vcl/source/outdev/ImplMapRes.cxx:190:23: runtime error: signed integer overflow: 0 - -9223372036854775808 cannot be represented in type 'tools::Long' (aka 'long')
#0 0x5afc86b89af9 in AbsoluteToLocalX vcl/source/outdev/ImplMapRes.cxx:190:23
#1 0x5afc86b89af9 in ImplMapRes::TransformPointX(long, ImplMapRes const&) const vcl/source/outdev/ImplMapRes.cxx:214:21
#2 0x5afc862abe28 in OutputDevice::LogicToLogic(Point const&, MapMode const*, MapMode const*) const vcl/source/outdev/map.cxx:991:32
#3 0x5afc862ab0eb in OutputDevice::SetRelativeMapMode(MapMode const&) vcl/source/outdev/map.cxx:417:16
#4 0x5afc85733670 in (anonymous namespace)::GraphicExporter::GetGraphic((anonymous namespace)::ExportSettings const&, Graphic&, bool) svx/source/unodraw/UnoGraphicExporter.cxx:909:19
when none of the shapes rendered for a SmartArt fallback has any
content the bound stays empty, and the metafile origin taken from
the minimum of that empty range rounds to LONG_MIN
so start an empty bound at 0,0
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I7f35f6280a882cd5c49de3e411bc0d006cdf9725
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13623
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 47dca3b9edf464297b1cef08a6223885d12efebf)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211528
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Timeout in rtf2pdffuzzer, stack sampled with gdb:
#14 writerfilter::rtftok::RTFDocumentImpl::dispatchDestination at sw/source/writerfilter/rtftok/rtfdispatchdestination.cxx:83
#15 writerfilter::rtftok::RTFTokenizer::dispatchKeyword at sw/source/writerfilter/rtftok/rtftokenizer.cxx:2190
#16 writerfilter::rtftok::RTFTokenizer::resolveKeyword at sw/source/writerfilter/rtftok/rtftokenizer.cxx:2146
a \fldinst cut off at the end of the file, before the field name ends,
was scanned for that end forever
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I1210ec48b0cbc333ab58b6662df71a22be8d0391
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13416
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 0b0a478ab8f533eb89dd1267e3d3860b8c62b167)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211455
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
A PPTX shape keeps the fit the file was saved with until its text is
edited, and after that it is fitted by our own rules.
The fontScale and lnSpcReduction of a normAutofit never reached the
shape, for three reasons.
Import passed fractions to the TextFitToSizeFontScale and
TextFitToSizeSpacingScale properties, which are percentages.
A missing lnSpcReduction was read as 100000, a full reduction,
instead of 0.
When both properties were set in one setPropertyValues call along
with TextFitToSize, the collected fit item was applied last and
overwrote the scales.
Change-Id: I6b7fcfb6a1822f289f18b8ce77e78526a80f8944
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13539
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit c6938c35aa527883e2fd867f36e22c396601d376)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211506
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
seen on converting forums/xlsx/forum-mso-en4-237685.xlsx to xls and
doing a hard recalculation of the reloaded export, which aborts with:
soffice.bin: sc/inc/formulacell.hxx:514: void ScFormulaCell::MaybeInterpret():
Assertion `!rDocument.IsThreadedGroupCalcInProgress()' failed.
#11 ScFormulaCell::MaybeInterpret at sc/inc/formulacell.hxx:514
#12 ScFormulaCell::IsEmpty at sc/source/core/data/formulacell.cxx:3218
#13 ScRefCellValue::hasEmptyValue at sc/source/core/data/cellvalue.cxx:705
#14 ScInterpreter::Compare at sc/source/core/tool/interpr1.cxx:881
#15 ScInterpreter::ScNotEqual at sc/source/core/tool/interpr1.cxx:1162
#16 ScInterpreter::DispatchOpCode at sc/source/core/tool/interpr4.cxx:3852
#17 ScInterpreter::Interpret at sc/source/core/tool/interpr4.cxx:4414
#18 ScFormulaCell::InterpretTail at sc/source/core/data/formulacell.cxx:2274
#19 ScColumn::CalculateInThread at sc/source/core/data/column2.cxx:3270
#20 ScTable::CalculateInColumnInThread at sc/source/core/data/table1.cxx:2740
#21 ScDocument::CalculateInColumnInThread at sc/source/core/data/documen8.cxx:421
#22 Executor::doWork at sc/source/core/data/formulacell.cxx:5541
#23 comphelper::ThreadTask::exec at comphelper/source/misc/threadpool.cxx:320
lcl_InterpretSpan calculates the first cell of a dirty span with a
group call and the cells after it one at a time, and rechecks only
the cells it calculated one at a time.
The first cell can still be dirty when that call returns. The
dependency walk found a cycle, so the group was rejected, and that is
recorded on the group itself, as mbPartOfCycle and a meCalcState of
GroupCalcDisabled. Interpret then skips InterpretTail, so that only
the group which starts the cycle is calculated.
Both flags sit on the group that was rejected, while lcl_InterpretSpan
looks at the parent group. The bool it gets back says whether a group
interpret was done, not whether this cell was calculated, so the cell
has to be asked.
The rest of the span and the ungrouped cells have been checked for
exactly this since:
commit 4f36f2ccab
Date: Fri Sep 4 15:51:07 2020 +0200
detect if a cell still needs interpreting after Interpret()
so check the first cell too, and leave the group to the unthreaded
path when it was left uncalculated
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I3756ed54fbbb9caf48467e0faab5f5cdddb8e5da
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12674
Reviewed-by: Tomaž Vajngerl <tomaz.vajngerl@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit e685bd07146af13db00f6b6811b74d2eba297d80)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211379
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
==1168891==ERROR: AddressSanitizer: heap-use-after-free on address 0x7cc3f9900268
READ of size 8 at 0x7cc3f9900268 thread T0
#0 in BigPtrEntry::GetPos() const sw/inc/bparr.hxx:107:5
#1 in SwNode::GetIndex() const sw/inc/node.hxx:317:57
#2 in SwTableBox::GetSttIdx() const sw/source/core/table/swtable.cxx:2288:41
#3 in SwCellFrame::SwCellFrame(SwTableBox const&, SwFrame*, bool) sw/source/core/layout/tabfrm.cxx:5968:37
#4 in SwRowFrame::SwRowFrame(SwTableLine const&, SwFrame*, bool) sw/source/core/layout/tabfrm.cxx:4822:33
#5 in SwTabFrame::SwTabFrame(SwTable&, SwFrame*) sw/source/core/layout/tabfrm.cxx:109:32
#6 in SwTableNode::MakeFrame(SwFrame*) sw/source/core/docnode/ndtbl.cxx:2474:16
#7 in InsertCnt_(SwLayoutFrame*, SwDoc&, ...) sw/source/core/layout/frmtool.cxx:1735:34
#8 in SwRootFrame::Init(SwFrameFormat*) sw/source/core/layout/newfrm.cxx:511:5
#9 in SwViewShell::Init(SwViewOption const*, long) sw/source/core/view/vnew.cxx:143:23
An empty table cell keeps its section because the SwTableBox that owns
the cell points at the start node. Nothing updates
SwTableBox::m_pStartNode, so removing the section leaves the table's
sort array holding a box that points at freed memory.
