI].GetWWStyleId() == 0)
         {
-            nCharWidth = ItemGet<SvxFontHeightItem>(*(pCollA[nI].pFmt),
+            nCharWidth = ItemGet<SvxFontHeightItem>(*(vColl[nI].pFmt),
                 RES_CHRATR_CJK_FONTSIZE).GetHeight();
             break;
         }
@@ -1714,9 +1714,9 @@ void WW8FlyPara::ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo)
             WW8FlyPara *pNowStyleApo=0;
             sal_uInt16 nColl = pPap->GetIstd();
             ww::sti eSti = eVer < ww::eWW6 ? ww::GetCanonicalStiFromStc( static_cast< sal_uInt8 >(nColl) ) : static_cast<ww::sti>(nColl);
-            while (eSti != ww::stiNil && 0 == (pNowStyleApo = pIo->pCollA[nColl].pWWFly))
+            while (eSti != ww::stiNil && nColl < pIo->vColl.size() && 0 == (pNowStyleApo = pIo->vColl[nColl].pWWFly))
             {
-                nColl = pIo->pCollA[nColl].nBase;
+                nColl = pIo->vColl[nColl].nBase;
                 eSti = eVer < ww::eWW6 ? ww::GetCanonicalStiFromStc( static_cast< sal_uInt8 >(nColl) ) : static_cast<ww::sti>(nColl);
             }
 
@@ -2664,10 +2664,10 @@ const SfxPoolItem* SwWW8ImplReader::GetFmtAttr( sal_uInt16 nWhich )
         pRet = pCtrlStck->GetStackAttr(*pPaM->GetPoint(), nWhich);
         if (!pRet)
         {
-            if (nAktColl < nColls && pCollA[nAktColl].pFmt &&
-                pCollA[nAktColl].bColl)
+            if (nAktColl < vColl.size() && vColl[nAktColl].pFmt &&
+                vColl[nAktColl].bColl)
             {
-                pRet = &(pCollA[nAktColl].pFmt->GetFmtAttr(nWhich));
+                pRet = &(vColl[nAktColl].pFmt->GetFmtAttr(nWhich));
             }
         }
         if (!pRet)
@@ -2790,7 +2790,7 @@ void SwWW8ImplReader::Read_Symbol(sal_uInt16, const sal_uInt8* pData, short nLen
 
 SwWW8StyInf *SwWW8ImplReader::GetStyle(sal_uInt16 nColl) const
 {
-    return nColl < nColls ? &pCollA[nColl] : 0;
+    return const_cast<SwWW8StyInf *>(nColl < vColl.size() ? &vColl[nColl] : 0);
 }
 
 /***************************************************************************
@@ -2874,8 +2874,8 @@ void SwWW8ImplReader::Read_BoldUsw( sal_uInt16 nId, const sal_uInt8* pData, shor
         {
             // The style based on has Bit 7 set ?
             if (
-                pSI->nBase < nColls && (*pData & 0x80) &&
-                (pCollA[pSI->nBase].n81Flags & nMask)
+                pSI->nBase < vColl.size() && (*pData & 0x80) &&
+                (vColl[pSI->nBase].n81Flags & nMask)
                )
             {
                 bOn = !bOn;                     // umdrehen
@@ -2955,9 +2955,9 @@ void SwWW8ImplReader::Read_BoldBiDiUsw(sal_uInt16 nId, const sal_uInt8* pData,
     {
         if (pSI)
         {
-            if( pSI->nBase < nColls             // Style Based on
+            if( pSI->nBase < vColl.size()             // Style Based on
                 && ( *pData & 0x80 )            // Bit 7 gesetzt ?
-                && ( pCollA[pSI->nBase].n81BiDiFlags & nMask ) ) // BasisMaske ?
+                && ( vColl[pSI->nBase].n81BiDiFlags & nMask ) ) // BasisMaske ?
                     bOn = !bOn;                     // umdrehen
 
             if( bOn )
@@ -3522,19 +3522,19 @@ bool SwWW8ImplReader::SetNewFontAttr(sal_uInt16 nFCode, bool bSetEnums,
 
     if( bSetEnums )
     {
-        if( pAktColl ) // StyleDef
+        if( pAktColl && nAktColl < vColl.size() ) // StyleDef
         {
             switch(nWhich)
             {
                 default:
                 case RES_CHRATR_FONT:
-                    pCollA[nAktColl].eLTRFontSrcCharSet = eSrcCharSet;
+                    vColl[nAktColl].eLTRFontSrcCharSet = eSrcCharSet;
                     break;
                 case RES_CHRATR_CTL_FONT:
-                    pCollA[nAktColl].eRTLFontSrcCharSet = eSrcCharSet;
+                    vColl[nAktColl].eRTLFontSrcCharSet = eSrcCharSet;
                     break;
                 case RES_CHRATR_CJK_FONT:
-                    pCollA[nAktColl].eCJKFontSrcCharSet = eSrcCharSet;
+                    vColl[nAktColl].eCJKFontSrcCharSet = eSrcCharSet;
                     break;
             }
         }
@@ -3762,11 +3762,11 @@ void SwWW8ImplReader::Read_CColl( sal_uInt16, const sal_uInt8* pData, short nLen
     }
     sal_uInt16 nId = SVBT16ToShort( pData );    // Style-Id (NICHT Sprm-Id!)
 
-    if( nId >= nColls || !pCollA[nId].pFmt  // ungueltige Id ?
-        || pCollA[nId].bColl )              // oder Para-Style ?
+    if( nId >= vColl.size() || !vColl[nId].pFmt  // ungueltige Id ?
+        || vColl[nId].bColl )              // oder Para-Style ?
         return;                             // dann ignorieren
 
-    NewAttr( SwFmtCharFmt( (SwCharFmt*)pCollA[nId].pFmt ) );
+    NewAttr( SwFmtCharFmt( (SwCharFmt*)vColl[nId].pFmt ) );
     nCharFmt = (short) nId;
 }
 
@@ -3961,9 +3961,9 @@ void SwWW8ImplReader::Read_LR( sal_uInt16 nId, const sal_uInt8* pData, short nLe
         case 0x840F:
         case 0x845E:
             aLR.SetTxtLeft( nPara );
-            if (pAktColl)
+            if (pAktColl && nAktColl < vColl.size())
             {        
-                pCollA[nAktColl].bListReleventIndentSet = true;
+                vColl[nAktColl].bListReleventIndentSet = true;
             }
             bLeftIndentSet = true;  // #i105414#
             break;
@@ -3982,22 +3982,22 @@ void SwWW8ImplReader::Read_LR( sal_uInt16 nId, const sal_uInt8* pData, short nLe
             been removed then we will factor the original list applied hanging
             into our calculation.
             */
-            if (pPlcxMan && pCollA[nAktColl].bHasBrokenWW6List)
+            if (pPlcxMan && nAktColl < vColl.size() && vColl[nAktColl].bHasBrokenWW6List)
             {
                 const sal_uInt8 *pIsZeroed = pPlcxMan->GetPapPLCF()->HasSprm(0x460B);
                 if (pIsZeroed && *pIsZeroed == 0)
                 {
                     const SvxLRSpaceItem &rLR =
-                        ItemGet<SvxLRSpaceItem>(*(pCollA[nAktColl].pFmt),
+                        ItemGet<SvxLRSpaceItem>(*(vColl[nAktColl].pFmt),
                         RES_LR_SPACE);
                     nPara = nPara - rLR.GetTxtFirstLineOfst();
                 }
             }
 
             aLR.SetTxtFirstLineOfst(nPara);
-            if (pAktColl)
+            if (pAktColl && nAktColl < vColl.size())
             {        
-                pCollA[nAktColl].bListReleventIndentSet = true;
+                vColl[nAktColl].bListReleventIndentSet = true;
             }
             bFirstLinOfstSet = true; // #i103711#
             break;
@@ -4110,15 +4110,15 @@ void SwWW8ImplReader::Read_ParaAutoBefore(sal_uInt16, const sal_uInt8 *pData, sh
         SvxULSpaceItem aUL(*(const SvxULSpaceItem*)GetFmtAttr(RES_UL_SPACE));
         aUL.SetUpper(GetParagraphAutoSpace(pWDop->fDontUseHTMLAutoSpacing));
         NewAttr(aUL);
-        if (pAktColl)
-            pCollA[nAktColl].bParaAutoBefore = true;
+        if (pAktColl && nAktColl < vColl.size())
+            vColl[nAktColl].bParaAutoBefore = true;
         else
             bParaAutoBefore = true;
     }
     else
     {
-        if (pAktColl)
-            pCollA[nAktColl].bParaAutoBefore = false;
+        if (pAktColl && nAktColl < vColl.size())
+            vColl[nAktColl].bParaAutoBefore = false;
         else
             bParaAutoBefore = false;
     }
@@ -4137,15 +4137,15 @@ void SwWW8ImplReader::Read_ParaAutoAfter(sal_uInt16, const sal_uInt8 *pData, sho
         SvxULSpaceItem aUL(*(const SvxULSpaceItem*)GetFmtAttr(RES_UL_SPACE));
         aUL.SetLower(GetParagraphAutoSpace(pWDop->fDontUseHTMLAutoSpacing));
         NewAttr(aUL);
-        if (pAktColl)
-            pCollA[nAktColl].bParaAutoAfter = true;
+        if (pAktColl && nAktColl < vColl.size())
+            vColl[nAktColl].bParaAutoAfter = true;
         else
             bParaAutoAfter = true;
     }
     else
     {
-        if (pAktColl)
-            pCollA[nAktColl].bParaAutoAfter = false;
+        if (pAktColl && nAktColl < vColl.size())
+            vColl[nAktColl].bParaAutoAfter = false;
         else
             bParaAutoAfter = false;
     }
@@ -4862,14 +4862,14 @@ void SwWW8ImplReader::Read_BreakBefore( sal_uInt16, const sal_uInt8* pData, shor
 
