SvxBrushItem::GetGraphic wants the name of the document the brush came
from, so take it as an argument and hand in SwDoc::GetLinkReferer
wherever a document is at hand, the Writer style, frame and background
shell paths included.
The dialog and example-window callers pass the name of the active
document shell through a new svx helper getActiveDocumentLinkReferer.
The hand-rolled copies of the GetPersist, HasName, GetMedium GetName
sequence elsewhere in sw now call SwDoc::GetLinkReferer too.
Change-Id: I8693d27869baed79962b2d5bdcb7b7e2c63227bb
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/8200
Reviewed-by: Stephan Bergmann <stephan.bergmann@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
(cherry picked from commit 18f91ac71710027479dfe9f206ae2207bad8f2b7)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209827
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
We have added various workarounds for ScPatternAttr use after free
issues since:
commit 2e1f9da8a6
Date: Sat Dec 23 15:52:06 2023 +0100
Decouple ScPatternAttr from SfxItemPool
separated ScPatternAttr from SfxItemPool.
Prior to that an ScPatternAttr was an SfxPoolItem held in the doc's
SfxItemPool which kept every item alive for the document's whole
lifetime, so any raw const ScPatternAttr* was basically safe.
The various workarounds for the new behaviour were:
commit dca19993a4c732e95b9a47e1abdcaad6efbeebe9
Date: Sat Jan 6 14:40:28 2024 +0100
tdf#159042: crash after changing cell style (if direct formatting done)
commit 19437715eb415fe2c40b8b40dbe04ddca28f9a35
Date: Thu Sep 12 12:06:28 2024 +0100
null pattern deref seen in ScViewData::SetEditEngine
commit e384f2e8de9603ee65a3edc6dcb50b07116ee4fc
Date: Mon Mar 10 14:45:22 2025 +0000
crashtesting: crash on reimport of xlsx output of forum-pl-2758.ods
commit 7999585bd8378f1a8d04ea2a9a93a8e0bf4d8eb6
Date: Fri May 9 08:50:17 2025 +0100
crash on null pattern de-ref
commit 1bf9bbea96
Date: Tue Oct 28 16:53:49 2025 +0300
tdf#169115: sc: fix use-after-free bug in ScDocument::FillInfo
commit 9f366af81478ad218dc2ef2e37423a9ebcc84e73
Date: Sat Apr 25 14:47:02 2026 +0200
ScPatternAttr use-after-free
commit 20fe691a18fb35120d0765dd1519acd6d2986c38
Date: Tue Apr 28 08:33:34 2026 +0200
ScPatternAttr use-after-free (2)
This commit picks the class member fields that are still raw
ScPatternAttr* and converts them to CellAttributeHolder:
ScUsedAreaIterator::pPattern and pFoundPattern
ScInputHandler::pLastPattern
LotAttrCol::ENTRY::pPattAttr
ScPatternCache::Entry::pPattern
The CalcAll() workaround from 9f366af81478 then doesn't seem to be needed(?)
A new compiler plugin catches class member fields of raw type
ScPatternAttr pointer.
Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: Ibb9f28b8fcaa5470c7a82eee52900c2d60434e41
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/3163
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 9c7b6313a29067bf0eef12884fc3ce7efb0374e5)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209822
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
This commit continues the cleanup of map.cxx by refactoring the
Polygon overload of OutputDevice::LogicToPixel to use the new
explicit ImplMapRes wrappers.
Key changes:
- Replaced the nested ViewToWindowUnits(LogicUnitsToViewUnits(...))
calls with the much cleaner LogicToWindowUnitsX/Y(..., aMapRes)
master wrappers.
- Removed legacy C-style pointer arithmetic (GetConstPointAry) in
favor of directly accessing and assigning to the polygon via the
overloaded operator[].
- Eliminated the temporary Point allocation and sequential setX/setY
calls, replacing them with a direct inline Point constructor.
- This dramatically improves the readability of the loop while
maintaining identical coordinate transformation behavior.
Change-Id: I25252b99f5fc8e1b7097d766cd74ac6e7e8f3e80
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/203669
Tested-by: Jenkins
Reviewed-by: Dan Williams <dcbw@libreoffice.org>
This commit improves the encapsulation of custom MapMode conversions
by adding ImplMapRes overloads to the LogicToWindowUnits master
wrappers in CoordinateMapper.