The ww8 import flushes its redline stack in WW8TabDesc::FinishSwTable
when the table finishes, and a tracked change that continues across a
cell mark gives a range with its two ends in different cells, and
applying it emptied the cell section.
so keep the empty start/end pair only when the table that owns the
cell survives the deletion too
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ia3f9cb45e361095f17a5a544f1efcd2a7465ef3f
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/11630
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit f196f8dfeda9ee0bdc7dc859f456582ddb0ce054)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211378
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
seen on converting interop-test-files/doc/forum-mso-en4-218597.doc to
rtf and reloading the export, which aborts with:
soffice.bin: sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:10493:
void writerfilter::dmapper::DomainMapper_Impl::substream(Id, const
writerfilter::Reference<writerfilter::Stream>::Pointer_t&):
Assertion `m_aContextStack.size() == contextSize' failed.
#12 writerfilter::dmapper::DomainMapper_Impl::substream at engine/sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:10494
#13 writerfilter::dmapper::DomainMapper::lcl_substream at engine/sw/source/writerfilter/dmapper/DomainMapper.cxx:5039
#14 writerfilter::LoggedStream::substream at engine/sw/source/writerfilter/dmapper/LoggedResources.cxx:275
#15 writerfilter::rtftok::RTFDocumentImpl::resolveSubstream at engine/sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx:407
#16 writerfilter::rtftok::RTFDocumentImpl::resolveSubstream at engine/sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx:379
#17 writerfilter::rtftok::RTFDocumentImpl::sectBreak at engine/sw/source/writerfilter/rtftok/rtfdocumentimpl.cxx:778
#18 writerfilter::rtftok::RTFDocumentImpl::dispatchSymbol at engine/sw/source/writerfilter/rtftok/rtfdispatchsymbol.cxx:217
In the header \intbl makes the table buffer current, so \shptxt buffers
the shape start instead of sending it to the dmapper. A paragraph mark
inside the shape text finds no table properties in that buffer and
decides it is not in a table. Replaying the buffer then sends the start
to the dmapper, and the start pushes a paragraph context.
When the shape text group ends the current buffer is still set, so the
end is appended to the buffer that was just drained. Nothing replays
that buffer again, so the paragraph context stays on the stack and the
header substream ends deeper than it began.
The start and the end have tested the current buffer separately since:
commit 818d80eb0c
Date: Fri Jun 28 16:47:49 2013 +0200
RTF import: support shapes inside tables
so remember whether the shape is open in the dmapper, and send its end
there directly when it is
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ifb94f77e3db4d3fcc6041a7927e88c62d9d970a4
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12757
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 306c1f840c413b352940513c83d1498d599b8359)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211313
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
seen on converting interop-test-files/odt/ooo115853-3.odt to odt,
which faults with:
#0 SwLayoutFrame::Lower() const (this=0x0) at engine/sw/source/core/inc/layfrm.hxx:103
#1 SwLayoutFrame::ContainsContent() const (this=0x0) at engine/sw/source/core/layout/findfrm.cxx:107
#2 GetBodyTextNode at engine/sw/source/core/fields/expfld.cxx:234
#3 SwChapterField::ChangeExpansion at engine/sw/source/core/fields/chpfld.cxx:145
#4 SwTextFormatter::NewFieldPortion at engine/sw/source/core/text/txtfld.cxx:113
...
#20 SwViewShell::CalcLayout() at engine/sw/source/core/view/viewsh.cxx:1005
#21 SwEditShell::CalcLayout() at engine/sw/source/core/edit/edws.cxx:89
#22 SwXFrame::getPropertyValue at engine/sw/source/core/unocore/unoframe.cxx:2225
#23 XMLTextParagraphExport::addTextFrameAttributes at engine/xmloff/source/text/txtparae.cxx:2969
A chapter field in the header asks GetBodyTextNode which text node the
page starts with. When the first body content of the page sits in the
repeated headline of a follow table, that headline is a repeat of the
master table's heading, so the code takes the first row after it
instead.
GetFirstNonHeadlineRow returns nothing when the follow holds only
repeated headline rows. The export reaches it in the middle of a
layout calculation, which SwXFrame::getPropertyValue starts in order
to answer a property of a text frame in a table cell.
GetFrameInPage in trvlfrm.cxx does the same step for the same reason
and checks the row it gets. Both callers arrived together,
probably since:
commit a3db03b8d4
Date: Mon May 3 12:45:37 2004 +0000
INTEGRATION: CWS gt03 (1.17.22); FILE MERGED 2004/03/11 14:55:03 fme 1.17.22.1: #26165# Feature - Multiple headline rows in tables
so check the row here too, and leave the fallback underneath to take
the content below the header
Not reproduced locally. The odt export runs clean here, under the
crashtest font set and through the harness round trip as well, and the
branch is reached eight times on this document with a row present each
time. Setting that row to null under gdb gives the frames above.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I5adb3b9495cfafe11cfa98d701a8ab7476b986bc
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12786
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 653b962592ae7ee257c8b7d28070e95d35cd09e1)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211312
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
seen on converting interop-test-files/odt/tdf118553-1.odt, tdf118558-1.odt
and tdf91677-1.odt to doc and reloading the exports
One dies with a stack overflow, SwFrame::InvalidateInfFlags recursing
between a column frame and a body frame that are each other's upper. The
other two abort on the pTmp->IsTabFrame() assertion at
sw/source/core/layout/sectfrm.cxx:2016 in SwFrame::GetNextSctLeaf, reached
through SwFrame::GetNextFootnoteLeaf and SwContentFrame::MoveFootnoteCntFwd.