 void SwWW8ImplReader::Read_ApoPPC( sal_uInt16, const sal_uInt8* pData, short )
 {
-    if (pAktColl) // only for Styledef, sonst anders geloest
+    if (pAktColl && nAktColl < vColl.size()) // only for Styledef, sonst anders geloest
     {
-        SwWW8StyInf& rSI = pCollA[nAktColl];
+        SwWW8StyInf& rSI = vColl[nAktColl];
         WW8FlyPara* pFly = rSI.pWWFly ? rSI.pWWFly : new WW8FlyPara(bVer67);
-        pCollA[nAktColl].pWWFly = pFly;
+        vColl[nAktColl].pWWFly = pFly;
         pFly->Read(pData, pStyles);
         if (pFly->IsEmpty())
-            delete pCollA[nAktColl].pWWFly, pCollA[nAktColl].pWWFly = 0;
+            delete vColl[nAktColl].pWWFly, vColl[nAktColl].pWWFly = 0;
     }
 }
 
-- 
cgit v1.2.3


From 39d4ce1b676e659e8de0e0752516d22aa5777953 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 24 Jun 2011 14:22:22 +0100
Subject: Resolves: fdo#38623 imported .doc crashes layout

Signed-off-by: Jan Holesovsky <kendy@suse.cz>
---
 sw/source/core/layout/ftnfrm.cxx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sw/source/core/layout/ftnfrm.cxx b/sw/source/core/layout/ftnfrm.cxx
index ce57fec940..a8e1b46bba 100644
--- a/sw/source/core/layout/ftnfrm.cxx
+++ b/sw/source/core/layout/ftnfrm.cxx
@@ -2701,7 +2701,7 @@ void SwPageFrm::UpdateFtnNum()
                             SwPageFrm* pPage = pTmpBoss->FindPageFrm();
                             pFtn = NULL;
                             lcl_NextFtnBoss( pTmpBoss, pPage, sal_False );
-                            SwFtnContFrm *pCont = pTmpBoss->FindNearestFtnCont();
+                            SwFtnContFrm *pCont = pTmpBoss ? pTmpBoss->FindNearestFtnCont() : NULL;
                             if ( pCont )
                                 pFtn = (SwFtnFrm*)pCont->Lower();
                         }
-- 
cgit v1.2.3


From ce50a165755bf80921cb461395890f89e9a22e37 Mon Sep 17 00:00:00 2001
From: Luboš Luňák <l.lunak@suse.cz>
Date: Mon, 27 Jun 2011 11:57:46 +0200
Subject: avoid infinite loop when writting out docs with bookmarks
 (bnc#700370)

The next position is either next attribute or next bookmark, whichever
comes first.
ACK by Cedric.
---
 sw/source/filter/ww8/wrtw8nds.cxx | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sw/source/filter/ww8/wrtw8nds.cxx b/sw/source/filter/ww8/wrtw8nds.cxx
index ca502d4c09..02659bf4a4 100644
--- a/sw/source/filter/ww8/wrtw8nds.cxx
+++ b/sw/source/filter/ww8/wrtw8nds.cxx
@@ -1622,7 +1622,7 @@ xub_StrLen MSWordExportBase::GetNextPos( SwWW8AttrIter* aAttrIter, const SwTxtNo
     xub_StrLen nNextPos = aAttrIter->WhereNext();
     xub_StrLen nNextBookmark = nNextPos;
 
-    if( nNextBookmark > nAktPos )//no need to search for bookmarks otherwise
+    if( nNextBookmark > nAktPos ) //no need to search for bookmarks otherwise (checked in UpdatePosition())
     {
         GetSortedBookmarks( rNode, nAktPos, nNextBookmark - nAktPos );
         NearestBookmark( nNextBookmark, nAktPos, false );
@@ -1634,9 +1634,9 @@ void MSWordExportBase::UpdatePosition( SwWW8AttrIter* aAttrIter, xub_StrLen nAkt
 {
     xub_StrLen nNextPos;
 
-    // go to next attribute if no bookmark is found and if the next attribute position if at the current position
+    // go to next attribute if no bookmark is found or if the bookmark is behind the next attribute position
     bool bNextBookmark = NearestBookmark( nNextPos, nAktPos, true );
-    if( !bNextBookmark && nAktPos >= aAttrIter->WhereNext() )
+    if( !bNextBookmark || nNextPos > aAttrIter->WhereNext() )
         aAttrIter->NextPos();
 }
 
-- 
cgit v1.2.3


From 6010e8f26a962c2812a8f85886a6bf1559fdae0b Mon Sep 17 00:00:00 2001
From: Jan Holesovsky <kendy@suse.cz>
Date: Fri, 1 Jul 2011 10:04:37 +0200
Subject: Fix the computation of grid character pitch, fdo#37516.

---
 sw/source/filter/ww8/attributeoutputbase.hxx |  3 ++
 sw/source/filter/ww8/docxattributeoutput.cxx | 17 +---------
 sw/source/filter/ww8/ww8atr.cxx              | 47 +++++++++++++++++++---------
 3 files changed, 36 insertions(+), 31 deletions(-)

diff --git a/sw/source/filter/ww8/attributeoutputbase.hxx b/sw/source/filter/ww8/attributeoutputbase.hxx
index 25fc96566d..84e58f7ad0 100644
--- a/sw/source/filter/ww8/attributeoutputbase.hxx
+++ b/sw/source/filter/ww8/attributeoutputbase.hxx
@@ -539,6 +539,9 @@ protected:
     /// Sfx item RES_KEEP
     virtual void FormatKeep( const SvxFmtKeepItem& ) = 0;
 
+    /// Compute the grid character pitch
+    sal_uInt32 GridCharacterPitch( const SwTextGridItem& rGrid ) const;
+
     /// Sfx item RES_TEXTGRID
     virtual void FormatTextGrid( const SwTextGridItem& ) = 0;
 
diff --git a/sw/source/filter/ww8/docxattributeoutput.cxx b/sw/source/filter/ww8/docxattributeoutput.cxx
index 9fd31503a7..693549c43a 100644
--- a/sw/source/filter/ww8/docxattributeoutput.cxx
+++ b/sw/source/filter/ww8/docxattributeoutput.cxx
@@ -4041,23 +4041,8 @@ void DocxAttributeOutput::FormatTextGrid( const SwTextGridItem& rGrid )
     pGridAttrList->add( FSNS( XML_w, XML_linePitch ),
             OString::valueOf( sal_Int32( nHeight ) ).getStr( ) );
 
-    MSWordStyles * pStyles = m_rExport.pStyles;
-    SwFmt * pSwFmt = pStyles->GetSwFmt();
-
-    sal_uInt32 nPageCharSize = 0;
-
-    if (pSwFmt != NULL)
-    {
-        nPageCharSize = ItemGet<SvxFontHeightItem>
-        (*pSwFmt, RES_CHRATR_FONTSIZE).GetHeight();
-    }
-
-    sal_uInt16 nPitch = rGrid.IsSquaredMode() ? rGrid.GetBaseHeight() :
-        rGrid.GetBaseWidth( );
-    sal_Int32 nCharSpace = ( nPitch - nPageCharSize ) * 4096 / 20;
-
     pGridAttrList->add( FSNS( XML_w, XML_charSpace ),
-            OString::valueOf( sal_Int32( nCharSpace ) ).getStr( ) );
+            OString::valueOf( sal_Int32( GridCharacterPitch( rGrid ) ) ).getStr( ) );
 
     m_pSerializer->singleElementNS( XML_w, XML_docGrid, pGridAttrList );
 }
diff --git a/sw/source/filter/ww8/ww8atr.cxx b/sw/source/filter/ww8/ww8atr.cxx
index 63ee393bb8..6e61641721 100644
--- a/sw/source/filter/ww8/ww8atr.cxx
+++ b/sw/source/filter/ww8/ww8atr.cxx
@@ -3641,6 +3641,37 @@ void WW8AttributeOutput::SectionBreak( sal_uInt8 nC, const WW8_SepInfo* /*pSecti
     m_rWW8Export.ReplaceCr( nC );
 }
 
