cppcanvas/source/mtfrenderer/emfplus.cxx | 16 external/curl/CVE-2017-8816.patch | 67 + external/curl/CVE-2018-1000005.patch | 36 external/curl/CVE-2018-1000007.patch | 110 ++ external/curl/UnpackedTarball_curl.mk | 3 external/liborcus/0001-protect-the-self-closing-xml-element-code-against-se.patch | 30 external/liborcus/UnpackedTarball_liborcus.mk | 1 hwpfilter/source/hcode.cxx | 30 hwpfilter/source/hwpfile.h | 2 include/o3tl/safeint.hxx | 124 ++ oox/source/ole/vbacontrol.cxx | 10 package/source/zipapi/MemoryByteGrabber.hxx | 2 package/source/zipapi/ZipFile.cxx | 10 sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls |binary sc/qa/unit/data/xls/pass/forcepoint-selfseriesadd.xls |binary sc/source/core/data/column3.cxx | 4 sc/source/filter/excel/xichart.cxx | 23 sc/source/filter/xml/xmlcelli.cxx | 2 sc/source/ui/inc/viewdata.hxx | 4 sc/source/ui/view/viewdata.cxx | 12 sot/source/sdstor/stgstrms.cxx | 4 sw/qa/core/data/odt/fail/forcepoint-dtor-1.odt |binary sw/qa/core/data/rtf/fail/forcepoint-7.rtf | 517 ++++++++++ sw/qa/core/data/rtf/pass/forcepoint-1.rtf | 193 +++ sw/source/core/txtnode/fntcache.cxx | 3 sw/source/filter/ww8/ww8toolbar.cxx | 4 sw/source/filter/xml/xmlimp.cxx | 5 sw/source/filter/xml/xmltbli.cxx | 7 sw/source/filter/xml/xmltexti.cxx | 11 vcl/inc/sft.hxx | 14 vcl/source/fontsubset/sft.cxx | 149 +- vcl/source/gdi/pdfwriter_impl2.cxx | 27 vcl/source/helper/strhelper.cxx | 9 vcl/unx/generic/glyphs/freetype_glyphcache.cxx | 4 vcl/unx/generic/printer/jobdata.cxx | 14 writerfilter/source/dmapper/DomainMapperTableManager.cxx | 13 writerfilter/source/dmapper/DomainMapperTableManager.hxx | 1 writerfilter/source/dmapper/TableManager.cxx | 2 writerfilter/source/rtftok/rtfdispatchvalue.cxx | 2 xmloff/source/draw/ximpcustomshape.cxx | 2 xmloff/source/text/txtparai.cxx | 15 41 files changed, 1350 insertions(+), 132 deletions(-)
New commits: commit c0e9139bb4779ca90e15bd5960a161c79dc2902d Author: Kohei Yoshida <[email protected]> Date: Wed Feb 21 20:08:23 2018 -0500 Patch liborcus to avoid incorrect parsing of XML. Found by Antti Levomäki and Christian Jalio from Forcepoint. This one is not a backport from the master branch. On the master branch the same fix will come from updating liborcus from 0.13.3 to 0.13.4. (cherry picked from commit 160350de5f07024b22fb5a9b596918ccc7f22c75) Conflicts: external/liborcus/UnpackedTarball_liborcus.mk Reviewed-on: https://gerrit.libreoffice.org/50147 Tested-by: Jenkins <[email protected]> Reviewed-by: Markus Mohrhard <[email protected]> (cherry picked from commit f25bc1254782589af5d24471599260b65558154a) Conflicts: external/liborcus/UnpackedTarball_liborcus.mk Change-Id: I701c5a65ff67d77767913f8d056682b9db549f84 diff --git a/external/liborcus/0001-protect-the-self-closing-xml-element-code-against-se.patch b/external/liborcus/0001-protect-the-self-closing-xml-element-code-against-se.patch new file mode 100644 index 000000000000..990665f9c383 --- /dev/null +++ b/external/liborcus/0001-protect-the-self-closing-xml-element-code-against-se.patch @@ -0,0 +1,30 @@ +From 12e5d89cbd7101c61fbdf063322203a1590a0ef5 Mon Sep 17 00:00:00 2001 +From: Markus Mohrhard <[email protected]> +Date: Wed, 21 Feb 2018 00:29:03 +0100 +Subject: [PATCH] protect the self-closing xml element code against + self-closing root elements +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Found by Antti Levomäki and Christian Jalio from Forcepoint. +--- + include/orcus/sax_parser.hpp | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/orcus/sax_parser.hpp b/include/orcus/sax_parser.hpp +index ba5ebcd..67d5943 100644 +--- a/include/orcus/sax_parser.hpp ++++ b/include/orcus/sax_parser.hpp +@@ -171,6 +171,8 @@ void sax_parser<_Handler,_Config>::element_open(std::ptrdiff_t begin_pos) + m_handler.start_element(elem); + reset_buffer_pos(); + m_handler.end_element(elem); ++ if (!m_nest_level) ++ m_root_elem_open = false; + #if ORCUS_DEBUG_SAX_PARSER + cout << "element_open: ns='" << elem.ns << "', name='" << elem.name << "' (self-closing)" << endl; + #endif +-- +2.7.4 + diff --git a/external/liborcus/UnpackedTarball_liborcus.mk b/external/liborcus/UnpackedTarball_liborcus.mk index 08f3423f2424..51f6e55e1de1 100644 --- a/external/liborcus/UnpackedTarball_liborcus.mk +++ b/external/liborcus/UnpackedTarball_liborcus.mk @@ -16,6 +16,7 @@ $(eval $(call gb_UnpackedTarball_set_patchlevel,liborcus,1)) $(eval $(call gb_UnpackedTarball_add_patches,liborcus,\ external/liborcus/0001-workaround-a-linking-problem-on-windows.patch \ external/liborcus/rpath.patch.0 \ + external/liborcus/0001-protect-the-self-closing-xml-element-code-against-se.patch \ )) ifeq ($(OS),WNT) commit ecae24f56f20b47e03b445fbaaf9b0f5702b7fb2 Author: Michael Stahl <[email protected]> Date: Wed Jan 24 22:24:03 2018 +0100 curl: fix CVE-2018-1000005/1000007 * don't upgrade to new release, no idea how the new windows build system likes targeting Win XP which is still supported in 5.4 Change-Id: I4fbd7f1c5f1f0563895f6f8ede10063621d10a4b Reviewed-on: https://gerrit.libreoffice.org/48542 Tested-by: Jenkins <[email protected]> Reviewed-by: Eike Rathke <[email protected]> (cherry picked from commit ed497921314ebd41fce3483c92ca433b502628ca) diff --git a/external/curl/CVE-2018-1000005.patch b/external/curl/CVE-2018-1000005.patch new file mode 100644 index 000000000000..7b5578b1aacc --- /dev/null +++ b/external/curl/CVE-2018-1000005.patch @@ -0,0 +1,36 @@ +From fa3dbb9a147488a2943bda809c66fc497efe06cb Mon Sep 17 00:00:00 2001 +From: Zhouyihai Ding <[email protected]> +Date: Wed, 10 Jan 2018 10:12:18 -0800 +Subject: [PATCH] http2: fix incorrect trailer buffer size + +Prior to this change the stored byte count of each trailer was +miscalculated and 1 less than required. It appears any trailer +after the first that was passed to Curl_client_write would be truncated +or corrupted as well as the size. Potentially the size of some +subsequent trailer could be erroneously extracted from the contents of +that trailer, and since that size is used by client write an +out-of-bounds read could occur and cause a crash or be otherwise +processed by client write. + +The bug appears to have been born in 0761a51 (precedes 7.49.0). + +Closes https://github.com/curl/curl/pull/2231 +--- + lib/http2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/http2.c b/lib/http2.c +index 8e2fc71996..699287940e 100644 +--- a/lib/http2.c ++++ b/lib/http2.c +@@ -925,8 +925,8 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame, + + if(stream->bodystarted) { + /* This is trailer fields. */ +- /* 3 is for ":" and "\r\n". */ +- uint32_t n = (uint32_t)(namelen + valuelen + 3); ++ /* 4 is for ": " and "\r\n". */ ++ uint32_t n = (uint32_t)(namelen + valuelen + 4); + + DEBUGF(infof(data_s, "h2 trailer: %.*s: %.*s\n", namelen, name, valuelen, + value)); diff --git a/external/curl/CVE-2018-1000007.patch b/external/curl/CVE-2018-1000007.patch new file mode 100644 index 000000000000..c474370c78ad --- /dev/null +++ b/external/curl/CVE-2018-1000007.patch @@ -0,0 +1,110 @@ +From af32cd3859336ab963591ca0df9b1e33a7ee066b Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <[email protected]> +Date: Fri, 19 Jan 2018 13:19:25 +0100 +Subject: [PATCH] http: prevent custom Authorization headers in redirects + +... unless CURLOPT_UNRESTRICTED_AUTH is set to allow them. This matches how +curl already handles Authorization headers created internally. + +Note: this changes behavior slightly, for the sake of reducing mistakes. + +Added test 317 and 318 to verify. + +Reported-by: Craig de Stigter +Bug: https://curl.haxx.se/docs/adv_2018-b3bf.html +--- + docs/libcurl/opts/CURLOPT_HTTPHEADER.3 | 12 ++++- + lib/http.c | 10 +++- + lib/setopt.c | 2 +- + lib/urldata.h | 2 +- + tests/data/Makefile.inc | 2 +- + tests/data/test317 | 94 +++++++++++++++++++++++++++++++++ + tests/data/test318 | 95 ++++++++++++++++++++++++++++++++++ + 7 files changed, 212 insertions(+), 5 deletions(-) + create mode 100644 tests/data/test317 + create mode 100644 tests/data/test318 + +diff --git a/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 b/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 +index c5ccb1a53d..c9f29e393e 100644 +--- a/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 ++++ b/docs/libcurl/opts/CURLOPT_HTTPHEADER.3 +@@ -5,7 +5,7 @@ + .\" * | (__| |_| | _ <| |___ + .\" * \___|\___/|_| \_\_____| + .\" * +-.\" * Copyright (C) 1998 - 2015, Daniel Stenberg, <[email protected]>, et al. ++.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <[email protected]>, et al. + .\" * + .\" * This software is licensed as described in the file COPYING, which + .