Every doc import turns on ContinuousEndnotes, so AppendFootnote makes a
section frame for the endnotes at the end of the document and inserts it
into the page's body frame. When the page style has more than one column the
body's lowers are column frames and all the text lives in the column bodies,
so the endnote section became a sibling of the columns. Its next sibling is
then a column frame, which GetNextSctLeaf doesn't expect, and the move it
makes puts a column frame under its own child body frame.
since:
commit 6885dcd7ec
Date: Tue May 14 08:28:33 2024 +0200
tdf#160984 sw continuous endnotes: switch to a section-based layout
so work out where the section belongs once, in GetEndNoteSectionUpper, and
let both the insert and GetEndNoteSection ask it
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I474131fca4f74254a5168d79d83ba11116abc692
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12675
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit f29d74eea952d3a9ea90b32afe2c9a8047afc10a)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211310
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
reproduce by converting novell485609-1.doc to odt and loading the
export, which fails with:
warn:sax:19444:19444:sax/source/fastparser/fastparser.cxx:649: Unexpected exception from XML parser com.sun.star.lang.IllegalArgumentException message: "at sw/source/core/unocore/unotext.cxx:923" ArgumentPosition: 0
Error: source file could not be loaded
#0 SwXText::ComparePositions (this=0x55555962dab8, xPos1=..., xPos2=...) at sw/source/core/unocore/unotext.cxx:923
#1 0x00007fffcb3ae036 in SwXText::compareRegionStarts (this=0x55555962dab8, xRange1=..., xRange2=...) at sw/source/core/unocore/unotext.cxx:965
#2 0x00007fffe7ec5ccc in InsertFieldmark (rImport=..., rHelper=..., isFieldmarkSeparatorMissing=false) at xmloff/source/text/XMLTextMarkImportContext.cxx:196
#3 0x00007fffe7ec7743 in XMLTextMarkImportContext::endFastElement (this=0x5555597140d0, nElement=3804281) at xmloff/source/text/XMLTextMarkImportContext.cxx:434
#4 0x00007fffe7aba6c2 in SvXMLImport::endFastElement (this=0x5555594e8030, Element=3804281) at xmloff/source/core/xmlimp.cxx:1086
CheckForOwnMember made a cursor and took the section node it landed in
as the node this text starts at. createXTextCursor moves forward to
the first content node, so in a cell that starts with a nested table
it lands in that table's first cell.
The fieldmark here is in a paragraph under such a table, so the check
reported it as belonging to some other text.
GetStartNode can be used to do this without a cursor and is apparently
the typical pattern used elsewhere.
see also:
commit 01ce0e62df
Date: Tue Jun 12 06:28:29 2001 +0000
#86004#: performance: check cursor position using start node
which moved insertString onto it, so use it here too, the last of
these checks that still makes a cursor
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I57ba4b23308daa1c0f3d6cb64686bce678f72aa6
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13108
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit b88b52f2694ff696e6141add82fc3c89b64243fc)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211294
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
The document-wide link update permission is decided when the document is
loaded. But media files that the users interactively inserts should be
automatically allowed.
Remember on the media object that the user picked the reference and
allow it on its own, the same way a presentation sound the user picks is
allowed. A reference that arrived with the document still needs the
document-wide permission.
since:
commit f0768394c14f928d47547408fc1195368be81f86
Date: Tue Jul 14 19:12:01 2026 +0100
put slideshow media links under link control
see also:
commit 0aa870b7b5a6bda50bab50c7a0a41d28fdf4f6ab
Date: Wed Jun 17 09:37:23 2026 +0000
bring external presentation sounds under link management
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/7939
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
(cherry picked from commit 17c0a99a0886b397d5682b87209e34c01fdcd44f)
Change-Id: I711fee12416e3e5e91fc07999ea62df32684b625
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211276
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
42 was never a flag value. SystemShellExecuteFlags publishes DEFAULTS 0,
NO_SYSTEM_ERROR_MESSAGE 1 and URIS_ONLY 2, and 42 needs bits 2, 8 and 32. It
was a private signal meaning the parameter is already quoted.
since:
commit c582b21de9
Date: Wed Jul 11 14:04:25 2007 +0000
INTEGRATION: CWS stclient (1.16.22); FILE MERGED 2007/07/03 07:43:38 obr 1.16.22.1: #b6573281# the answer to all questions
the only caller arrived the same day in
c61477eea7, a Solaris Service Tags startup job in
framework/source/jobs/shelljob.cxx. It defined the number as
ANSWER_TO_ALL_QUESTIONS and carried the comment explaining it, which is why a
bare 42 was all that was left here.
the job moved to osl_executeProcess in January 2008 in
5629b13246, and the wrapper it drove went in
6b8e02c741, "Kill Sun-specific stclient_wrapper".
unreachable regardless since URIS_ONLY took the value 2 in
d4b67611c4, because 42 & 2 is 2 and so the
URIS_ONLY test above it diverts any caller passing 42.
so always escape the parameter and drop the unused branch
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I6f95a0a6a1ff7d39456b999c11f8aa91e36833c0
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12883
Reviewed-by: Stephan Bergmann <stephan.bergmann@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 0e4a3baffc249372706508681977a9c486e4d73f)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211109
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
reproduce by converting the crashtesting document
bitmapreadaccess_getpixelforn24bittcbgr_segmentation_fault.sample,
which is a pdf despite its name, to odg:
soffice.bin: sd/source/filter/pdf/sdpdffilter.cxx:102: bool ImportPDF(...):
Assertion `nPageNumber >= 0 && o3tl::make_unsigned(nPageNumber) < aGraphics.size()' failed.
pdfium cannot read three of the five pages here. Both the page size by
index and the page itself fail, so this isn't our size test being too
strict. The file is fuzzed, mutool reports a broken xref and an
invalid object number, and one MediaBox reads
[ 1612934155079108773 0 594 841 ].
ImportPDFUnloaded dropped each page that it couldn't read, so a five
page pdf became a two page Draw document with nothing to say three
pages were lost. The graphics that remained kept their own pdf page
numbers, which then had gaps, and the last one pointed past the end.
Keep an entry for every page the pdf declares. Such a page takes the
size of the last page that did come through, A4 to start, and warns.
It still carries its own page number, so there are no gaps left for
sd to trip over.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Id0d0bde13a2102b4e30cc0dd71edf17031406e1d
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/5639
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 321ab2f58f62bf3037ee32e1696bacd14c8f06ed)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211020
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
every following newline was skipped, so stream data starting with
0x0a or 0x0d lost a byte and an encrypted stream decrypted to the
wrong bytes
CppunitTest_vcl_pdf_encryption failed at random in CI with:
PDFEncryptionTest.cxx:362:Assertion
Test name: (anonymous namespace)::testEmbeddedDocumentOfEncryptedHybridFile::TestBody
equality assertion failed
- Expected: 0
- Actual : -38
Failures !!!