+sal_uInt32 AttributeOutputBase::GridCharacterPitch( const SwTextGridItem& rGrid ) const
+{
+    MSWordStyles * pStyles = GetExport().pStyles;
+    SwFmt * pSwFmt = pStyles->GetSwFmt();
+
+    sal_uInt32 nPageCharSize = 0;
+
+    if (pSwFmt != NULL)
+    {
+        nPageCharSize = ItemGet<SvxFontHeightItem>
+            (*pSwFmt, RES_CHRATR_FONTSIZE).GetHeight();
+    }
+    sal_uInt16 nPitch = rGrid.IsSquaredMode() ? rGrid.GetBaseHeight() :
+        rGrid.GetBaseWidth( );
+
+    sal_Int32 nCharWidth = nPitch - nPageCharSize;
+    sal_Int32 nFraction = nCharWidth % 20;
+    if ( nCharWidth < 0 )
+        nFraction = 20 + nFraction;
+    nFraction = ( nFraction * 0xFFF ) / 20;
+    nFraction = ( nFraction & 0x00000FFF );
+
+    sal_Int32 nMain = nCharWidth / 20;
+    if ( nCharWidth < 0 )
+        nMain -= 1;
+    nMain = nMain * 0x1000;
+    nMain = ( nMain & 0xFFFFF000 );
+
+    return sal_uInt32( nFraction + nMain );
+}
+
 void WW8AttributeOutput::FormatTextGrid( const SwTextGridItem& rGrid )
 {
     if ( m_rWW8Export.bOutPageDescs && m_rWW8Export.bWrtWW8 )
@@ -3670,22 +3701,8 @@ void WW8AttributeOutput::FormatTextGrid( const SwTextGridItem& rGrid )
         m_rWW8Export.InsUInt16( NS_sprm::LN_SDyaLinePitch );
         m_rWW8Export.InsUInt16( nHeight );
 
-        MSWordStyles * pStyles = m_rWW8Export.pStyles;
-        SwFmt * pSwFmt = pStyles->GetSwFmt();
-
-        sal_uInt32 nPageCharSize = 0;
-
-        if (pSwFmt != NULL)
-        {
-            nPageCharSize = ItemGet<SvxFontHeightItem>
-            (*pSwFmt, RES_CHRATR_FONTSIZE).GetHeight();
-        }
-        sal_uInt16 nPitch = rGrid.IsSquaredMode() ? rGrid.GetBaseHeight() :
-            rGrid.GetBaseWidth( );
-        sal_Int32 nCharSpace = ( nPitch - nPageCharSize ) * 4096 / 20;
-
         m_rWW8Export.InsUInt16( NS_sprm::LN_SDxtCharSpace );
-        m_rWW8Export.InsUInt32( nCharSpace );
+        m_rWW8Export.InsUInt32( GridCharacterPitch( rGrid ) );
     }
 }
 
-- 
cgit v1.2.3


From b904df34c21c1b24a5b6942d608c8a1cc8dc82df Mon Sep 17 00:00:00 2001
From: Jan Holesovsky <kendy@suse.cz>
Date: Fri, 1 Jul 2011 16:35:39 +0200
Subject: Copy fieldmark properties when copying/pasting, fdo#38374.

---
 sw/source/core/docnode/ndcopy.cxx | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/sw/source/core/docnode/ndcopy.cxx b/sw/source/core/docnode/ndcopy.cxx
index acdb9a9dcf..0176adaf4e 100644
--- a/sw/source/core/docnode/ndcopy.cxx
+++ b/sw/source/core/docnode/ndcopy.cxx
@@ -186,14 +186,25 @@ namespace
             // Explicitly try to get exactly the same name as in the source
             // because NavigatorReminders, DdeBookmarks etc. ignore the proposed name
             pDestDoc->getIDocumentMarkAccess()->renameMark(pNewMark, pMark->GetName());
+
+            // copying additional attributes for bookmarks or fieldmarks
             ::sw::mark::IBookmark* const pNewBookmark =
                 dynamic_cast< ::sw::mark::IBookmark* const >(pNewMark);
-            if(pNewBookmark) /* copying additional attributes for bookmarks */
+            if(pNewBookmark)
             {
                 const ::sw::mark::IBookmark* const pOldBookmark = dynamic_cast< const ::sw::mark::IBookmark* >(pMark);
                 pNewBookmark->SetKeyCode(pOldBookmark->GetKeyCode());
                 pNewBookmark->SetShortName(pOldBookmark->GetShortName());
             }
+            ::sw::mark::IFieldmark* const pNewFieldmark =
+                dynamic_cast< ::sw::mark::IFieldmark* const >(pNewMark);
+            if(pNewFieldmark)
+            {
+                const ::sw::mark::IFieldmark* const pOldFieldmark = dynamic_cast< const ::sw::mark::IFieldmark* >(pMark);
+                pNewFieldmark->SetFieldname(pOldFieldmark->GetFieldname());
+                pNewFieldmark->SetFieldHelptext(pOldFieldmark->GetFieldHelptext());
+            }
+
             ::sfx2::Metadatable const*const pMetadatable(
                     dynamic_cast< ::sfx2::Metadatable const* >(pMark));
             ::sfx2::Metadatable      *const pNewMetadatable(
-- 
cgit v1.2.3


From 262261c39dc68ba7fb8d846fb3dacfa6b4fc98ba Mon Sep 17 00:00:00 2001
From: Roland Baudin <roland65@free.fr>
Date: Fri, 17 Jun 2011 19:39:55 +0000
Subject: Additional fix for bug fdo#33781

Signed-off-by: Petr Mladek <pmladek@suse.cz>
---
 sw/source/core/doc/notxtfrm.cxx | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sw/source/core/doc/notxtfrm.cxx b/sw/source/core/doc/notxtfrm.cxx
index a5e4f2f65c..580000da7f 100644
--- a/sw/source/core/doc/notxtfrm.cxx
+++ b/sw/source/core/doc/notxtfrm.cxx
@@ -952,6 +952,12 @@ void SwNoTxtFrm::PaintPicture( OutputDevice* pOut, const SwRect &rGrfArea ) cons
     }
     else if( pOLENd )
     {
+        // Fix for bug fdo#33781
+        if (pShell->Imp()->GetDrawView()->IsAntiAliasing())
+        {
+            pOut->SetAntialiasing( ANTIALIASING_ENABLE_B2DDRAW );
+        }
+
         // #i99665#
         // Adjust AntiAliasing mode at output device for chart OLE
         const sal_uInt16 nFormerAntialiasingAtOutput( pOut->GetAntialiasing() );
-- 
cgit v1.2.3


From c703b311c907b4c97850b5c81ae6a9d3ef47954c Mon Sep 17 00:00:00 2001
From: Petr Mladek <pmladek@suse.cz>
Date: Fri, 8 Jul 2011 10:46:57 +0200
Subject: More conservative fix for aliasing problems (fdo#33781)

Inspired by i#99665. It solves the problem where the aliasing caused
problems. It modifies the current aliasing using "byte or" (operator |)
 and restores the original aliasing at the end of the "if" block.

Signed-off-by: Roland Baudin <roland65@free.fr>
---
 sw/source/core/doc/notxtfrm.cxx | 33 +++++++++++++++------------------
 1 file changed, 15 insertions(+), 18 deletions(-)

diff --git a/sw/source/core/doc/notxtfrm.cxx b/sw/source/core/doc/notxtfrm.cxx
index 580000da7f..15708c76f6 100644
--- a/sw/source/core/doc/notxtfrm.cxx
+++ b/sw/source/core/doc/notxtfrm.cxx
@@ -819,9 +819,10 @@ void SwNoTxtFrm::PaintPicture( OutputDevice* pOut, const SwRect &rGrfArea ) cons
     if( pGrfNd )
     {
         // Fix for bug fdo#33781
+        const sal_uInt16 nFormerAntialiasingAtOutput( pOut->GetAntialiasing() );
         if (pShell->Imp()->GetDrawView()->IsAntiAliasing())
         {
-            pOut->SetAntialiasing( ANTIALIASING_ENABLE_B2DDRAW );
+            pOut->SetAntialiasing( nFormerAntialiasingAtOutput | ANTIALIASING_ENABLE_B2DDRAW );
         }
 
         sal_Bool bForceSwap = sal_False, bContinue = sal_True;
@@ -938,8 +939,12 @@ void SwNoTxtFrm::PaintPicture( OutputDevice* pOut, const SwRect &rGrfArea ) cons
             if( bSwapped && bPrn )
                 bForceSwap = sal_True;
         }
+
         if( bForceSwap )
             pGrfNd->SwapOut();
+
+        if ( pShell->Imp()->GetDrawView()->IsAntiAliasing() )
+            pOut->SetAntialiasing( nFormerAntialiasingAtOutput );
     }
     else if( bIsChart
         //charts must be painted resolution dependent!! #i82893#, #i75867#
@@ -953,20 +958,17 @@ void SwNoTxtFrm::PaintPicture( OutputDevice* pOut, const SwRect &rGrfArea ) cons
     else if( pOLENd )
     {
         // Fix for bug fdo#33781
+        const sal_uInt16 nFormerAntialiasingAtOutput( pOut->GetAntialiasing() );
         if (pShell->Imp()->GetDrawView()->IsAntiAliasing())
         {
-            pOut->SetAntialiasing( ANTIALIASING_ENABLE_B2DDRAW );
-        }
+            sal_uInt16 nNewAntialiasingAtOutput = nFormerAntialiasingAtOutput | ANTIALIASING_ENABLE_B2DDRAW;
 
