| 2d2c30bc | 18-Sep-2026 |
Peter <petko@apache.org> |
filter: idxf: port the input-validation hunks missed by the #491 backport
PR #491 was landed on AOO41X as 3c5a7184f8 ("cherry pick and adaptation
of merge commit c082241a9b"), but three hardening hu
filter: idxf: port the input-validation hunks missed by the #491 backport
PR #491 was landed on AOO41X as 3c5a7184f8 ("cherry pick and adaptation
of merge commit c082241a9b"), but three hardening hunks of the series did
not survive the adaptation:
* DXFBoundaryPathData::EvaluateGroup, group 93: the vertex count taken
from the file was used for `new DXFVector[n]` without checking the
reader status or the sign. A negative or unread count reached
operator new[]; a huge one threw std::bad_alloc out of the filter.
Check GetStatus() and n >= 0, and turn bad_alloc into a reader error.
* DXFHatchEntity::EvaluateGroup, group 91: identical problem for the
boundary-path count driving `new DXFBoundaryPathData[n]`.
* DXFGroupReader::ReadI: the hand-rolled do/while accumulated digits
without any overflow or termination check, so it also ran once on a
non-digit before testing. Parse with strtol over the digit run and
reject the group unless the converted span ends exactly where the
scan did.
Both allocation sites are reachable from HATCH entities in an untrusted
DXF, which is what makes these worth carrying over rather than leaving to
the next full sync.
Also fixes the "assoiciative" comment typo on nAssociativityFlag, so the
file matches trunk.
No functional change beyond the above: after this commit the idxf sources
on AOO41X are content-identical to the #491 head (96b0524be2), modulo the
trailing-whitespace cleanup trunk applied to the licence headers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
show more ...
|
| 95d0ce3a | 13-Jun-2019 |
Matthias Seidel <mseidel@apache.org> |
Changed branding OpenOffice.org -> Apache OpenOffice, fixed typos
git-svn-id: https://svn.apache.org/repos/asf/openoffice/trunk@1861305 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commi
Changed branding OpenOffice.org -> Apache OpenOffice, fixed typos
git-svn-id: https://svn.apache.org/repos/asf/openoffice/trunk@1861305 13f79535-47bb-0310-9956-ffa450edef68
(cherry picked from commit 96cf728913ec7f6434e34c935a8d609679e6cb64)
show more ...
|
| d1836b62 | 12-Jan-2023 |
Damjan Jovanovic <damjan@apache.org> |
In ODF (19.679.2 of ODF 1.3), the <table:covered-table-cell> element's
table:number-columns-repeated attribute has a default value of 1,
meaning the cell spans the cell to its right. However when the
In ODF (19.679.2 of ODF 1.3), the <table:covered-table-cell> element's
table:number-columns-repeated attribute has a default value of 1,
meaning the cell spans the cell to its right. However when the XSLT import
filter converts from SpreadsheetML's ss:MergeAcross to ODF's
table:number-columns-repeated, it always inserts a <table:covered-table-cell>
element, and then adds the table:number-columns-repeated attribute only if
it is greater than 1. This breaks when ss:MergeAcross="0", because ODF's
defaulting to 1 ends up occupying an extra empty cell to the right when it
shouldn't.
Fix this by only inserting the <table:covered-table-cell> when
ss:MergeAcross > 0.
Add a test document to prove this.
Fixes #100989 - SpreadsheetML: cell with ss:MergeAcross="0" gets an extra empty cell to the right
Patch by: me
(cherry picked from commit a896732bfcd282115c06407a2f1da77694fa8d19)
show more ...
|
| ffb2f9cd | 14-Jan-2023 |
Damjan Jovanovic <damjan@apache.org> |
When importing SpreadsheetML ss:DateTime, import the entire value, not only the
first 19 characters.
Add a test file for this bug.
Fixes: #128554 - Office 2003 SpreadsheetML: fractional seconds are
When importing SpreadsheetML ss:DateTime, import the entire value, not only the
first 19 characters.
Add a test file for this bug.