Run: 16 Failure total: 1 Failures: 1 Errors: 0
since:
commit b6f98b7115
Date: Wed Oct 26 17:55:02 2016 +0200
xmlsecurity PDF verify: support SHA-256
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I72e4e72506942ed0151e5d96a1abc94cce1a059f
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/11825
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit b42ffcd8af9427a0ecdfe917d897db98d4f00b6f)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210954
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
every custom xml item was given the values of every data-bound control,
so a document with two data stores came back with both controls showing
the same value, and testTdf147724 failed in ci with:
xmltesttools.cxx:214:Assertion
Test name: testTdf147724::Load_Verify_Reload_Verify
equality assertion failed
- Expected: Placeholder -> *ABC*
- Actual : Placeholder -> *HERUNTERLADEN*
- In <>, XPath contents of child does not match
the second control's data binding names no store, so the import picks a
store by std::unordered_map iteration order. That order differs from one
builder to the next, and the test accepts either value for that control,
so only some machines saw the failure.
since:
commit b5c616d10b
Date: Wed Nov 24 14:50:12 2021 +0300
tdf#104823: support for sdt plain text fields
so keep the storeItemID of the data binding along with the value and
only update the item whose ds:itemID matches it
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I794ebb7c647ecddcd2cee3e90c25145ba4c32b97
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/12083
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
(cherry picked from commit b522379deae4c9df243d0493a3d242e80822c171)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210923
Tested-by: Jenkins
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
drawinglayer/source/tools/emfphelperdata.cxx:771:32: runtime error: load of value 4280295456, which is not a valid value for type 'EmfPlusHatchStyle'
#0 0x7b14dd7d4d02 in emfplushelper::EmfPlusHelperData::EMFPPlusFillPolygon(basegfx::B2DPolyPolygon const&, bool, unsigned int) drawinglayer/source/tools/emfphelperdata.cxx:771:32
#1 0x7b14dd7f903a in emfplushelper::EmfPlusHelperData::processEmfPlusData(SvMemoryStream&, drawinglayer::geometry::ViewInformation2D const&) drawinglayer/source/tools/emfphelperdata.cxx:1776:29
#2 0x7b14dd7c020c in emfplushelper::EmfPlusHelper::processEmfPlusData(SvMemoryStream&, drawinglayer::geometry::ViewInformation2D const&) drawinglayer/source/tools/emfplushelper.cxx:41:14
#3 0x7b14dd932d9d in wmfemfhelper::implInterpretMetafile(GDIMetaFile const&, wmfemfhelper::TargetHolders&, wmfemfhelper::PropertyHolders&, drawinglayer::geometry::ViewInformation2D const&) drawinglayer/source/tools/wmfemfhelper.cxx:2957:43
#4 0x7b14dd919d51 in wmfemfhelper::interpretMetafile(GDIMetaFile const&, drawinglayer::geometry::ViewInformation2D const&) drawinglayer/source/tools/wmfemfhelper.cxx:2993:9
#5 0x7b14dd470d93 in drawinglayer::primitive2d::MetafilePrimitive2D::create2DDecomposition(drawinglayer::geometry::ViewInformation2D const&) const drawinglayer/source/primitive2d/metafileprimitive2d.cxx:42:42
#6 0x7f14fb527e4f in drawinglayer::primitive2d::BufferedDecompositionPrimitive2D::get2DDecomposition(drawinglayer::primitive2d::Primitive2DDecompositionVisitor&, drawinglayer::geometry::ViewInformation2D const&) const drawinglayer/source/primitive2d/BufferedDecompositionPrimitive2D.cxx:90:41
#7 0x7b14dd4727d5 in TestImportWMF drawinglayer/source/primitive2d/metafileprimitive2d.cxx:149:16
so keep the hatch style as the value read from the stream, and an
unknown one then reaches the switch default
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I9725f2f80d3a00fbf82ac5a84cf55b5c071af68b
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/11529
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 906c713f2cdd05372db04c1d807d31b1fff5377a)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210589
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
reproduce by loading crashtesting (rtf) file:
swxtextframe_createtextcursorbyrange.sample
and exporting it to pdf:
#0 SwContentNode::GetSwAttrSet (this=0x0) at sw/inc/node.hxx:750
#1 SwTextFrame::RecalcAllLines at sw/source/core/text/txtfrm.cxx:4130
#2 SwLayAction::FormatContent at sw/source/core/layout/layact.cxx:1870
#3 SwLayAction::InternalAction at sw/source/core/layout/layact.cxx:640
#4 SwLayAction::Action at sw/source/core/layout/layact.cxx:418
#5 SwViewShell::CalcLayout at sw/source/core/view/viewsh.cxx:990
the frame at #2 has m_pMergedPara 0, GetDep() 0 and mbInDtor true, so
it was freed under the object formatting two statements earlier:
SwFrame::DestroyFrame (the follow)
SwTextFrame::JoinFrame frmform.cxx:778
SwTextFrame::AdjustFollow_ frmform.cxx:681
SwTextFrame::FormatAdjust / Format_ / Format
SwContentFrame::MakeAll calcmove.cxx:1633
SwFrame::Calc (the MASTER)
SwAnchoredDrawObject::MakeObjPosAnchoredAtPara
SwObjectFormatter::FormatObj_
SwObjectFormatterTextFrame::DoFormatObj
SwObjectFormatter::FormatObjsAtFrame_
FormatContent is formatting a follow frame. Placing a drawing object
anchored in that paragraph calls Calc on the master, the master reflows
and takes back its text, and JoinFrame then destroys the follow.
the loop already keeps an SfxDeleteListener on pContentPrev, so keep one
on pContent too and return false, and the caller invalidates the page and
runs it again.
no unit test, the layout tests only have the bundled fonts and this
document asks for Palatino Linotype. Only P052, its metric substitute,
keeps the layout that splits the paragraph, and P052 isn't bundled
either, so the document needs adjusting first.
reached since:
commit ac332d53d565325f3db2697126d97e02a15e4b5d
Date: Wed Aug 26 21:02:06 2026 +0000
crashtesting: pass the collected page number to CheckMovedFwdCondition
which dropped the DoFormatObj assert that used to stop this document
before the object formatting could complete the join.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I64e95ba6d3a6fda6ab585b5f319be2fb8bca8533
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/11273
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit ab7337476075e0b903ec5cb705821d8b3a14e9f7)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210590
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
see on loading forums/xlsx/forum-mso-en4-748529.xlsx and doing a
hard recalculation, which aborts with:
soffice.bin: sc/inc/formulacell.hxx:514: void ScFormulaCell::MaybeInterpret():
Assertion `!rDocument.IsThreadedGroupCalcInProgress()' failed.