-        // #i99665#
-        // Adjust AntiAliasing mode at output device for chart OLE
-        const sal_uInt16 nFormerAntialiasingAtOutput( pOut->GetAntialiasing() );
-        if ( pOLENd->IsChart() &&
-             pShell->Imp()->GetDrawView()->IsAntiAliasing() )
-        {
-            const sal_uInt16 nAntialiasingForChartOLE =
-                    nFormerAntialiasingAtOutput | ANTIALIASING_PIXELSNAPHAIRLINE;
-            pOut->SetAntialiasing( nAntialiasingForChartOLE );
+            // #i99665#
+            // Adjust AntiAliasing mode at output device for chart OLE
+            if ( pOLENd->IsChart() )
+                nNewAntialiasingAtOutput |= ANTIALIASING_PIXELSNAPHAIRLINE;
+
+            pOut->SetAntialiasing( nNewAntialiasingAtOutput );
         }
         // <--
 
@@ -1012,13 +1014,8 @@ void SwNoTxtFrm::PaintPicture( OutputDevice* pOut, const SwRect &rGrfArea ) cons
             ((SwFEShell*)pShell)->ConnectObj( pOLENd->GetOLEObj().GetObject(), pFly->Prt(), pFly->Frm());
         }
 
-        // #i99665#
-        if ( pOLENd->IsChart() &&
-             pShell->Imp()->GetDrawView()->IsAntiAliasing() )
-        {
+        if ( pShell->Imp()->GetDrawView()->IsAntiAliasing() )
             pOut->SetAntialiasing( nFormerAntialiasingAtOutput );
-        }
-        // <--
     }
 }
 
-- 
cgit v1.2.3


From b00c51c9fb1a69431248e3bfa3d8e9265e69a83c Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Sat, 2 Jul 2011 01:55:56 +0100
Subject: Related: fdo#37057 use standard sprm iterator

Signed-off-by: Michael Meeks <michael.meeks@novell.com>
---
 sw/source/filter/ww8/ww8par2.cxx | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index 4ab1be3502..bda689b1e4 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -3727,11 +3727,11 @@ void WW8RStyle::ImportSprms(sal_uInt8 *pSprms, short nLen, bool bPap)
         nSprmsLen = nLen;
     }
 
-    while ( nLen > 0 )
+    WW8SprmIter aSprmIter(pSprms, nLen, maSprmParser);
+    while (const sal_uInt8* pSprm = aSprmIter.GetSprms())
     {
-        sal_uInt16 nL1 = pIo->ImportSprm(pSprms);
-        nLen = nLen - nL1;
-        pSprms += nL1;
+        pIo->ImportSprm(pSprm);
+        aSprmIter.advance();
     }
 
     pParaSprms = 0;
-- 
cgit v1.2.3


From deba57d90339fa6083a54495aa410872ffa5e15e Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Sat, 2 Jul 2011 21:34:14 +0100
Subject: Resolves: fdo#34023 hang on load of .doc

Signed-off-by: Michael Meeks <michael.meeks@novell.com>
---
 sw/source/filter/ww8/ww8toolbar.cxx | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sw/source/filter/ww8/ww8toolbar.cxx b/sw/source/filter/ww8/ww8toolbar.cxx
index 0f4a644989..20bfcf380e 100644
--- a/sw/source/filter/ww8/ww8toolbar.cxx
+++ b/sw/source/filter/ww8/ww8toolbar.cxx
@@ -906,12 +906,13 @@ bool Tcg255::Read(SvStream *pS)
 {
     OSL_TRACE("Tcg255::Read() stream pos 0x%x", pS->Tell() );
     nOffSet = pS->Tell();
-    sal_uInt8 nId = 0; //
+    sal_uInt8 nId = 0x40;
     *pS >> nId;
     while (  nId != 0x40  )
     {
         if ( !processSubStruct( nId, pS ) )
             return false;
+        nId = 0x40;
         *pS >> nId;
     }
     return true;
@@ -948,9 +949,10 @@ bool Tcg255SubStruct::Read(SvStream *pS)
     return true;
 }
 
-PlfMcd::PlfMcd( bool bReadId ): Tcg255SubStruct( bReadId ), rgmcd( NULL )
+PlfMcd::PlfMcd( bool bReadId ): Tcg255SubStruct( bReadId ), iMac(0), rgmcd( NULL )
 {
 }
+
 PlfMcd::~PlfMcd()
 {
     if ( rgmcd )
-- 
cgit v1.2.3


From 0e34784737d4f654aba92932680c521a9430f63f Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 17 Jun 2011 23:48:50 +0100
Subject: merge these sprm finders and do it right

Signed-off-by: Michael Meeks <michael.meeks@novell.com>
---
 sw/source/filter/ww8/ww8par2.cxx | 16 +---------------
 sw/source/filter/ww8/ww8par3.cxx | 15 +--------------
 sw/source/filter/ww8/ww8scan.cxx | 21 +++++++++++++++++++++
 sw/source/filter/ww8/ww8scan.hxx |  5 +++++
 4 files changed, 28 insertions(+), 29 deletions(-)

diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index bda689b1e4..0ee1b97c05 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -3699,21 +3699,7 @@ const sal_uInt8* WW8RStyle::HasParaSprm( sal_uInt16 nId ) const
     if( !pParaSprms || !nSprmsLen )
         return 0;
 
-    const sal_uInt8* pSprms = pParaSprms;
-    sal_uInt16 i, x;
-
-    for( i=0; i < nSprmsLen; )
-    {
-        sal_uInt16 nAktId = maSprmParser.GetSprmId(pSprms);
-        // Sprm found ?
-        if( nAktId == nId )
-            return pSprms + maSprmParser.DistanceToData(nId);
-
-        x = maSprmParser.GetSprmSize(nAktId, pSprms);
-        i = i + x;
-        pSprms += x;
-    }
-    return 0;                               // Sprm not found
+    return maSprmParser.findSprmData(nId, pParaSprms, nSprmsLen);
 }
 
 void WW8RStyle::ImportSprms(sal_uInt8 *pSprms, short nLen, bool bPap)
diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index c1062daedb..bbc99af637 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -470,20 +470,7 @@ SV_IMPL_PTRARR( WW8LFOInfos, WW8LFOInfo_Ptr );
 sal_uInt8* WW8ListManager::GrpprlHasSprm(sal_uInt16 nId, sal_uInt8& rSprms,
     sal_uInt8 nLen)
 {
-    sal_uInt8* pSprms = &rSprms;
-    sal_uInt16 nRemLen=nLen;
-    while (nRemLen > (maSprmParser.getVersion()?1:0))
-    {
-        sal_uInt16 nAktId = maSprmParser.GetSprmId(pSprms);
-        if( nAktId == nId ) // Sprm found
-            return pSprms + maSprmParser.DistanceToData(nId);
-
-        // gib Zeiger auf Daten
-        sal_uInt16 nSize = maSprmParser.GetSprmSize(nAktId, pSprms);
-        pSprms += nSize;
-        nRemLen -= nSize;
-    }
-    return 0;                           // Sprm not found
+    return maSprmParser.findSprmData(nId, &rSprms, nLen);
 }
 
 class ListWithId : public std::unary_function<const WW8LSTInfo *, bool>
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index dbb8d2ce63..3db9bf6b54 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -7280,6 +7280,27 @@ sal_uInt16 wwSprmParser::DistanceToData(sal_uInt16 nId) const
     return 1 + mnDelta + SprmDataOfs(nId);
 }
 
+sal_uInt8* wwSprmParser::findSprmData(sal_uInt16 nId, sal_uInt8* pSprms,
+    sal_uInt16 nLen) const
+{
+    while (nLen > (getVersion()?1:0))
+    {
+        sal_uInt16 nAktId = GetSprmId(pSprms);
+        if (nAktId == nId) // Sprm found
+            return pSprms + DistanceToData(nId);
+
+        // gib Zeiger auf Daten
+        sal_uInt16 nSize = GetSprmSize(nAktId, pSprms);
+        OSL_ENSURE(nSize <= nLen, "sprm longer than remaining bytes");
+        //Clip to available size if wrong
+        nSize = std::min(nSize, nLen);
+        pSprms += nSize;
+        nLen -= nSize;
+    }
+    // Sprm not found
+    return 0;
+}
+
 SEPr::SEPr() :
     bkc(2), fTitlePage(0), fAutoPgn(0), nfcPgn(0), fUnlocked(0), cnsPgn(0),
     fPgnRestart(0), fEndNote(1), lnc(0), grpfIhdt(0), nLnnMod(0), dxaLnn(0),
diff --git a/sw/source/filter/ww8/ww8scan.hxx b/sw/source/filter/ww8/ww8scan.hxx
index 0bb532a3d6..7d809d8ab1 100644
--- a/sw/source/filter/ww8/ww8scan.hxx
+++ b/sw/source/filter/ww8/ww8scan.hxx
@@ -145,6 +145,11 @@ public:
     /// The minimum acceptable sprm len possible for this type of parser
     int MinSprmLen() const { return (IsSevenMinus(meVersion)) ? 2 : 3; }
 