Fixes: #128554 - Office 2003 SpreadsheetML: fractional seconds are silently
ignored during import
Patch by: me
(cherry picked from commit 195282cf3d8bfaa9e1cec43b093251d9df87f4ba)
show more ...
|
| 4926b382 | 13-Jan-2023 |
Damjan Jovanovic <damjan@apache.org> |
Dates and times are loaded wrongly from SpreadsheetML files, because the filter
loads only the date or time portion of the ss:DateTime based on the cell's
style.
Rather always load the ss:DateTime a
Dates and times are loaded wrongly from SpreadsheetML files, because the filter
loads only the date or time portion of the ss:DateTime based on the cell's
style.
Rather always load the ss:DateTime as our ODF office:date-value in the
XMLSchema-2 dateTime format, with both its date and time part, and then rely on
formatting to display only the date or time as desired.
Fixes: #82849 - SpreadsheetML ss:DateTime cell value is loaded as either only
a date or a time
Patch by: Philip J. Turmel <philip@turmel.org>
Reviewed by: me
(cherry picked from commit 0db4a4f44da1c0fb06154ba61c960a18427e751b)
show more ...
|
| 0285e67f | 11-Jan-2023 |
Damjan Jovanovic <damjan@apache.org> |
Our XSLT-based MS Office 2003 SpreadsheetML format import filter, when doing
conversion from R1C1 style column references to our A1 style references, had a
bug where it was treating the column value
Our XSLT-based MS Office 2003 SpreadsheetML format import filter, when doing
conversion from R1C1 style column references to our A1 style references, had a
bug where it was treating the column value as 0-based, and dividing by 26 to
find the 1st letter and taking the remainder when divided by 26 for the second
letter. Those numbers are then each converted to a letter [0 = nothing,
1 = "A", 2 = "B", ..., 26 = "Z"].
However since R1C1 is 1-based, and not 0-based, this breaks for column numbers
which are multiples of 26, as 26 mod 26 = 0, so the least significant digit is
converted to nothing while the most significant digit gets incremented too
early.
Fix this by converting the column number to 0-based by subtracting 1 before
calculation, then adding 1 to the least significant digit afterwards.
Also the fact we have 2 letters limited us to a maximum of 26^2 = 676 columns,
after which column references would wrap around. Fix this too, by adding a 3rd
letter, which lets us address a maximum of 17576 columns.
Add a sample file to our unit tests.
Found by: alex dot plantema at xs4all dot nl
Patch by: me
(cherry picked from commit 577fe17932e0dec38662067d1a86e7fd6ae525b6)
show more ...
|
| ba6c1353 | 07-Oct-2018 |
Matthias Seidel <mseidel@apache.org> |
i127873 - Merge r1838291 from trunk
Ignore the SP_FGROUP flag on shape records. Instead assume that the
first shape in a shape group is the group shape. Add a new flag
parameter to SvxMSDffManager
i127873 - Merge r1838291 from trunk
Ignore the SP_FGROUP flag on shape records. Instead assume that the
first shape in a shape group is the group shape. Add a new flag
parameter to SvxMSDffManager::ImportShape() to indicate the whether
or not this is a group shape based on the calling context. Call
SvxMSDffManager::ImportShape() directly from SvxMSDffManager::ImportGroup()
instead of indirectly via SvxMSDffManager::ImportObj() to facilitate
passing the context information.
Don't call SvxMSDffManager::ProcessObj() from SvxMSDffManager::ImportShape()
when processing a group shape. SvxMSDffManager::ImportObj() expects
SvxMSDffManager::ImportShape() to return a pointer to an SdrObjGroup
object in this case, and SvxMSDffManager::ProcessObj() may replace
the SdrObjGroup object with some other type of shape object.
Change some C-style SdrObjGroup* casts to dynamic_cast so that incorrect
casts will create a NULL pointer and fail quickly rather than executing
methods on an object of the wrong type and doing something possibly
undefined.
Submitted by: truckman
git-svn-id: https://svn.apache.org/repos/asf/openoffice/branches/AOO416@1843062 13f79535-47bb-0310-9956-ffa450edef68
show more ...
|