\" * you should have received as part of this distribution. The terms +@@ -77,6 +77,16 @@ the headers. They may be private or otherwise sensitive to leak. + + Use \fICURLOPT_HEADEROPT(3)\fP to make the headers only get sent to where you + intend them to get sent. ++ ++Custom headers are sent in all requests done by the easy handles, which ++implies that if you tell libcurl to follow redirects ++(\fBCURLOPT_FOLLOWLOCATION(3)\fP), the same set of custom headers will be sent ++in the subsequent request. Redirects can of course go to other hosts and thus ++those servers will get all the contents of your custom headers too. ++ ++Starting in 7.58.0, libcurl will specifically prevent "Authorization:" headers ++from being sent to other hosts than the first used one, unless specifically ++permitted with the \fBCURLOPT_UNRESTRICTED_AUTH(3)\fP option. + .SH DEFAULT + NULL + .SH PROTOCOLS +diff --git a/lib/http.c b/lib/http.c +index c1cdf2da02..a5007670d7 100644 +--- a/lib/http.c ++++ b/lib/http.c +@@ -714,7 +714,7 @@ Curl_http_output_auth(struct connectdata *conn, + if(!data->state.this_is_a_follow || + conn->bits.netrc || + !data->state.first_host || +- data->set.http_disable_hostname_check_before_authentication || ++ data->set.allow_auth_to_other_hosts || + strcasecompare(data->state.first_host, conn->host.name)) { + result = output_auth_headers(conn, authhost, request, path, FALSE); + } +@@ -1636,6 +1636,14 @@ CURLcode Curl_add_custom_headers(struct connectdata *conn, + checkprefix("Transfer-Encoding:", headers->data)) + /* HTTP/2 doesn't support chunked requests */ + ; ++ else if(checkprefix("Authorization:", headers->data) && ++ /* be careful of sending this potentially sensitive header to ++ other hosts */ ++ (data->state.this_is_a_follow && ++ data->state.first_host && ++ !data->set.allow_auth_to_other_hosts && ++ !strcasecompare(data->state.first_host, conn->host.name))) ++ ; + else { + CURLcode result = Curl_add_bufferf(req_buffer, "%s\r\n", + headers->data); +diff --git a/lib/setopt.c b/lib/setopt.c +index 66f30ea653..a5ef75c722 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -976,7 +976,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, + * Send authentication (user+password) when following locations, even when + * hostname changed. + */ +- data->set.http_disable_hostname_check_before_authentication = ++ data->set.allow_auth_to_other_hosts = + (0 != va_arg(param, long)) ? TRUE : FALSE; + break; + +diff --git a/lib/urldata.h b/lib/urldata.h +index 4dcd1a322c..5c04ad1720 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -1599,7 +1599,7 @@ struct UserDefined { + bool http_keep_sending_on_error; /* for HTTP status codes >= 300 */ + bool http_follow_location; /* follow HTTP redirects */ + bool http_transfer_encoding; /* request compressed HTTP transfer-encoding */ +- bool http_disable_hostname_check_before_authentication; ++ bool allow_auth_to_other_hosts; + bool include_header; /* include received protocol headers in data output */ + bool http_set_referer; /* is a custom referer used */ + bool http_auto_referer; /* set "correct" referer when following location: */ diff --git a/external/curl/UnpackedTarball_curl.mk b/external/curl/UnpackedTarball_curl.mk index 4cabf2f1b80b..f9f3a8bf6016 100644 --- a/external/curl/UnpackedTarball_curl.mk +++ b/external/curl/UnpackedTarball_curl.mk @@ -24,6 +24,8 @@ $(eval $(call gb_UnpackedTarball_add_patches,curl,\ external/curl/curl-7.26.0_win-proxy.patch \ external/curl/curl-xp.patch.1 \ external/curl/CVE-2017-8816.patch \ + external/curl/CVE-2018-1000005.patch \ + external/curl/CVE-2018-1000007.patch \ )) ifeq ($(SYSTEM_NSS),) commit 05448abb3cd6f4c2bb85da5d6e4993fa7d1435ba Author: Michael Stahl <[email protected]> Date: Wed Nov 29 12:28:03 2017 +0100 curl: fix CVE-2017-8816 * don't upgrade to new release, no idea how the new windows build system likes targeting Win XP which is still supported in 5.4 * CVE-2017-8817 doesn't affect LO as CURLOPT_WILDCARDMATCH isn't used * CVE-2017-8818 doesn't affect the old 7.52 version Change-Id: I49ddb771ccdb93d5fe8f4b3544f74ab9b171c156 Reviewed-on: https://gerrit.libreoffice.org/45487 Tested-by: Jenkins <[email protected]> Reviewed-by: Caolán McNamara <[email protected]> Tested-by: Caolán McNamara <[email protected]> (cherry picked from commit aa0f44de5b260b2b2a39bdd2de9445d72ab14265) diff --git a/external/curl/CVE-2017-8816.patch b/external/curl/CVE-2017-8816.patch new file mode 100644 index 000000000000..dd4fa677e03f --- /dev/null +++ b/external/curl/CVE-2017-8816.patch @@ -0,0 +1,67 @@ +From 7947c50bcd09cf471c95511739bc66d2cb506ee2 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg <[email protected]> +Date: Mon, 6 Nov 2017 23:51:52 +0100 +Subject: [PATCH] ntlm: avoid integer overflow for malloc size + +Reported-by: Alex Nichols +Assisted-by: Kamil Dudka and Max Dymond + +CVE-2017-8816 + +Bug: https://curl.haxx.se/docs/adv_2017-11e7.html +--- + lib/curl_ntlm_core.