+    /// Returns the offset to data of the first sprm of id nId, 0
+    //  if not found. nLen must be the <= length of pSprms
+    sal_uInt8* findSprmData(sal_uInt16 nId, sal_uInt8* pSprms, sal_uInt16 nLen)
+        const;
+
     inline int getVersion() const { return meVersion; } //cmc, I'm dubious about the usage of this, how can it be 0
 };
 
-- 
cgit v1.2.3


From 410105ca3c9ec448e162d66a072ffd2b2b42424f Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Sat, 18 Jun 2011 00:39:59 +0100
Subject: handle truncated stream

Signed-off-by: Michael Meeks <michael.meeks@novell.com>
---
 sw/source/filter/ww8/ww8par.cxx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index ce86fd2cc9..163b078029 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -5358,7 +5358,7 @@ sal_uLong SwWW8ImplReader::LoadDoc( SwPaM& rPaM,WW8Glossary *pGloss)
         m_bRegardHindiDigits = aVal[ 12 ] > 0;
     }
 
-    sal_uInt16 nMagic;
+    sal_uInt16 nMagic(0);
     *pStrm >> nMagic;
 
     // beachte: 6 steht fuer "6 ODER 7",  7 steht fuer "NUR 7"
-- 
cgit v1.2.3


From cf65ab392673024f34eedb27f6002b6da86504c3 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Thu, 23 Jun 2011 12:45:44 +0100
Subject: Resolves: #i95550# handle wrong text len gracefully

Signed-off-by: Michael Meeks <michael.meeks@novell.com>
---
 sw/source/filter/ww8/ww8par.cxx | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 163b078029..0ff27b1b42 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -2627,9 +2627,6 @@ bool SwWW8ImplReader::ReadPlainChars(WW8_CP& rPos, long nEnd, long nCpOfs)
     // Unicode-Flag neu setzen und notfalls File-Pos korrigieren
     // merke: Seek kostet nicht viel, da inline geprueft wird,
     //        ob die korrekte FilePos nicht schon erreicht ist.
-    WW8_FC nStreamPos = pSBase->WW8Cp2Fc(nCpOfs+rPos, &bIsUnicode);
-    pStrm->Seek( nStreamPos );
-
     xub_StrLen nLen;
     if (nEnd - rPos <= (STRING_MAXLEN-1))
         nLen = writer_cast<xub_StrLen>(nEnd - rPos);
@@ -2639,6 +2636,16 @@ bool SwWW8ImplReader::ReadPlainChars(WW8_CP& rPos, long nEnd, long nCpOfs)
     if (!nLen)
         return true;
 
+    sal_Size nRequestedPos = pSBase->WW8Cp2Fc(nCpOfs+rPos, &bIsUnicode);
+    sal_Size nSeekedPos = pStrm->Seek(nRequestedPos);
+    OSL_ENSURE(nRequestedPos == nSeekedPos, "Document claimed to have more text than available");
+    if (nRequestedPos != nSeekedPos)
+    {
+        //Swallow missing range, e.g. #i95550#
+        rPos+=nLen;
+        return true;
+    }
+
     const CharSet eSrcCharSet = bVer67 ? GetCurrentCharSet() :
         RTL_TEXTENCODING_MS_1252;
     const CharSet eSrcCJKCharSet = bVer67 ? GetCurrentCJKCharSet() :
-- 
cgit v1.2.3


From 4f7ce10128216e93ef8953fa396be6dca23eb335 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Mon, 20 Jun 2011 23:43:32 +0100
Subject: Resolves: #i105349# protect against missing insertion position

Signed-off-by: Michael Meeks <michael.meeks@novell.com>
---
 sw/source/filter/ww8/ww8par3.cxx | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index bbc99af637..2f108cf095 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -1780,10 +1780,12 @@ void SwWW8ImplReader::RegisterNumFmtOnTxtNode(sal_uInt16 nActLFO,
 
     if (pLstManager) // sind die Listendeklarationen gelesen?
     {
-        std::vector<sal_uInt8> aParaSprms;
         SwTxtNode* pTxtNd = pPaM->GetNode()->GetTxtNode();
-        OSL_ENSURE(pTxtNd, "Kein Text-Node an PaM-Position");
+        OSL_ENSURE(pTxtNd, "No Text-Node at PaM-Position");
+        if (!pTxtNd)
+            return;
 
+        std::vector<sal_uInt8> aParaSprms;
         const SwNumRule* pRule = bSetAttr ?
             pLstManager->GetNumRuleForActivation( nActLFO, nActLevel,
                 aParaSprms, pTxtNd) : 0;
-- 
cgit v1.2.3


From ab28696e17a913c0f4be5c7daebeb1f3fc4827d8 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Mon, 4 Jul 2011 01:26:18 +0100
Subject: valgrind: init nTypeFace

Signed-off-by: Michael Meeks <michael.meeks@novell.com>
---
 starmath/source/mathtype.hxx | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/starmath/source/mathtype.hxx b/starmath/source/mathtype.hxx
index c29c665b01..6660b77a60 100644
--- a/starmath/source/mathtype.hxx
+++ b/starmath/source/mathtype.hxx
@@ -64,14 +64,16 @@ class MathType
 public:
     MathType(String &rIn) : 
         rRet(rIn), nHAlign(0), nVAlign(0), nDefaultSize(12),
-        nLSize(0), nDSize(0), nCurSize(0), nLastSize(0), bIsSilent(sal_False)
+        nLSize(0), nDSize(0), nCurSize(0), nLastSize(0), bIsSilent(sal_False),
+        nTypeFace(0)
     {
         Init();
     }
 
     MathType(String &rIn,SmNode *pIn) : 
         rRet(rIn), pTree(pIn), nHAlign(2), nVAlign(0), nInsertion(0), nDefaultSize(12),
-        nLSize(0), nDSize(0), nCurSize(0), nLastSize(0), nSpec(0), bIsSilent(sal_False)
+        nLSize(0), nDSize(0), nCurSize(0), nLastSize(0), nSpec(0), bIsSilent(sal_False),
+        nTypeFace(0)
     {
         Init();
     }
-- 
cgit v1.2.3


From a7df8e169565031d8587d9bde048b2f45279c6d8 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Mon, 4 Jul 2011 10:37:54 +0100
Subject: Related: #i86988# make abo levels safer

Signed-off-by: Michael Meeks <michael.meeks@novell.com>
---
 sw/qa/core/data/ww8/pass/CVE-2006-3493-1.doc | Bin 0 -> 48128 bytes
 sw/qa/core/data/ww8/pass/CVE-2006-6628-1.doc | Bin 0 -> 26624 bytes
 sw/qa/core/data/ww8/pass/CVE-2007-1347-1.doc | Bin 0 -> 24064 bytes
 sw/qa/core/data/ww8/pass/CVE-2008-2752-1.doc | Bin 0 -> 25088 bytes
 sw/qa/core/data/ww8/pass/CVE-2008-2752-2.doc | Bin 0 -> 24576 bytes
 sw/qa/core/data/ww8/pass/CVE-2008-2752-3.doc | Bin 0 -> 22528 bytes
 sw/qa/core/data/ww8/pass/CVE-2008-2752-4.doc | Bin 0 -> 23040 bytes
 sw/qa/core/data/ww8/pass/CVE-2008-4841-1.doc |   1 +
 sw/qa/core/data/ww8/pass/CVE-2009-0259-1.doc | Bin 0 -> 101888 bytes
 sw/qa/core/data/ww8/pass/CVE-2010-3200-1.doc | Bin 0 -> 48128 bytes
 sw/source/filter/ww8/ww8par.cxx              |   2 ++
 11 files changed, 3 insertions(+)
 create mode 100644 sw/qa/core/data/ww8/pass/CVE-2006-3493-1.doc
 create mode 100644 sw/qa/core/data/ww8/pass/CVE-2006-6628-1.doc
 create mode 100644 sw/qa/core/data/ww8/pass/CVE-2007-1347-1.doc
 create mode 100644 sw/qa/core/data/ww8/pass/CVE-2008-2752-1.doc
 create mode 100644 sw/qa/core/data/ww8/pass/CVE-2008-2752-2.doc
 create mode 100644 sw/qa/core/data/ww8/pass/CVE-2008-2752-3.doc
 create mode 100644 sw/qa/core/data/ww8/pass/CVE-2008-2752-4.doc
 create mode 120000 sw/qa/core/data/ww8/pass/CVE-2008-4841-1.doc
 create mode 100644 sw/qa/core/data/ww8/pass/CVE-2009-0259-1.doc
 create mode 100644 sw/qa/core/data/ww8/pass/CVE-2010-3200-1.doc