Previously, when OutputDevice::LogicToPixel was called with an
explicit custom MapMode, it had to bypass the standard wrappers and
manually chain the LogicUnitsToViewUnits and ViewToWindowUnits
pipeline stages inline. This resulted in highly verbose and difficult-
to-read rectangle initialization.
Key changes:
- Added LogicToWindowUnitsX(nX, rRes) and LogicToWindowUnitsY to
CoordinateMapper to safely encapsulate custom resolution scaling
while still applying the correct internal window offsets.
- Refactored OutputDevice::LogicToPixel(Rectangle, MapMode) in
map.cxx to use these new wrappers, drastically improving the
readability of the coordinate mapping logic.
Change-Id: Ib3af5314ad11653395b08c2ca722d66360baeb99
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/203668
Tested-by: Jenkins
Reviewed-by: Dan Williams <dcbw@libreoffice.org>
This commit replaces manual coordinate arithmetic in map.cxx with the
newly introduced CoordinateMapper pipeline stages and master wrappers,
improving encapsulation and fixing a subtle offset bug.
Key changes:
- OutputDevice::LogicToDeviceSubPixel: Replaced nested pipeline calls
and manual device origin additions with the LogicToDeviceSubPixel
master wrapper. This completely hides the math from map.cxx and
ensures the absolute logical offset (mnOutOffLogic) is correctly
applied before any DPI/MapMode scaling occurs.
- OutputDevice::ImplPixelToDevicePixel: Fixed an early-exit bug. The
legacy code only checked if the screen origin (mnOutOff) was zero
before returning early, completely ignoring whether the window had an
internal VCL pixel offset (mnOutOffOrig). By piping `0` through
ViewToWindowUnits and WindowToDeviceUnits, we now calculate the
exact combined spatial delta to check for the early exit and move
the region safely.
Change-Id: I697a0a7aa2bc4c03e55654305432b0805cee9c66
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/203667
Tested-by: Jenkins
Reviewed-by: Dan Williams <dcbw@libreoffice.org>
Updates the OutputDevice::LogicToPixel variant that accepts an
explicit MapMode to utilize CoordinateMapper pipeline stages.
Previously, this method manually composed the transformation by
adding ImplMapRes offsets, calling LogicToViewDistance, and then
adding the internal VCL pixel offset (mnOutOffOrigX/Y).
By refactoring this to use LogicUnitsToViewUnitsX/Y(nX, aMapRes)
nested within ViewToWindowUnitsX/Y, we maintain architectural
consistency with the rest of the mapper refactor. This ensures
that even when using a temporary resolution context, the coordinate
journey follows the standardized Logic -> View -> Window path
without exposing raw arithmetic in OutputDevice.
Change-Id: Ie39cf7d67d6461f418c942528abbbffbf7f9a7bc
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/203663
Tested-by: Jenkins
Reviewed-by: Dan Williams <dcbw@libreoffice.org>
Introduces LogicToWindowUnitsX and LogicToWindowUnitsY to the
CoordinateMapper API. These master wrappers chain the first two
stages of the forward transformation pipeline (LogicUnits -> View
-> Window), cleanly stopping before the final physical screen
offset is applied.
This addition is immediately put to use in map.cxx to refactor
OutputDevice::LogicToPixel for both Rectangles and Polygons.
It successfully collapses complex, nested inline arithmetic—such
as the manual scaling of logical offsets and the explicit addition
of internal VCL pixel offsets (mnOutOffOrigX/Y)—into single,
highly semantic API calls.
OutputDevice is now further isolated from the underlying mechanics
of the coordinate mapping math, continuing the encapsulation
goals of the mapper refactor.
Change-Id: Ifbc49b3c8ba5a84d864fe9a6626dcf587039241d
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/203662
Tested-by: Jenkins
Reviewed-by: Dan Williams <dcbw@libreoffice.org>
In the PDF export case, where a metafile is attached to the output device,
text drawing was not enabling clipping to the draw rectangle. This caused
tables with text that overflowed the table cell boundary (and thus which
should be hidden) to be drawn to the PDF.
SwTextFrame::PaintSwFrame() must first create the SwSaveClip helper with
a valid OutputDevice and then SwTextPainter::DrawTextLine() must actually
update the clip region on the helper, which happened in the OnWin() case
but not for PDF export (where OnWin() is false).
Change-Id: Ic89371cd59b2c5bde2962767b2da67a0e8b9ad4e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/209015
Tested-by: Jenkins
Reviewed-by: Dan Williams <dcbw@libreoffice.org>
Andrea Gelmini