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +diff --git a/lib/curl_ntlm_core.c b/lib/curl_ntlm_core.c +index 1309bf0d9..e8962769c 100644 +--- a/lib/curl_ntlm_core.c ++++ b/lib/curl_ntlm_core.c +@@ -644,23 +644,42 @@ CURLcode Curl_hmac_md5(const unsigned char *key, unsigned int keylen, + Curl_HMAC_final(ctxt, output); + + return CURLE_OK; + } + ++#ifndef SIZE_T_MAX ++/* some limits.h headers have this defined, some don't */ ++#if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4) ++#define SIZE_T_MAX 18446744073709551615U ++#else ++#define SIZE_T_MAX 4294967295U ++#endif ++#endif ++ + /* This creates the NTLMv2 hash by using NTLM hash as the key and Unicode + * (uppercase UserName + Domain) as the data + */ + CURLcode Curl_ntlm_core_mk_ntlmv2_hash(const char *user, size_t userlen, + const char *domain, size_t domlen, + unsigned char *ntlmhash, + unsigned char *ntlmv2hash) + { + /* Unicode representation */ +- size_t identity_len = (userlen + domlen) * 2; +- unsigned char *identity = malloc(identity_len); ++ size_t identity_len; ++ unsigned char *identity; + CURLcode result = CURLE_OK; + ++ /* we do the length checks below separately to avoid integer overflow risk ++ on extreme data lengths */ ++ if((userlen > SIZE_T_MAX/2) || ++ (domlen > SIZE_T_MAX/2) || ++ ((userlen + domlen) > SIZE_T_MAX/2)) ++ return CURLE_OUT_OF_MEMORY; ++ ++ identity_len = (userlen + domlen) * 2; ++ identity = malloc(identity_len); ++ + if(!identity) + return CURLE_OUT_OF_MEMORY; + + ascii_uppercase_to_unicode_le(identity, user, userlen); + ascii_to_unicode_le(identity + (userlen << 1), domain, domlen); +-- +2.15.0 + diff --git a/external/curl/UnpackedTarball_curl.mk b/external/curl/UnpackedTarball_curl.mk index 6a5720d78459..4cabf2f1b80b 100644 --- a/external/curl/UnpackedTarball_curl.mk +++ b/external/curl/UnpackedTarball_curl.mk @@ -23,6 +23,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,curl,\ external/curl/curl-7.26.0_mingw.patch \ external/curl/curl-7.26.0_win-proxy.patch \ external/curl/curl-xp.patch.1 \ + external/curl/CVE-2017-8816.patch \ )) ifeq ($(SYSTEM_NSS),) commit f58bf719637363f4f87f41afdeba8eacce3a543e Author: Caolán McNamara <[email protected]> Date: Fri Feb 9 10:35:33 2018 +0000 various sft fixes backport removing unneeded code use ptr diff rather than int (cherry picked from commit 5b426038a7befcaf0d05824ffb20200ff8833ad3) fix mem leak (cherry picked from commit 603cb6cf31a5212d03736a552770e5734b0e8066) check more table sizes (cherry picked from commit 1828490bb22f1c8273c4a9f5b1db819b173ca70d) check cmap offset (cherry picked from commit 683d9883ad8fd6568e6a7832e5bb347c1d043e4b) check tableoffset against size (cherry picked from commit ae73c3ff112e1ed38eb4678ac5745990661a2e66) check ntables offset (cherry picked from commit 75a171a405afd6eac236af93aa9d29a9c3ec9c64) use safeint on calculations (cherry picked from commit 139b6c6cf898467098f3a6f29fa84013a182285f) simplify returns (cherry picked from commit e8b2aad1cb2107304761e68aa380b5c29d8ef22f) extend to cover the last byte needed (cherry picked from commit c7b0117f26a386c98a721ff3897479c268103d74) bounds check (cherry picked from commit bb32616bdd6e3b327654bab0e1d790d8d50b893d) move largest bounds check to start (cherry picked from commit f832198e6a33052c7cc86b25843badfb962a2ae8) android:update safeint header to use the else implementation with clang Clang toolchain does not defines the __builtin_mul_overflow for 32-bit ARM. So, fallback to else implementation of checked_multiply when building Android with Clang Reviewed-on: https://gerrit.libreoffice.org/39005 Tested-by: Jenkins <[email protected]> Reviewed-by: Miklos Vajna <[email protected]> (cherry picked from commit 2149d4a88e9dc88c30e7475f8ea317e5c7b78529) add checked_add Reviewed-on: https://gerrit.libreoffice.org/43779 Tested-by: Jenkins <[email protected]> Reviewed-by: Caolán McNamara <[email protected]> Tested-by: Caolán McNamara <[email protected]> (cherry picked from commit 9cfb27ae6cb94f0a853ff70e9ad9f3109d305a94) Change-Id: I0b59f1b93d31a7cb5b8db2a21736db11aed46536 a174fd94c57cc3c899c10e1c0dc5968965a50427 0d329357ac282d4652b0f7ebc401cbd51963461b 004a6d322f60d916cc4635b362ce948e8a10d7c7 5aae26c38f3645020f0e1d6d7b6877c2727af1b4 a79be052dd3f6b6ed38fb326558924c853af5fff d75f5f4b578fd176c17e5763569f1403260c6594 c063786ba41aa9a985f505e62b43d3d543a0d48f 1a67cb2f1c686032438852fec1267a59fbd04d7f 5177d42b47a4bca614878dce4a69ab16b5cfe163 6d32a6b6f1dd91db42a3f154700ea55603f0e4dd 03fe80f9568759b829fac4e9bcfd496efebe6a26 6120606f521ce121541a5b7f1150229258012d55 10cba898bba528f5f1bfbd583e27a6821c789ab9 Reviewed-on: https://gerrit.libreoffice.org/49485 Reviewed-by: Michael Stahl <[email protected]> Tested-by: Jenkins <[email protected]> diff --git a/include/o3tl/safeint.hxx b/include/o3tl/safeint.hxx new file mode 100644 index 000000000000..5ebf353b6bd6 --- /dev/null +++ b/include/o3tl/safeint.hxx @@ -0,0 +1,124 @@ +/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file is part of the LibreOffice project. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + */ + +#ifndef INCLUDED_O3TL_SAFEINT_HXX +#define INCLUDED_O3TL_SAFEINT_HXX + +#include <limits> +#if defined(_MSC_VER) +#include <safeint.h> +#else +#ifndef __has_builtin +# define __has_builtin(x) 0 +#endif +#endif + +namespace o3tl +{ + +#if defined(_MSC_VER) + +template<typename T> inline bool checked_multiply(T a, T b, T& result) +{ + return !msl::utilities::SafeMultiply(a, b, result); +} + +template<typename T> inline bool checked_add(T a, T b, T& result) +{ + return !msl::utilities::SafeAdd(a, b, result); +} + +#elif (defined __GNUC__ && __GNUC__ >= 5) || (__has_builtin(__builtin_mul_overflow) && !(defined ANDROID && defined __clang__)) + +template<typename T> inline bool checked_multiply(T a, T b, T& result) +{ + return __builtin_mul_overflow(a, b, &result); +} + +template<typename T> inline bool checked_add(T a, T b, T& result) +{ + return __builtin_add_overflow(a, b, &result); +} + +#else + +//https://www.securecoding.cert.org/confluence/display/c/INT32-C.+Ensure+that+operations+on+signed+integers+do+not+result+in+overflow +template<typename T> inline typename std::enable_if<std::is_signed<T>::value, bool>::type checked_multiply(T a, T b, T& result) +{ + if (a > 0) { /* a is positive */ + if (b > 0) { /* a and b are positive */ + if (a > (std::numeric_limits<T>::max() / b)) { + return true; /* Handle error */ + } + } else { /* a positive, b nonpositive */ + if (b < (std::numeric_limits<T>::min() / a)) { + return true; /* Handle error */ + } + } /* a positive, b nonpositive */ + } else { /* a is nonpositive */ + if (b > 0) { /* a is nonpositive, b is positive */ + if (a < (std::numeric_limits<T>::min() / b)) { + return true; /* Handle error */ + } + } else { /* a and b are nonpositive */ + if ( (a != 0) && (b < (std::numeric_limits<T>::max() / a))) { + return true; /* Handle error */ + } + } /* End if a and b are nonpositive */ + } /* End if a is nonpositive */ + + result = a * b; + + return false; +} + +//https://www.securecoding.cert.org/confluence/display/c/INT30-C.+Ensure+that+unsigned+integer+operations+do+not+wrap +template<typename T> inline typename std::enable_if<std::is_unsigned<T>::value, bool>::type checked_multiply(T a, T b, T& result) +{ + if (b && a > std::numeric_limits<T>::max() / b) { + return true;/* Handle error */ + } + + result = a * b; + + return false; +} + +//https://www.securecoding.cert.org/confluence/display/c/INT32-C.+Ensure+that+operations+on+signed+integers+do+not+result+in+overflow +template<typename T> inline typename std::enable_if<std::is_signed<T>::value, bool>::type checked_add(T a, T b, T& result) +{ + if (((b > 0) && (a > (std::numeric_limits<T>::max() - b))) || + ((b < 0) && (a < (std::numeric_limits<T>::min() - b)))) { + return true; + } + + result = a + b; + + return false; +} + +//https://www.securecoding.cert.org/confluence/display/c/INT30-C.+Ensure+that+unsigned+integer+operations+do+not+wrap +template<typename T> inline typename std::enable_if<std::is_unsigned<T>::value, bool>::type checked_add(T a, T b, T& result) +{ + if (std::numeric_limits<T>::max() - a < b) { + return true;/* Handle error */ + } + + result = a + b; + + return false; +} + +#endif + +} + +#endif + +/* vim:set shiftwidth=4 softtabstop=4 expandtab: */ diff --git a/vcl/inc/sft.hxx b/vcl/inc/sft.hxx index 80c62c11b878..0b3c3afcfbef 100644 --- a/vcl/inc/sft.hxx +++ b/vcl/inc/sft.hxx @@ -189,21 +189,15 @@ namespace vcl int descender; /**< typographic descent. */ int linegap; /**< typographic line gap.\ Negative values are treated as zero in Win 3.1, System 6 and System 7. */ - int vascent; /**< typographic ascent for vertical writing mode */ - int vdescent; /**< typographic descent for vertical writing mode */ int typoAscender; /**< OS/2 portable typographic ascender */ int typoDescender; /**< OS/2 portable typographic descender */ int typoLineGap; /**< OS/2 portable typographic line gap */ int winAscent; /**< ascender metric for Windows */ int winDescent; /**< descender metric for Windows */ bool symbolEncoded; /**< true: MS symbol encoded */ - int rangeFlag; /**< if set to 1 Unicode Range flags are applicable */ - sal_uInt32 ur1; /**< bits 0 - 31 of Unicode Range flags */ - sal_uInt32 ur2; /**< bits 32 - 63 of Unicode