diff --git a/sw/qa/core/data/ww8/pass/CVE-2006-3493-1.doc b/sw/qa/core/data/ww8/pass/CVE-2006-3493-1.doc
new file mode 100644
index 0000000000..af452ddc0e
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2006-3493-1.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2006-6628-1.doc b/sw/qa/core/data/ww8/pass/CVE-2006-6628-1.doc
new file mode 100644
index 0000000000..240ea77bca
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2006-6628-1.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2007-1347-1.doc b/sw/qa/core/data/ww8/pass/CVE-2007-1347-1.doc
new file mode 100644
index 0000000000..d25e62ab24
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2007-1347-1.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2008-2752-1.doc b/sw/qa/core/data/ww8/pass/CVE-2008-2752-1.doc
new file mode 100644
index 0000000000..f51fa8fe9b
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2008-2752-1.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2008-2752-2.doc b/sw/qa/core/data/ww8/pass/CVE-2008-2752-2.doc
new file mode 100644
index 0000000000..7ce7a07bb6
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2008-2752-2.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2008-2752-3.doc b/sw/qa/core/data/ww8/pass/CVE-2008-2752-3.doc
new file mode 100644
index 0000000000..8b04872af7
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2008-2752-3.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2008-2752-4.doc b/sw/qa/core/data/ww8/pass/CVE-2008-2752-4.doc
new file mode 100644
index 0000000000..148a30d4ab
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2008-2752-4.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2008-4841-1.doc b/sw/qa/core/data/ww8/pass/CVE-2008-4841-1.doc
new file mode 120000
index 0000000000..f099938bc1
--- /dev/null
+++ b/sw/qa/core/data/ww8/pass/CVE-2008-4841-1.doc
@@ -0,0 +1 @@
+CVE-2009-0259-1.doc
\ No newline at end of file
diff --git a/sw/qa/core/data/ww8/pass/CVE-2009-0259-1.doc b/sw/qa/core/data/ww8/pass/CVE-2009-0259-1.doc
new file mode 100644
index 0000000000..0942b6d8d4
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2009-0259-1.doc differ
diff --git a/sw/qa/core/data/ww8/pass/CVE-2010-3200-1.doc b/sw/qa/core/data/ww8/pass/CVE-2010-3200-1.doc
new file mode 100644
index 0000000000..596aec93bd
Binary files /dev/null and b/sw/qa/core/data/ww8/pass/CVE-2010-3200-1.doc differ
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx
index 0ff27b1b42..880384b426 100644
--- a/sw/source/filter/ww8/ww8par.cxx
+++ b/sw/source/filter/ww8/ww8par.cxx
@@ -5661,6 +5661,8 @@ bool SwWW8ImplReader::InEqualApo(int nLvl) const
     //the table.
     if (nLvl)
         --nLvl;
+    if (nLvl < 0 || static_cast<size_t>(nLvl) >= maApos.size())
+        return false;
     return maApos[nLvl];
 }
 
-- 
cgit v1.2.3


From 408ffebd26be78170a602104d260ccb0a116b209 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Mon, 4 Jul 2011 10:13:32 +0100
Subject: Related: #i115768# use cached data values instead of pointer to sprm
 cache

use cached data value in case underlying sprm cache goes away

Signed-off-by: Michael Meeks <michael.meeks@novell.com>
---
 sw/source/filter/ww8/ww8par.hxx  | 20 ++++++++++----------
 sw/source/filter/ww8/ww8par2.cxx |  6 ++++--
 sw/source/filter/ww8/ww8par6.cxx | 22 ++++++++--------------
 3 files changed, 22 insertions(+), 26 deletions(-)

diff --git a/sw/source/filter/ww8/ww8par.hxx b/sw/source/filter/ww8/ww8par.hxx
index 2fb1cee578..8a803db3e5 100644
--- a/sw/source/filter/ww8/ww8par.hxx
+++ b/sw/source/filter/ww8/ww8par.hxx
@@ -245,13 +245,12 @@ struct WW8FlyPara
                                 // enthaltene Grafik anders als zeichengebunden
                                 // zu positionieren
     bool mbVertSet;             // true if vertical positioning has been set
-    sal_uInt8 nOrigSp29;
 
     WW8FlyPara(bool bIsVer67, const WW8FlyPara* pSrc = 0);
     bool operator==(const WW8FlyPara& rSrc) const;
-    void Read(const sal_uInt8* pSprm29, WW8PLCFx_Cp_FKP* pPap);
-    void ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo);
-    void Read(const sal_uInt8* pSprm29, WW8RStyle* pStyle);
+    void Read(sal_uInt8 nSprm29, WW8PLCFx_Cp_FKP* pPap);
+    void ReadFull(sal_uInt8 nSprm29, SwWW8ImplReader* pIo);
+    void Read(sal_uInt8 nSprm29, WW8RStyle* pStyle);
     void ApplyTabPos(const WW8_TablePos *pTabPos);
     bool IsEmpty() const;
 };
@@ -880,14 +879,15 @@ struct ApoTestResults
 {
     bool mbStartApo;
     bool mbStopApo;
-    const sal_uInt8* mpSprm37;
-    const sal_uInt8* mpSprm29;
+    bool m_bHasSprm37;
+    bool m_bHasSprm29;
+    sal_uInt8 m_nSprm29;
     WW8FlyPara* mpStyleApo;
-    ApoTestResults() :
-        mbStartApo(false), mbStopApo(false), mpSprm37(0), mpSprm29(0),
-        mpStyleApo(0) {}
+    ApoTestResults()
+        : mbStartApo(false), mbStopApo(false), m_bHasSprm37(false)
+        , m_bHasSprm29(false), m_nSprm29(0), mpStyleApo(0) {}
     bool HasStartStop() const { return (mbStartApo || mbStopApo); }
-    bool HasFrame() const { return (mpSprm29 || mpSprm37 || mpStyleApo); }
+    bool HasFrame() const { return (m_bHasSprm29 || m_bHasSprm37 || mpStyleApo); }
 };
 
 struct ANLDRuleMap
diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx
index 0ee1b97c05..0e0b46df04 100644
--- a/sw/source/filter/ww8/ww8par2.cxx
+++ b/sw/source/filter/ww8/ww8par2.cxx
@@ -549,8 +549,10 @@ ApoTestResults SwWW8ImplReader::TestApo(int nCellLevel, bool bTableRowEnd,
     to see if we are still in that frame.
     */
 
-    aRet.mpSprm37 = pPlcxMan->HasParaSprm( bVer67 ? 37 : 0x2423 );
-    aRet.mpSprm29 = pPlcxMan->HasParaSprm( bVer67 ? 29 : 0x261B );
+    aRet.m_bHasSprm37 = pPlcxMan->HasParaSprm( bVer67 ? 37 : 0x2423 );
+    const sal_uInt8 *pSrpm29 = pPlcxMan->HasParaSprm( bVer67 ? 29 : 0x261B );
+    aRet.m_bHasSprm29 = pSrpm29 != NULL;
+    aRet.m_nSprm29 = pSrpm29 ? *pSrpm29 : 0;
 
     // Is there some frame data here
     bool bNowApo = aRet.HasFrame() || pTopLevelTable;
diff --git a/sw/source/filter/ww8/ww8par6.cxx b/sw/source/filter/ww8/ww8par6.cxx
index 01520a3b47..79ff1d5996 100644
--- a/sw/source/filter/ww8/ww8par6.cxx
+++ b/sw/source/filter/ww8/ww8par6.cxx
@@ -1616,11 +1616,8 @@ bool WW8FlyPara::operator==(const WW8FlyPara& rSrc) const
 }
 
 // Read fuer normalen Text
-void WW8FlyPara::Read(const sal_uInt8* pSprm29, WW8PLCFx_Cp_FKP* pPap)
+void WW8FlyPara::Read(sal_uInt8 nOrigSp29, WW8PLCFx_Cp_FKP* pPap)
 {
-    if (pSprm29)
-        nOrigSp29 = *pSprm29;                           // PPC ( Bindung )
-
     const sal_uInt8* pS = 0;
     if( bVer67 )
     {
@@ -1671,12 +1668,12 @@ void WW8FlyPara::Read(const sal_uInt8* pSprm29, WW8PLCFx_Cp_FKP* pPap)
         nSp29 = nOrigSp29;
 }
 
-void WW8FlyPara::ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo)
+void WW8FlyPara::ReadFull(sal_uInt8 nOrigSp29, SwWW8ImplReader* pIo)
 {
     WW8PLCFMan* pPlcxMan = pIo->pPlcxMan;
     WW8PLCFx_Cp_FKP* pPap = pPlcxMan->GetPapPLCF();
 
-    Read(pSprm29, pPap);    // Lies Apo-Parameter
+    Read(nOrigSp29, pPap);    // Lies Apo-Parameter
 
     do{             // Block zum rausspringen
         if( nSp45 != 0 /* || nSp28 != 0 */ )
@@ -1722,7 +1719,7 @@ void WW8FlyPara::ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo)
 