#4 ScFormulaCell::MaybeInterpret at sc/inc/formulacell.hxx:514
#5 ScFormulaCell::IsEmpty at sc/source/core/data/formulacell.cxx:3153
#6 FillMatrixHandler::operator() at sc/source/core/data/column2.cxx:2636
#7 sc::ParseBlock at sc/inc/mtvfunctions.hxx:66
#8 ScColumn::FillMatrix at sc/source/core/data/column2.cxx:2708
#9 ScTable::FillMatrix at sc/source/core/data/table1.cxx:2700
#10 ScDocument::FillMatrix at sc/source/core/data/documen8.cxx:400
#11 ScInterpreter::CreateMatrixFromDoubleRef at sc/source/core/tool/interpr5.cxx:386
#12 ScInterpreter::ScSpilledRange at sc/source/core/tool/interpr1.cxx:1703
#13 ScInterpreter::DispatchOpCode at sc/source/core/tool/interpr4.cxx:3868
#14 ScInterpreter::Interpret at sc/source/core/tool/interpr4.cxx:4414
#15 ScFormulaCell::InterpretTail at sc/source/core/data/formulacell.cxx:2209
#16 ScColumn::CalculateInThread at sc/source/core/data/column2.cxx:3270
#17 ScTable::CalculateInColumnInThread at sc/source/core/data/table1.cxx:2740
#18 ScDocument::CalculateInColumnInThread at sc/source/core/data/documen8.cxx:421
#19 Executor::doWork at sc/source/core/data/formulacell.cxx:5463
ScSpilledRange calculates cells itself. It calls MaybeInterpret on the
master cell of the dynamic array, and CreateMatrixFromDoubleRef then
covers the whole spill range, so FillMatrix asks every cell in that
range whether it is empty and IsEmpty calculates it. A worker thread
inside a threaded group calculation must not calculate a cell.
The dependency evaluator can't cover it either, only the operand's own
cell is named by a reference token and how far the spill reaches is
known only once that cell has been calculated
an issue since:
commit 9b97b0fc91bce4b8726ea210347e8ea84270e148
Date: Mon Jul 6 13:09:39 2026 +0000
sc: add the # postfix operator for spilled-range references
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Id58e88d1bd927576e4723dd23bc119673feed108
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/11285
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Tomaž Vajngerl <tomaz.vajngerl@collabora.com>
(cherry picked from commit 89af05e8a5e8ce4ae337e2f0048f670940573930)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210542
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
reproduce by loading ooo59043-1.odt and exporting it to the binary doc
format, which toggles the tracked-change display.
that save-time show and hide joins and splits the text nodes, and can
leave the spell wrong list with an invalid end past the now shorter
text.
the idle autospell then maps that end and asserts, here with nIndex 15
on a 12 char node:
soffice.bin: sw/source/core/text/txtfrm.cxx:1344:
Assertion `nIndex <= pNode->Len()' failed.
#4 sw::MapModelToView (nIndex=15) at txtfrm.cxx:1344
#5 SwTextFrame::MapModelToView (nIndex=15) at txtfrm.cxx:1385
#6 lcl_CalculateRepaintRect (nChgStart=0, nChgEnd=15) at txtedt.cxx
#7 SwTextFrame::AutoSpell_ at txtedt.cxx:1519
#8 SwLayIdle::DoIdleJob_ (ONLINE_SPELLING) at layact.cxx:2171
#9 SwLayIdle::DoIdleJob at layact.cxx:2312
#10 SwLayIdle::SwLayIdle at layact.cxx:2573
#11 SwViewShell::LayoutIdle at viewsh.cxx:927
#12 sw::DocumentTimerManager::DoIdleJobs at DocumentTimerManager.cxx:179
AutoSpell_ already tolerates the over-long end, set with std::max
against the text length a few lines up, and the word scanner stops at
the real end.
so clamp the repaint range the same way before it is mapped.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I5ad086753f8b3fc0f838a45a7291cd62a4d4a343
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6699
Reviewed-by: Andras Timar <andras.timar@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 1920f81f2df779c9787256c9ad93903640817419)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210508
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
There are two rules for which node of a merged paragraph provides the
paragraph properties. The classic rule takes the first node that has
visible text.
Under the classic rule, when SwContentNode::DelFrames deletes the
properties node and it is also the last node, no node has visible text
left, so the merge must be empty. An assert checks that, and it always
held until:
commit 0849ddd0b1
Date: Wed Oct 8 19:29:46 2025 +0200
sw: text formatting: implement per-line paragraph properties like Word
which added the second rule: with a hidden paragraph mark the
properties node is the last node, even while earlier nodes still have
visible text. Now the same delete can happen while the merge still has
visible text, and the assert fires falsely.
So allow non-empty extents in hidden paragraph mode too. The existing
relocation loop already picks the correct new properties node under
both rules.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I599b0c09c92e5f9adaa1874a6de5a054eb947d8b
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/9281
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 29b5b72c31483af4585fe419ce1789b990c55c8e)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210477
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
KillPython runs an inline CodeTaskFactory task that compiles a temporary
dll and loads it. Two parallel builds on one machine race over that dll,
and one build fails to find it:
pyproject.props(176,5): error MSB4175: The task factory "CodeTaskFactory"
could not be loaded from the assembly "...\Microsoft.Build.Tasks.Core.dll".
Could not find file '...\tmp\rmlsuizu\rmlsuizu.dll'.
KillPython only kills a stray python.exe that holds the output file open
across an incremental rebuild. A clean build has none to kill, so pass
/p:KillPython=false to override pythoncore.vcxproj and skip the target.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ic6cc3d51d4409bce6cc95137626debcab67dbc53
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/10183
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit a287185f62eaa49f03ab0b3b2e5d956221ef9997)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210291
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
reproduce by loading bugtrackers/docx/novell592907-1.docx under the
crashtest reduced font set:
soffice.bin: sw/source/core/layout/objectformattertxtfrm.cxx:235: virtual bool SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool): Assertion `GetPageFrame().GetPhyPageNum() == GetPgNumOfCollected(nIdx)' failed.
#12 SwObjectFormatterTextFrame::DoFormatObj(SwAnchoredObject&, bool) at ./sw/source/core/layout/objectformattertxtfrm.cxx:238
#13 SwObjectFormatter::FormatObj(SwAnchoredObject&, SwFrame*, SwPageFrame const*, SwLayAction*) at ./sw/source/core/layout/objectformatter.cxx:191 (discriminator 3)
#14 CalcContent(SwLayoutFrame*, bool) at ./sw/source/core/layout/fly.cxx:1880 (discriminator 4)
a cluster of 27 crashtesting documents assert like this
partial revert of:
commit 533a998e54
Date: Thu May 6 18:20:14 2021 +0200
tdf#138518 sw: layout: fix assert on ooo43913-1.doc
The two page numbers only have to match for the FormatObjsAtFrame_
caller. On the CalcContent route the formatter is built with the anchor
text frame's page, while Collect recorded the page of the frame holding
the anchor character. Here the anchor paragraph is split over two
pages: the anchor character sits in the follow on page 2 while
CalcContent formats the master on page 1. Nothing has moved.
In a release build the anchor is then measured from the formatter's
page and looks moved forward, so the master paragraph gets marked to
move to the next page for an anchor that never moved.
The other user of the page frame parameter, the scan over the page's
flys, was removed in:
commit 59a917305d
Date: Wed Dec 10 21:13:55 2025 +0500
tdf#169882: revert commit c799de145f
leaving GetPhyPageNum as its only use, so pass the snapshot page number
collected earlier and drop the asserts. Whether an anchor moved forward
is again decided against the page numbering recorded at collect time,
as it was before 533a998e54.