Range flags */ - sal_uInt32 ur3; /**< bits 64 - 95 of Unicode Range flags */ - sal_uInt32 ur4; /**< bits 96 - 127 of Unicode Range flags */ - sal_uInt8 panose[10]; /**< PANOSE classification number */ - sal_uInt32 typeFlags; /**< type flags (copyright bits + PS-OpenType flag) */ + sal_uInt8 panose[10]; /**< PANOSE classification number */ + sal_uInt32 typeFlags; /**< type flags (copyright bits + PS-OpenType flag) */ + sal_uInt16 fsSelection; /**< OS/2 fsSelection */ } TTGlobalFontInfo; #define TYPEFLAG_INVALID 0x8000000 @@ -521,8 +515,6 @@ namespace vcl /*- private definitions */ struct TrueTypeFont { - sal_uInt32 tag; - char *fname; sal_Int32 fsize; sal_uInt8 *ptr; diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 150b21ec676a..e6bfd7509da3 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -39,7 +39,7 @@ #include "xlat.hxx" #include <rtl/crc.h> #include <rtl/ustring.hxx> - +#include <o3tl/safeint.hxx> #include <osl/endian.h> #include <algorithm> @@ -104,9 +104,6 @@ typedef struct { sal_uInt32 *offs; /* array of nGlyphs offsets */ } GlyphOffsets; -/* private tags */ -static const sal_uInt32 TTFontClassTag = 0x74746663; /* 'ttfc' */ - static const sal_uInt32 T_true = 0x74727565; /* 'true' */ static const sal_uInt32 T_ttcf = 0x74746366; /* 'ttcf' */ static const sal_uInt32 T_otto = 0x4f54544f; /* 'OTTO' */ @@ -1341,6 +1338,13 @@ static void FindCmap(TrueTypeFont *ttf) } if (ttf->cmapType != CMAP_NOT_USABLE) { + if( (ttf->cmap - ttf->ptr + 2U) > static_cast<sal_uInt32>(ttf->fsize) ) { + ttf->cmapType = CMAP_NOT_USABLE; + ttf->cmap = nullptr; + } + } + + if (ttf->cmapType != CMAP_NOT_USABLE) { switch (GetUInt16(ttf->cmap, 0, 1)) { case 0: ttf->mapper = getGlyph0; break; case 2: ttf->mapper = getGlyph2; break; @@ -1461,7 +1465,6 @@ static void allocTrueTypeFont( TrueTypeFont** ttf ) *ttf = static_cast<TrueTypeFont*>(calloc(1,sizeof(TrueTypeFont))); if( *ttf != nullptr ) { - (*ttf)->tag = 0; (*ttf)->fname = nullptr; (*ttf)->fsize = -1; (*ttf)->ptr = nullptr; @@ -1546,10 +1549,41 @@ int OpenTTFontBuffer(const void* pBuffer, sal_uInt32 nLen, sal_uInt32 facenum, T return doOpenTTFont( facenum, *ttf ); } +namespace { + +bool withinBounds(sal_uInt32 tdoffset, sal_uInt32 moreoffset, sal_uInt32 len, sal_uInt32 available) +{ + sal_uInt32 result; + if (o3tl::checked_add(tdoffset, moreoffset, result)) + return false; + if (o3tl::checked_add(result, len, result)) + return false; + return result <= available; +} + +class TTFontCloser +{ + TrueTypeFont* m_font; +public: + TTFontCloser(TrueTypeFont* t) + : m_font(t) + { + } + void clear() { m_font = nullptr; } + ~TTFontCloser() + { + if (m_font) + CloseTTFont(m_font); + } +}; + +} + static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) { + TTFontCloser aCloseGuard(t); + if (t->fsize < 4) { - CloseTTFont(t); return SF_TTFORMAT; } int i; @@ -1563,27 +1597,28 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) } else if (TTCTag == T_otto) { /* PS-OpenType font */ tdoffset = 0; } else if (TTCTag == T_ttcf) { /* TrueType collection */ + if (!withinBounds(12, 4 * facenum, sizeof(sal_uInt32), t->fsize)) { + return SF_FONTNO; + } sal_uInt32 Version = GetUInt32(t->ptr, 4, 1); if (Version != 0x00010000 && Version != 0x00020000) { - CloseTTFont(t); return SF_TTFORMAT; } if (facenum >= GetUInt32(t->ptr, 8, 1)) { - CloseTTFont(t); return SF_FONTNO; } tdoffset = GetUInt32(t->ptr, 12 + 4 * facenum, 1); } else { - CloseTTFont(t); return SF_TTFORMAT; } - /* magic number */ - t->tag = TTFontClassTag; + if (withinBounds(tdoffset, 0, 4 + sizeof(sal_uInt16), t->fsize)) { + t->ntables = GetUInt16(t->ptr + tdoffset, 4, 1); + } - t->ntables = GetUInt16(t->ptr + tdoffset, 4, 1); - if( t->ntables >= 128 ) + if (t->ntables >= 128 || t->ntables == 0) { return SF_TTFORMAT; + } t->tables = static_cast<const sal_uInt8**>(calloc(NUM_TAGS, sizeof(sal_uInt8 *))); assert(t->tables != nullptr); @@ -1595,7 +1630,7 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) int nIndex; const sal_uInt32 nStart = tdoffset + 12; const sal_uInt32 nOffset = 16 * i; - if (nStart + nOffset + sizeof(sal_uInt32) <= static_cast<sal_uInt32>(t->fsize)) + if (withinBounds(nStart, nOffset, sizeof(sal_uInt32), t->fsize)) tag = GetUInt32(t->ptr + nStart, nOffset, 1); else tag = static_cast<sal_uInt32>(-1); @@ -1620,9 +1655,10 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) case T_CFF: nIndex = O_CFF; break; default: nIndex = -1; break; } - if( nIndex >= 0 ) { - sal_uInt32 nTableOffset = GetUInt32(t->ptr + tdoffset + 12, 16 * i + 8, 1); - length = GetUInt32(t->ptr + tdoffset + 12, 16 * i + 12, 1); + + if ((nIndex >= 0) && withinBounds(nStart, nOffset, 12 + sizeof(sal_uInt32), t->fsize)) { + sal_uInt32 nTableOffset = GetUInt32(t->ptr + nStart, nOffset + 8, 1); + length = GetUInt32(t->ptr + nStart, nOffset + 12, 1); t->tables[nIndex] = t->ptr + nTableOffset; t->tlens[nIndex] = length; } @@ -1631,8 +1667,9 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) /* Fixup offsets when only a TTC extract was provided */ if( facenum == (sal_uInt32)~0 ) { sal_uInt8* pHead = const_cast<sal_uInt8*>(t->tables[O_head]); - if( !pHead ) + if (!pHead) { return SF_TTFORMAT; + } /* limit Head candidate to TTC extract's limits */ if( pHead > t->ptr + (t->fsize - 54) ) pHead = t->ptr + (t->fsize - 54); @@ -1648,8 +1685,9 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) break; } } - if( p <= t->ptr ) + if (p <= t->ptr) { return SF_TTFORMAT; + } } /* Check the table offsets after TTC correction */ @@ -1671,7 +1709,7 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) } else if( const_cast<sal_uInt8*>(t->tables[i]) + t->tlens[i] > t->ptr + t->fsize ) { - int nMaxLen = (t->ptr + t->fsize) - t->tables[i]; + sal_PtrDiff nMaxLen = (t->ptr + t->fsize) - t->tables[i]; if( nMaxLen < 0 ) nMaxLen = 0; t->tlens[i] = nMaxLen; @@ -1689,7 +1727,6 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) */ if( !(getTable(t, O_maxp) && getTable(t, O_head) && getTable(t, O_name) && getTable(t, O_cmap)) ) { - CloseTTFont(t); return SF_TTFORMAT; } @@ -1700,14 +1737,12 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) table = getTable(t, O_head); table_size = getTableSize(t, O_head); if (table_size < 52) { - CloseTTFont(t); return SF_TTFORMAT; } t->unitsPerEm = GetUInt16(table, 18, 1); int indexfmt = GetInt16(table, 50, 1); if( ((indexfmt != 0) && (indexfmt != 1)) || (t->unitsPerEm <= 0) ) { - CloseTTFont(t); return SF_TTFORMAT; } @@ -1731,7 +1766,6 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) /* TODO: implement to get subsetting */ assert(t->goffsets != nullptr); } else { - CloseTTFont(t); return SF_TTFORMAT; } @@ -1748,6 +1782,8 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) GetKern(t); ReadGSUB( t, 0, 0 ); + aCloseGuard.clear(); + return SF_OK; } @@ -2590,13 +2626,6 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, TTGlobalFontInfo *info) if( info->winDescent > 5*UPEm ) info->winDescent = XUnits(UPEm, GetInt16(table, 76,1)); } - if (ttf->cmapType == CMAP_MS_Unicode) { - info->rangeFlag = 1; - info->ur1 = GetUInt32(table, 42, 1); - info->ur2 = GetUInt32(table, 46, 1); - info->ur3 = GetUInt32(table, 50, 1); - info->ur4 = GetUInt32(table, 54, 1); - } memcpy(info->panose, table + 32, 10); info->typeFlags = GetUInt16( table, 8, 1 ); if( getTable(ttf, O_CFF) ) @@ -2610,24 +2639,24 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, TTGlobalFontInfo *info) } table = getTable(ttf, O_head); /* 'head' tables is always there */ - info->xMin = XUnits(UPEm, GetInt16(table, 36, 1)); - info->yMin = XUnits(UPEm, GetInt16(table, 38, 1)); - info->xMax = XUnits(UPEm, GetInt16(table, 40, 1)); - info->yMax = XUnits(UPEm, GetInt16(table, 42, 1)); - info->macStyle = GetInt16(table, 44, 1); + table_size = getTableSize(ttf, O_head); + if (table_size >= 46) { + info->xMin = XUnits(UPEm, GetInt16(table, 36, 1)); + info->yMin = XUnits(UPEm, GetInt16(table, 38, 1)); + info->xMax = XUnits(UPEm, GetInt16(table, 40, 1)); + info->yMax = XUnits(UPEm, GetInt16(table, 42, 1)); + info->macStyle = GetInt16(table, 44, 1); + } table = getTable(ttf, O_hhea); - if (table) { + table_size = getTableSize(ttf, O_hhea); + if (table && table_size >= 10) { info->ascender = XUnits(UPEm, GetInt16(table, 4, 1)); info->descender = XUnits(UPEm, GetInt16(table, 6, 1)); info->linegap = XUnits(UPEm, GetInt16(table, 8, 1)); } table = getTable(ttf, O_vhea); - if (table) { - info->vascent = XUnits(UPEm, GetInt16(table, 4, 1)); - info->vdescent = XUnits(UPEm, GetInt16(table, 6, 1)); - } } GlyphData *GetTTRawGlyphData(TrueTypeFont *ttf, sal_uInt32 glyphID) commit 14487b93b115634cb53ac48ddb52bbabddbbf83a Author: Caolán McNamara <[email protected]> Date: Wed Feb 7 15:50:35 2018 +0000 check O_head size Change-Id: Idf5d30eaed0196cfa9266e35131c538c606a0960 Reviewed-on: https://gerrit.libreoffice.org/49365 Tested-by: Jenkins <[email protected]> Reviewed-by: Caolán McNamara <[email protected]> Tested-by: Caolán McNamara <[email protected]> (cherry picked from commit b10ae2faae6f3c448bbab71585550387e18cc248) Reviewed-on: https://gerrit.libreoffice.org/49367 Reviewed-by: Michael Stahl <[email protected]> diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index