             WW8FlyPara aF(bVer67, pNowStyleApo);
                                                 // Neuer FlaPara zum Vergleich
-            aF.Read( pS, pPap );                // WWPara fuer neuen Para
+            aF.Read( *pS, pPap );               // WWPara fuer neuen Para
             if( !( aF == *this ) )              // selber APO ? ( oder neuer ? )
                 bGrafApo = true;                // nein -> 1-zeiliger APO
                                                 //      -> Grafik-APO
@@ -1736,11 +1733,8 @@ void WW8FlyPara::ReadFull(const sal_uInt8* pSprm29, SwWW8ImplReader* pIo)
 
 
 // Read fuer Apo-Defs in Styledefs
-void WW8FlyPara::Read(const sal_uInt8* pSprm29, WW8RStyle* pStyle)
+void WW8FlyPara::Read(sal_uInt8 nOrigSp29, WW8RStyle* pStyle)
 {
-    if (pSprm29)
-        nOrigSp29 = *pSprm29;                           // PPC ( Bindung )
-
     const sal_uInt8* pS = 0;
     if (bVer67)
     {
@@ -2315,7 +2309,7 @@ WW8FlyPara *SwWW8ImplReader::ConstructApo(const ApoTestResults &rApo,
 
     // APO-Parameter ermitteln und Test auf bGrafApo
     if (rApo.HasFrame())
-        pRet->ReadFull(rApo.mpSprm29, this);
+        pRet->ReadFull(rApo.m_nSprm29, this);
 
     pRet->ApplyTabPos(pTabPos);
 
@@ -2592,7 +2586,7 @@ bool SwWW8ImplReader::TestSameApo(const ApoTestResults &rApo,
     WW8FlyPara aF(bVer67, rApo.mpStyleApo);
     // WWPara fuer akt. Para
     if (rApo.HasFrame())
-        aF.Read(rApo.mpSprm29, pPlcxMan->GetPapPLCF());
+        aF.Read(rApo.m_nSprm29, pPlcxMan->GetPapPLCF());
     aF.ApplyTabPos(pTabPos);
 
     return aF == *pWFlyPara;
@@ -4867,7 +4861,7 @@ void SwWW8ImplReader::Read_ApoPPC( sal_uInt16, const sal_uInt8* pData, short )
         SwWW8StyInf& rSI = vColl[nAktColl];
         WW8FlyPara* pFly = rSI.pWWFly ? rSI.pWWFly : new WW8FlyPara(bVer67);
         vColl[nAktColl].pWWFly = pFly;
-        pFly->Read(pData, pStyles);
+        pFly->Read(*pData, pStyles);
         if (pFly->IsEmpty())
             delete vColl[nAktColl].pWWFly, vColl[nAktColl].pWWFly = 0;
     }
-- 
cgit v1.2.3


From 54a88fdf62d8e7507e7c3822e5fdddfeeeaa335b Mon Sep 17 00:00:00 2001
From: "marc-andre@atc.tcs.com" <marc-andre@atc.tcs.com>
Date: Wed, 6 Jul 2011 13:15:42 +0530
Subject: Fixed core dump and invalid memory access for some edge cases (cherry
 picked from commit b991a2fb76e2859d7f04793ad7ad3a0596d8d630)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Caolán McNamara <caolanm@redhat.com>
---
 sw/source/core/doc/docnew.cxx    | 59 ++++++++++++++++++++--------------------
 sw/source/filter/ww8/ww8par3.cxx |  2 +-
 2 files changed, 31 insertions(+), 30 deletions(-)

diff --git a/sw/source/core/doc/docnew.cxx b/sw/source/core/doc/docnew.cxx
index 6cc62a173a..111afa7889 100644
--- a/sw/source/core/doc/docnew.cxx
+++ b/sw/source/core/doc/docnew.cxx
@@ -909,39 +909,40 @@ void SwDoc::UpdateLinks( sal_Bool bUI )
 {
     SfxObjectCreateMode eMode;
     sal_uInt16 nLinkMode = getLinkUpdateMode( true );
-    sal_uInt16 nUpdateDocMode = GetDocShell()->GetUpdateDocMode();
-    if( GetDocShell() &&
-            (nLinkMode != NEVER ||  document::UpdateDocMode::FULL_UPDATE == nUpdateDocMode) &&
-        GetLinkManager().GetLinks().Count() &&
-        SFX_CREATE_MODE_INTERNAL !=
-                    ( eMode = GetDocShell()->GetCreateMode()) &&
-        SFX_CREATE_MODE_ORGANIZER != eMode &&
-        SFX_CREATE_MODE_PREVIEW != eMode &&
-        !GetDocShell()->IsPreview() )
-    {
-        ViewShell* pVSh = 0;
-        sal_Bool bAskUpdate = nLinkMode == MANUAL;
-        sal_Bool bUpdate = sal_True;
-        switch(nUpdateDocMode)
-        {
-            case document::UpdateDocMode::NO_UPDATE:   bUpdate = sal_False;break;
-            case document::UpdateDocMode::QUIET_UPDATE:bAskUpdate = sal_False; break;
-            case document::UpdateDocMode::FULL_UPDATE: bAskUpdate = sal_True; break;
-        }
-        if( bUpdate && (bUI || !bAskUpdate) )
+    if ( GetDocShell()) {
+        sal_uInt16 nUpdateDocMode = GetDocShell()->GetUpdateDocMode();
+        if( (nLinkMode != NEVER ||  document::UpdateDocMode::FULL_UPDATE == nUpdateDocMode) &&
+            GetLinkManager().GetLinks().Count() &&
+            SFX_CREATE_MODE_INTERNAL !=
+                        ( eMode = GetDocShell()->GetCreateMode()) &&
+            SFX_CREATE_MODE_ORGANIZER != eMode &&
+            SFX_CREATE_MODE_PREVIEW != eMode &&
+            !GetDocShell()->IsPreview() )
         {
-            SfxMedium* pMedium = GetDocShell()->GetMedium();
-            SfxFrame* pFrm = pMedium ? pMedium->GetLoadTargetFrame() : 0;
-            Window* pDlgParent = pFrm ? &pFrm->GetWindow() : 0;
-            if( GetCurrentViewShell() && !GetEditShell( &pVSh ) && !pVSh )	//swmod 071108//swmod 071225
+            ViewShell* pVSh = 0;
+            sal_Bool bAskUpdate = nLinkMode == MANUAL;
+            sal_Bool bUpdate = sal_True;
+            switch(nUpdateDocMode)
             {
-                ViewShell aVSh( *this, 0, 0 );
+                case document::UpdateDocMode::NO_UPDATE:   bUpdate = sal_False;break;
+                case document::UpdateDocMode::QUIET_UPDATE:bAskUpdate = sal_False; break;
+                case document::UpdateDocMode::FULL_UPDATE: bAskUpdate = sal_True; break;
+            }
+            if( bUpdate && (bUI || !bAskUpdate) )
+            {
+                SfxMedium* pMedium = GetDocShell()->GetMedium();
+                SfxFrame* pFrm = pMedium ? pMedium->GetLoadTargetFrame() : 0;
+                Window* pDlgParent = pFrm ? &pFrm->GetWindow() : 0;
+                if( GetCurrentViewShell() && !GetEditShell( &pVSh ) && !pVSh )	//swmod 071108//swmod 071225
+                {
+                    ViewShell aVSh( *this, 0, 0 );
 
-                SET_CURR_SHELL( &aVSh );
-                GetLinkManager().UpdateAllLinks( bAskUpdate , sal_True, sal_False, pDlgParent );
+                    SET_CURR_SHELL( &aVSh );
+                    GetLinkManager().UpdateAllLinks( bAskUpdate , sal_True, sal_False, pDlgParent );
+                }
+                else
+                    GetLinkManager().UpdateAllLinks( bAskUpdate, sal_True, sal_False, pDlgParent );
             }
-            else
-                GetLinkManager().UpdateAllLinks( bAskUpdate, sal_True, sal_False, pDlgParent );
         }
     }
 
diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index 2f108cf095..c2e267078e 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -762,7 +762,7 @@ bool WW8ListManager::ReadLVL(SwNumFmt& rNumFmt, SfxItemSet*& rpItemSet,
     for(nLevelB = 0; nLevelB <= nLevel; ++nLevelB)
     {
         sal_uInt8 nPos = aOfsNumsXCH[nLevelB];
-        if (nPos && sNumString.GetChar(nPos-1) < nMaxLevel)
+        if (nPos && nPos < sNumString.Len()  && sNumString.GetChar(nPos-1) < nMaxLevel)
         {
             if (rNotReallyThere[nLevelB])
                 aOfsNumsXCH[nLevelB] = 0;
-- 
cgit v1.2.3


From 92c1de7d394bf02e8a344a81844b6534114c3343 Mon Sep 17 00:00:00 2001
From: "marc-andre@atc.tcs.com" <marc-andre@atc.tcs.com>
Date: Fri, 8 Jul 2011 14:23:34 +0530
Subject: Fixed a segmentation fault in some edge cases (cherry picked from
 commit 79f14410f2db7d186c8b7ee94b09e8e362e74dfd)