A debug build without this change aborts reliably on loading the added
test document. Its final layout is the same with and without the
change, so the test asserts only the page count.
The tdf#138518 bugdoc ooo43913-1.doc still passes in crashtesting with
this change
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I248072d9e7101f1f925d6d75e3cb7a9dec855313
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/10147
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
(cherry picked from commit ac332d53d565325f3db2697126d97e02a15e4b5d)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/210289
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
SvxBrushItem::GetGraphic wants the name of the document the brush came
from, so take it as an argument and hand in SwDoc::GetLinkReferer
wherever a document is at hand, the Writer style, frame and background
shell paths included.
The dialog and example-window callers pass the name of the active
document shell through a new svx helper getActiveDocumentLinkReferer.
The hand-rolled copies of the GetPersist, HasName, GetMedium GetName
sequence elsewhere in sw now call SwDoc::GetLinkReferer too.
Change-Id: I8693d27869baed79962b2d5bdcb7b7e2c63227bb
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/8200
Reviewed-by: Stephan Bergmann <stephan.bergmann@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 18f91ac71710027479dfe9f206ae2207bad8f2b7)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209827
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
We have added various workarounds for ScPatternAttr use after free
issues since:
commit 2e1f9da8a6
Date: Sat Dec 23 15:52:06 2023 +0100
Decouple ScPatternAttr from SfxItemPool
separated ScPatternAttr from SfxItemPool.
Prior to that an ScPatternAttr was an SfxPoolItem held in the doc's
SfxItemPool which kept every item alive for the document's whole
lifetime, so any raw const ScPatternAttr* was basically safe.
The various workarounds for the new behaviour were:
commit dca19993a4c732e95b9a47e1abdcaad6efbeebe9
Date: Sat Jan 6 14:40:28 2024 +0100
tdf#159042: crash after changing cell style (if direct formatting done)
commit 19437715eb415fe2c40b8b40dbe04ddca28f9a35
Date: Thu Sep 12 12:06:28 2024 +0100
null pattern deref seen in ScViewData::SetEditEngine
commit e384f2e8de9603ee65a3edc6dcb50b07116ee4fc
Date: Mon Mar 10 14:45:22 2025 +0000
crashtesting: crash on reimport of xlsx output of forum-pl-2758.ods
commit 7999585bd8378f1a8d04ea2a9a93a8e0bf4d8eb6
Date: Fri May 9 08:50:17 2025 +0100
crash on null pattern de-ref
commit 1bf9bbea96
Date: Tue Oct 28 16:53:49 2025 +0300
tdf#169115: sc: fix use-after-free bug in ScDocument::FillInfo
commit 9f366af81478ad218dc2ef2e37423a9ebcc84e73
Date: Sat Apr 25 14:47:02 2026 +0200
ScPatternAttr use-after-free
commit 20fe691a18fb35120d0765dd1519acd6d2986c38
Date: Tue Apr 28 08:33:34 2026 +0200
ScPatternAttr use-after-free (2)
This commit picks the class member fields that are still raw
ScPatternAttr* and converts them to CellAttributeHolder:
ScUsedAreaIterator::pPattern and pFoundPattern
ScInputHandler::pLastPattern
LotAttrCol::ENTRY::pPattAttr
ScPatternCache::Entry::pPattern
The CalcAll() workaround from 9f366af81478 then doesn't seem to be needed(?)
A new compiler plugin catches class member fields of raw type
ScPatternAttr pointer.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ibb9f28b8fcaa5470c7a82eee52900c2d60434e41
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/3163
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 9c7b6313a29067bf0eef12884fc3ce7efb0374e5)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209822
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
db_maxkeys came from the index header, the key count of a page came from the
page itself, and node access used neither. Now the header value is capped to
the number of keys a DINDEX_PAGE_SIZE page can hold for the given key length,
each page keeps its own capacity and caps its key count to it, and node
positions are clamped to the same bound, so all three agree.
ODbaseIndex::CreateImpl worked out db_maxkeys from a four byte page header
while the reader counts eight bytes of page header, so use eight here too and
write an index the reader agrees with.
ONDXPage::Remove asserted on a position past the key count and then carried on
regardless, so return early instead.
ONDXPage::Merge added the key counts of two pages together in a sal_uInt16, so
widen the sum to sal_uInt32.
nValue was a file-level static shared by the page read and write operators for
no reason, so make it a local in the reader and write rPage.nCount directly.
The two GetChild overloads would load a child page that is already on the chain
of parents the descent came down, so leave such a page unread rather than
descending into a page we are inside. ONDXPage::Merge and ONDXPage::PrintPage
can then be handed a page that was left unread, so both check for one with
nothing loaded.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Id51bf8368099447df41aaacbaebba7783c5769e2
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/9518
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit db92d0be756305ec0b1e122a1d00333477c17ba5)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209449
Tested-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
saving fdo66811-1.odt back to odt writes its one paragraph-anchored
text frame twice into content.xml. on a dbgutil build the save
asserts in XMLTextParagraphExport::RecordNodeIndex with:
xmloff/source/text/txtparae.cxx:1826: Assertion `it == maDocumentNodeOrder.end() || isInShapesTextFrame(xTextContent)' failed.
a problem since:
commit 98ae340307
Date: Fri Apr 22 19:26:47 2022 +0200
tdf#135978 sw_redlinehide: recreate fly frames anchored to subsequent nodes
which recreates the flys of nodes merged under a redline frame on the
assumption that each node's own frame was deleted. here the anchor
node survived a join with its fly frame still attached, so the export's
redline flag flip made AppendObj create a second SwFlyAtContentFrame
on the same anchor frame, and the UNO layer reported the text frame
twice.
so check for an already attached fly before creating another one.
SwFlyFrameFormat::MakeFrames already does this before it creates a
fly, so factor its check out into FindFlyFrameOfFormat and call that
from both places.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I8fb148288844ee44c0318b8c760130ee2da488da
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/9280
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
(cherry picked from commit f095944cb1dfc278e726859bcb792f84c67a6adb)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209394
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
same fix as:
commit 671b1b51f26fbb8630d1f0022a6d2771bba938db
Date: Wed Jun 10 15:31:58 2026 +0000
crashtesting: skip the deferred-break paragraph split in headers and footers
that guarded the paragraph-mark branch of lcl_utext but not the run
branch beside it, which does the same finishParagraph plus
lcl_startParagraphGroup and pushes a CONTEXT_PARAGRAPH with no matching
pop. A column break as the first run of a header paragraph, followed by
text, flushes through the run branch, so tdf89392-1 still tripped the
stack-balance assert at the end of substream().