---
 sw/source/filter/ww8/ww8par6.cxx | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sw/source/filter/ww8/ww8par6.cxx b/sw/source/filter/ww8/ww8par6.cxx
index 79ff1d5996..e393472854 100644
--- a/sw/source/filter/ww8/ww8par6.cxx
+++ b/sw/source/filter/ww8/ww8par6.cxx
@@ -917,6 +917,7 @@ void wwSectionManager::CreateSep(const long nTxtPos, bool /*bMustHaveBreak*/)
         aNewSection.maSep.fEvenlySpaced =
             ReadBSprm(pSep, (eVer <= ww::eWW7 ? 138 : 0x3005), 1) ? true : false;
 
+        const sal_uInt8 numrgda = SAL_N_ELEMENTS(aNewSection.maSep.rgdxaColumnWidthSpacing);
         if (aNewSection.maSep.ccolM1 > 0 && !aNewSection.maSep.fEvenlySpaced)
         {
             aNewSection.maSep.rgdxaColumnWidthSpacing[0] = 0;
@@ -930,7 +931,8 @@ void wwSectionManager::CreateSep(const long nTxtPos, bool /*bMustHaveBreak*/)
                 OSL_ENSURE( pSW, "+Sprm 136 (bzw. 0xF203) (ColWidth) fehlt" );
                 sal_uInt16 nWidth = pSW ? SVBT16ToShort(pSW + 1) : 1440;
 
-                aNewSection.maSep.rgdxaColumnWidthSpacing[++nIdx] = nWidth;
+                if (++nIdx < numrgda)
+                    aNewSection.maSep.rgdxaColumnWidthSpacing[nIdx] = nWidth;
 
                 if (i < nCols-1)
                 {
@@ -941,7 +943,8 @@ void wwSectionManager::CreateSep(const long nTxtPos, bool /*bMustHaveBreak*/)
                     if( pSD )
                     {
                         nWidth = SVBT16ToShort(pSD + 1);
-                        aNewSection.maSep.rgdxaColumnWidthSpacing[++nIdx] = nWidth;
+                        if (++nIdx < numrgda)
+                            aNewSection.maSep.rgdxaColumnWidthSpacing[nIdx] = nWidth;
                     }
                 }
             }
-- 
cgit v1.2.3


From 5746d502a21087350a17f4b9045f7c095cd17ba9 Mon Sep 17 00:00:00 2001
From: Cédric Bosdonnat <cedric.bosdonnat.ooo@free.fr>
Date: Fri, 8 Jul 2011 14:49:14 +0200
Subject: n#695479: basic handling of lines in RTF import

Signed-off-by: Michael Meeks <michael.meeks@novell.com>
---
 sw/source/filter/rtf/swparrtf.cxx | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/sw/source/filter/rtf/swparrtf.cxx b/sw/source/filter/rtf/swparrtf.cxx
index 1b5c076f3e..49a6f77fec 100644
--- a/sw/source/filter/rtf/swparrtf.cxx
+++ b/sw/source/filter/rtf/swparrtf.cxx
@@ -1173,7 +1173,7 @@ void SwRTFParser::ReadShpTxt(String& s)
 }
 
 /*
- * Very basic support for the "Buchhalternase".
+ * Very basic support for the Z-line.
  */
 void SwRTFParser::ReadDrawingObject()
 {
@@ -1185,6 +1185,9 @@ void SwRTFParser::ReadDrawingObject()
     ::basegfx::B2DPoint aPoint;
     bool bPolygonActive(false);
 
+    SwFmtHoriOrient aHori( 0, text::HoriOrientation::NONE, text::RelOrientation::PAGE_FRAME );
+    SwFmtVertOrient aVert( 0, text::VertOrientation::NONE, text::RelOrientation::PAGE_FRAME );
+
     while (level>0 && IsParserWorking())
     {
         nToken = GetNextToken();
@@ -1196,6 +1199,12 @@ void SwRTFParser::ReadDrawingObject()
             case '{':
                 level++;
                 break;
+            case RTF_DOBXMARGIN:
+                aHori.SetRelationOrient( text::RelOrientation::PAGE_PRINT_AREA );
+                break;
+            case RTF_DOBYMARGIN:
+                aVert.SetRelationOrient( text::RelOrientation::PAGE_PRINT_AREA );
+                break;
             case RTF_DPX:
                 aRect.setX(nTokenValue);
                 break;
@@ -1208,6 +1217,7 @@ void SwRTFParser::ReadDrawingObject()
             case RTF_DPYSIZE:
                 aRect.setHeight(nTokenValue);
                 break;
+            case RTF_DPLINE:
             case RTF_DPPOLYCOUNT:
                 bPolygonActive = true;
                 break;
@@ -1244,9 +1254,7 @@ void SwRTFParser::ReadDrawingObject()
         aAnchor.SetAnchor( pPam->GetPoint() );
         aFlySet.Put( aAnchor );
 
-        SwFmtHoriOrient aHori( 0, text::HoriOrientation::NONE, text::RelOrientation::PAGE_FRAME );
         aFlySet.Put( aHori );
-        SwFmtVertOrient aVert( 0, text::VertOrientation::NONE, text::RelOrientation::PAGE_FRAME );
         aFlySet.Put( aVert );
 
         pDoc->GetOrCreateDrawModel();
-- 
cgit v1.2.3

-- 
cgit v1.2.3

-- 
cgit v1.2.3


From bae73094a02deaad5f23027869151a866e6287e7 Mon Sep 17 00:00:00 2001
From: Jan Holesovsky <kendy@suse.cz>
Date: Wed, 13 Jul 2011 20:17:35 +0200
Subject: Fix counting the paragraphs, fdo#36816.

Signed-off-by: Noel Power <noel.power@novell.com>
Signed-off-by: Michael Meeks <michael.meeks@novell.com>
---
 sw/source/core/txtnode/txtedt.cxx | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/sw/source/core/txtnode/txtedt.cxx b/sw/source/core/txtnode/txtedt.cxx
index 08d0c6b67b..d54875a0e5 100644
--- a/sw/source/core/txtnode/txtedt.cxx
+++ b/sw/source/core/txtnode/txtedt.cxx
@@ -1803,6 +1803,10 @@ void SwTxtNode::CountWords( SwDocStat& rStat,
     {   // not counting hidden paras
         return;
     }
+
+    // count of non-empty paras
+    ++rStat.nPara;
+
     // Shortcut when counting whole paragraph and current count is clean
     if ( isCountAll && !IsWordCountDirty() )
     {
@@ -1842,8 +1846,6 @@ void SwTxtNode::CountWords( SwDocStat& rStat,
     sal_uInt32 nTmpChars = 0;        // count of all chars
     sal_uInt32 nTmpCharsExcludingSpaces = 0;  // all non-white chars
 
-    ++rStat.nPara;      // count of non-empty paras
-
     // count words in masked and expanded text:
     if( pBreakIt->GetBreakIter().is() )
     {
-- 
cgit v1.2.3


From 33f8e4826ca01860cef7f85ab5f4ccb298ec371d Mon Sep 17 00:00:00 2001
From: Miklos Vajna <vmiklos@frugalware.org>
Date: Thu, 14 Jul 2011 16:44:32 +0200
Subject: starmath: check for existing edit window

Signed-off-by: Michael Meeks <michael.meeks@novell.com>
Signed-off-by: Petr Mladek <pmladek@suse.cz>
Signed-off-by: Jonas Finnemann Jensen <jopsen@gmail.com>
---
 starmath/source/view.cxx | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/starmath/source/view.cxx b/starmath/source/view.cxx
index 3a099c331d..662911e030 100644
--- a/starmath/source/view.cxx
+++ b/starmath/source/view.cxx
@@ -195,6 +195,8 @@ void SmGraphicWindow::MouseButtonDown(const MouseEvent& rMEvt)
 
         if (pNode)
         {	SmEditWindow  *pEdit = pViewShell->GetEditWindow();
+            if (!pEdit)
+                return;
             const SmToken  aToken (pNode->GetToken());
 
             // set selection to the beginning of the token
-- 
cgit v1.2.3


From da18e058e54024bfb1a8694e0a316423a57f154b Mon Sep 17 00:00:00 2001
From: Miklos Vajna <vmiklos@frugalware.org>
Date: Fri, 15 Jul 2011 18:11:43 +0200
Subject: starmath: check for edit window when inline editing is enabled

Signed-off-by: Michael Meeks <michael.meeks@novell.com>
Signed-off-by: Petr Mladek <pmladek@suse.cz>
Signed-off-by: Jonas Finnemann Jensen <jopsen@gmail.com>
---
 starmath/source/view.cxx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/starmath/source/view.cxx b/starmath/source/view.cxx
index 662911e030..c924e31e75 100644
--- a/starmath/source/view.cxx
+++ b/starmath/source/view.cxx
@@ -224,7 +224,8 @@ void SmGraphicWindow::GetFocus()
 {
     if (!IsInlineEditEnabled())
         return;
-    pViewShell->GetEditWindow()->Flush();
+    if (pViewShell->GetEditWindow())
+        pViewShell->GetEditWindow()->Flush();
     //Let view shell know what insertions should be done in visual editor
     pViewShell->SetInsertIntoEditWindow(false);
     SetIsCursorVisible(true);
-- 
cgit v1.2.3

-- 
cgit v1.2.3

-- 
cgit v1.2.3