Reproduced with tdf89392-1.odt converted to docx and reloaded, dbgutil
build:
soffice.bin: sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:10400:
void writerfilter::dmapper::DomainMapper_Impl::substream(Id, const
writerfilter::Reference<writerfilter::Stream>::Pointer_t&): Assertion
`m_aContextStack.size() == contextSize' failed.
#21 writerfilter::dmapper::DomainMapper_Impl::substream at sw/source/writerfilter/dmapper/DomainMapper_Impl.cxx:10400
#22 writerfilter::dmapper::DomainMapper::lcl_substream at sw/source/writerfilter/dmapper/DomainMapper.cxx:5018
#23 writerfilter::LoggedStream::substream at sw/source/writerfilter/dmapper/LoggedResources.cxx:272
#24 writerfilter::ooxml::OOXMLDocument::resolveFastSubStreamWithId at sw/source/writerfilter/ooxml/OOXMLDocumentImpl.cxx:133
#25 writerfilter::ooxml::OOXMLDocument::resolveHeader at sw/source/writerfilter/ooxml/OOXMLDocumentImpl.cxx:399
#26 writerfilter::ooxml::OOXMLFastContextHandler::resolveHeader at sw/source/writerfilter/ooxml/OOXMLFastContextHandler.cxx:897
#27 writerfilter::ooxml::OOXMLHeaderHandler::finalize at sw/source/writerfilter/ooxml/Handler.cxx:214
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ib1126759fca9ff7772a573b7737817fb5f1f3ee7
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6704
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
(cherry picked from commit c1637ff78d7acd3fe8c081f7a4aefdd1a47910fb)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209376
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
reproduce by loading bugtrackers/odt/tdf136042-1.odt, exporting to rtf, and
loading the exported rtf, which crashes with:
#0 SwLineLayout::GetLineSpacingBaseHeight (this=0x0) at porlay.hxx:183
#1 SwTextFormatter::CalcRealHeight at itrform2.cxx:2442
#2 SwTextFormatter::NewFootnotePortion at txtftn.cxx:820
#3 SwTextFormatter::NewExtraPortion at txtfld.cxx:290
#4 SwTextFormatter::NewPortion at itrform2.cxx:1891
#5 SwTextFormatter::BuildPortions at itrform2.cxx:809
#6 SwTextFormatter::BuildMultiPortion at pormulti.cxx:2202
#7 SwTextFormatter::BuildPortions at itrform2.cxx:643
since:
commit 67a3d5c2b579d9db74ad575e45c1f554024ba0f7
Date: Thu May 28 17:28:23 2026 -0400
tdf#172233 sw: apply line spacing gap after the line, not before
BuildMultiPortion points m_pCurr at the nested lines of the multi-portion but
leaves alone the previous line the iterator cached for the paragraph, so GetPrev
returns that stale state, still null on the first line.
so skip the previous line lookup while a multi-portion is being formatted.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I9bd4cf33e34936263a67dc104a12258c1eabe244
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/9580
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit d0c2aed19e4e99c33261a294b947d8ef7f502eea)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209375
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
with a document loaded from file:///tmp/doc.html a data attribute
resolves as wanted:
<object data="movie.mp4"/> -> file:///tmp/movie.mp4
but with only a src attribute the empty data string resolved against
the base url and replaced the src url already in aURLObj with the
document's own url:
<object src="movie.mp4"/> -> file:///tmp/doc.html
now that case keeps its src url:
<object src="movie.mp4"/> -> file:///tmp/movie.mp4
since:
commit c40afac8a3
Date: Mon Mar 5 17:29:51 2018 +0100
sw XHTML import: map <object> to OLE objects
Change-Id: Ie18ce1ef35a55e618c126db050b0864b342b59df
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/8383
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 161009e7f14768d6c37620f722c00fb1f1bc3bee)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209249
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
reproduce by loading forum-mso-de-31447 and exporting it to pdf, reduced here
to the sw/qa/core/text/data/footnote-follow-join.fodt of this commit
a footnote frame is left pointing at a text frame that was already destroyed:
#0 SwFrame::IsBodyFrame (this=0x5) at sw/source/core/inc/frame.hxx:1259
#1 SwFootnoteBossFrame::FindBodyCont at sw/source/core/layout/findfrm.cxx:52
#2 SwFootnoteBossFrame::SetFootnoteDeadLine (nDeadLine=35945) at sw/source/core/layout/ftnfrm.cxx:2644
#3 SwSaveFootnoteHeight::SwSaveFootnoteHeight (nDeadLine=35945) at sw/source/core/layout/ftnfrm.cxx:3032
#4 SwContentFrame::MakeAll at sw/source/core/layout/calcmove.cxx:1397
#5 SwFrame::OptPrepareMake at sw/source/core/layout/calcmove.cxx:420
#6 SwFrame::OptCalc at sw/source/core/inc/frame.hxx:1135
#7 SwLayAction::FormatContent_ at sw/source/core/layout/layact.cxx:2041
#8 SwLayAction::FormatContent at sw/source/core/layout/layact.cxx:1847
#9 SwLayAction::InternalAction at sw/source/core/layout/layact.cxx:639
#10 SwLayAction::Action at sw/source/core/layout/layact.cxx:404
#11 SwViewShell::CalcLayout at sw/source/core/view/viewsh.cxx:1313
#12 SwEditShell::CalcLayout at sw/source/core/edit/edws.cxx:89
#13 SwXTextDocument::getRendererCount at sw/source/uibase/uno/unotxdoc.cxx:2788
#14 PDFExport::Export at filter/source/pdf/pdfexport.cxx:1147
When CalcFollow pulls text back from the follow, the follow's offset moves
forward past that text. Any footnote of the moved text is then outside the
follow's range, so nothing removes its footnote frame and it keeps pointing
at a text frame the layout later destroys. Remove those footnotes before the
new offset is set.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Iea3207159559434560ce869eed7c501f951ac940
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/7988
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
(cherry picked from commit 82e71e2fcd1ea124c12d991134dba1b69002a139)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208888
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Debian patches firebird to resolve its plugins, intl and conf
directories under the FIREBIRD variable (instead of where it was built)
and we want point that variable at a private directory. But then the
modules aren't loaded and no database opens.
So write a replacement plugins.conf that lists the absolute path of each
plugin module (and the intl conf files) with their macros expanded.
each lib<Name>.so (otherwise found by default) with no entry names gets
an entry of its own.
Change-Id: I2696d7197394b7fe9b7739732deadd2cb2e01acc
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/7989
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
(cherry picked from commit b8407b18adf3c6d552d54d7b6657539e2769afd6)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208882
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
there is one firebird engine per process and it reads its configuration once
from the directory we set up, so a .fdb the user picked somewhere else could
not be attached. firebird resolves a name in databases.conf before it treats
it as a path, so give the file a name there and pass firebird that name,
dropped again when the connection is disposed.
since:
commit 520d8173cef39a4da85b3ba21bdaaa3150384c25
Date: Sun Jul 12 12:10:41 2026 +0000
firebird: keep each embedded database's files in one directory
Change-Id: I4872a4e2165c4701bfb20be5dcd8c119b1723125
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/7990
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
(cherry picked from commit 6ab71a109bd8a8335208c9faa37a3cfa94523148)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208773
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
reproduce with a dbgutil build loading forum-mso-en-4208.docx
sw/source/core/crsr/bookmark.cxx:294
sw::mark::Fieldmark::IsCoveringPosition(this=0x0)
writerfilter field import calls InsertFieldmark, which splits the
paragraph. SwTextNode::CutImpl moves the text, which already carries
the CH_TXT_ATR_FIELDSTART/FIELDSEP/FIELDEND dummy characters, to the
destination node before the fieldmarks themselves are repositioned.
relocating a content-control nesting hint then runs sw::CalcBreaks
over the destination node. getFieldmarkAt finds no mark at the
FIELDSTART character and the assert at the FIELDSEP character
dereferences the null pushed for it.
keep pushing the possibly-null mark so start, separator and end stay
paired on the stack, and let the two asserts accept a null top entry.
The loop at the end over the still-open fields already handles a null
mark.
a similar guard existed since:
commit b3325ef8cd
Date: Sat Nov 6 16:40:17 2021 +0000
ofz40766 Null-dereference
until:
commit a7116b890c
Date: Tue Nov 16 14:28:15 2021 +0100
ofz#40766 svtools, sw: HTMLParser: really stop inserting control chars
removed it when the source of stray control characters was fixed
instead. Here the field characters are legitimate and only the mark
repositioning lags behind.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I9c7a33f5fac614645e420152c490765b53a7004c
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/6714
Tested-by: Michael Stahl <michael.stahl@collabora.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
(cherry picked from commit 274d1402efe96b367be1cf0fdfe7edd3641c9df2)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208770
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
A matrix formula cell holds the "top-left" result of its matrix in the
reference-counted xUpperLeft of ScMatrixFormulaCellToken.
CloneUpperLeftIfNecessary cloned that only for svDouble; other types
were kept by shared reference.
But threaded group calculation switches every token in the group's shared pCode
to RefCntPolicy::None while worker threads interpret it, on the basis that
interpreting only reads pCode, since:
commit 791a2489ee
Date: Sun Mar 24 21:31:38 2024 +0000
Related: tdf#160056 elide ref counting for initial tokens
A matrix formula whose result is a string constant from its own pCode
broke that: the pCode token was taken as the upper left during the None
window, so its IncRef was a no-op.
At teardown the matrix released it and freed a token the pCode array
still pointed at.
Where the uncounted reference is taken:
#1 boost::intrusive_ptr<formula::FormulaToken const>::operator=
boost/smart_ptr/intrusive_ptr.hpp:121
#2 ScMatrixFormulaCellToken::Assign sc/source/core/tool/token.cxx
#3 ScFormulaResult::SetToken sc/source/core/tool/formularesult.cxx:206
#4 ScFormulaResult::Assign sc/source/core/tool/formularesult.cxx:171
#5 ScFormulaCell::InterpretTail sc/source/core/data/formulacell.cxx:2476
#6 ScColumn::CalculateInThread sc/source/core/data/column2.cxx:3266
#7 ScTable::CalculateInColumnInThread sc/source/core/data/table1.cxx:2715
#8 ScDocument::CalculateInColumnInThread sc/source/core/data/documen8.cxx:420
#9 ...Executor::doWork() sc/source/core/data/formulacell.cxx:5437
#10 comphelper::ThreadTask::exec
Clone the upper left when it is svDouble (as before) or not reference counted
(RefCntPolicy::None). The clone is a counted token the cell owns, so no
reference into pCode is taken during the threaded window. The non-threaded
path is unchanged.
Also assert in HandleStuffAfterParallelCalculation that a matrix result's
upper left does not alias the cell's own pCode.
Found with an ASan+UBSan build reloading crashtest document
forum-mso-en4-676909.
The original motivating tdf#160056 benchmark document never visits this
clone branch, so that case remains unchanged.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ibd9e93aa9e59fabb99941a92a16aef247f7ae160
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/5638
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 2a70b7a75ce8768e077ea42175e59465d3adba31)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208769
Tested-by: Jenkins
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
The document-wide link update permission is decided when the document is
loaded. But media files that the users interactively inserts should be
automatically allowed.
Remember on the media object that the user picked the reference and
allow it on its own, the same way a presentation sound the user picks is
allowed. A reference that arrived with the document still needs the
document-wide permission.
since:
commit f0768394c14f928d47547408fc1195368be81f86
Date: Tue Jul 14 19:12:01 2026 +0100
put slideshow media links under link control
see also:
commit 0aa870b7b5a6bda50bab50c7a0a41d28fdf4f6ab
Date: Wed Jun 17 09:37:23 2026 +0000
bring external presentation sounds under link management
Change-Id: Id9fd49245fbfe2d62d767e3cb04370b2e5197fe1
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/7939
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Michael Stahl <michael.stahl@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/7961
(cherry picked from commit 82f3a17f461fb2d0057cc81625f7ae1e301db3ad)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208739
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
reproduce by converting doc/forum-mso-de-53089.doc to odt, which asserts on a
paragraph whose node index was recorded twice:
xmloff/source/text/txtparae.cxx:1826: Assertion
`it == maDocumentNodeOrder.end()
|| isInShapesTextFrame(xTextContent)' failed.
when a paragraph mark is hidden the paragraph that follows it is laid out in
the same text frame.
that one text frame has the objects anchored in every node it covers.
CollectFrameAtNode is asked about one node at a time, so its layout branch
listed the fly for each of the merged nodes and the odt export wrote it twice.
the branch that runs without a layout already takes only the objects whose
anchor node is the node it was asked about, so now both branches answer alike.
a node hidden inside a merged text frame keeps its own objects either way,
as the merged frame is reachable from every node it covers.
the assert shows up on this document since:
commit 9df0b0af0743923e84722cec3a452e15b35963cf
Date: Fri Jun 12 15:37:29 2026 -0400
tdf#164800 doc import: don't limit RES_PARATR_LIST_AUTOFMT to SwNumRule
which fills RES_PARATR_LIST_AUTOFMT for every paragraph imported from DOC,
hidden paragraph marks included, so HideIterator merges nodes that never
merged before.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ice2d156c04e763bca25e4e623f82304ed31e63e0
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/7885
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
(cherry picked from commit 5c23db772b3164b18ade74c40637d0cb35a31c33)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/208726
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
Caolán McNamara