b34037ebdba1..150b21ec676a 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1555,7 +1555,6 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) int i; sal_uInt32 length, tag; sal_uInt32 tdoffset = 0; /* offset to TableDirectory in a TTC file. For TTF files is 0 */ - int indexfmt; sal_uInt32 TTCTag = GetInt32(t->ptr, 0, 1); @@ -1699,8 +1698,13 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) t->nglyphs = table_size >= 6 ? GetUInt16(table, 4, 1) : 0; table = getTable(t, O_head); + table_size = getTableSize(t, O_head); + if (table_size < 52) { + CloseTTFont(t); + return SF_TTFORMAT; + } t->unitsPerEm = GetUInt16(table, 18, 1); - indexfmt = GetInt16(table, 50, 1); + int indexfmt = GetInt16(table, 50, 1); if( ((indexfmt != 0) && (indexfmt != 1)) || (t->unitsPerEm <= 0) ) { CloseTTFont(t); commit 45deaff92ab812f944637ab2f442b27e7b182492 Author: Caolán McNamara <[email protected]> Date: Wed Feb 7 16:44:43 2018 +0000 check O_hhea and O_vhea sizes Change-Id: I82e47732815f0112801c8c3a3e5b0b09ac25610a Reviewed-on: https://gerrit.libreoffice.org/49439 Reviewed-by: Michael Stahl <[email protected]> Tested-by: Jenkins <[email protected]> diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index d97be8071272..b34037ebdba1 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1548,8 +1548,10 @@ int OpenTTFontBuffer(const void* pBuffer, sal_uInt32 nLen, sal_uInt32 facenum, T static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) { - if (t->fsize < 4) + if (t->fsize < 4) { + CloseTTFont(t); return SF_TTFORMAT; + } int i; sal_uInt32 length, tag; sal_uInt32 tdoffset = 0; /* offset to TableDirectory in a TTC file. For TTF files is 0 */ @@ -1730,10 +1732,12 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) } table = getTable(t, O_hhea); - t->numberOfHMetrics = (table != nullptr) ? GetUInt16(table, 34, 1) : 0; + table_size = getTableSize(t, O_hhea); + t->numberOfHMetrics = (table && table_size >= 36) ? GetUInt16(table, 34, 1) : 0; table = getTable(t, O_vhea); - t->numOfLongVerMetrics = (table != nullptr) ? GetUInt16(table, 34, 1) : 0; + table_size = getTableSize(t, O_vhea); + t->numOfLongVerMetrics = (table && table_size >= 36) ? GetUInt16(table, 34, 1) : 0; GetNames(t); FindCmap(t); commit 7c764ca83bfcc0f46048f45de2d47bfea0bb46e5 Author: Caolán McNamara <[email protected]> Date: Wed Feb 7 15:33:36 2018 +0000 check table size before reading nglyphs Change-Id: Ib511fdf16006877ca76085137eb9200601b2f8f7 Reviewed-on: https://gerrit.libreoffice.org/49363 Tested-by: Jenkins <[email protected]> Reviewed-by: Caolán McNamara <[email protected]> Tested-by: Caolán McNamara <[email protected]> (cherry picked from commit 08dd51bfcaa6b493e134bcc7787cc18c36ad5db1) Reviewed-on: https://gerrit.libreoffice.org/49436 Reviewed-by: Michael Stahl <[email protected]> diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 0e0978b779c0..d97be8071272 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1693,7 +1693,8 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) } const sal_uInt8* table = getTable(t, O_maxp); - t->nglyphs = GetUInt16(table, 4, 1); + sal_uInt32 table_size = getTableSize(t, O_maxp); + t->nglyphs = table_size >= 6 ? GetUInt16(table, 4, 1) : 0; table = getTable(t, O_head); t->unitsPerEm = GetUInt16(table, 18, 1); commit 61a36e172e0ebdfdc6efae4c5be49b7e2a3f3886 Author: Caolán McNamara <[email protected]> Date: Wed Feb 7 16:20:54 2018 +0000 return early on short stream Change-Id: Ia9cb4dec5358281322a2428c5f2153836a1ee1af Reviewed-on: https://gerrit.libreoffice.org/49375 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index cc4893216d3d..0e0978b779c0 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1548,6 +1548,8 @@ int OpenTTFontBuffer(const void* pBuffer, sal_uInt32 nLen, sal_uInt32 facenum, T static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) { + if (t->fsize < 4) + return SF_TTFORMAT; int i; sal_uInt32 length, tag; sal_uInt32 tdoffset = 0; /* offset to TableDirectory in a TTC file. For TTF files is 0 */ commit 777927c46b2d0d16e554cbeadbae8223ba27e6c3 Author: Caolán McNamara <[email protected]> Date: Wed Feb 7 16:05:08 2018 +0000 stay within font bounds Change-Id: Ie8ed610b71cb1b20963827c2be97155d2d8aa22c Reviewed-on: https://gerrit.libreoffice.org/49371 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index dfe66eb5d58c..cc4893216d3d 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1590,7 +1590,12 @@ static int doOpenTTFont( sal_uInt32 facenum, TrueTypeFont* t ) /* parse the tables */ for (i=0; i<(int)t->ntables; i++) { int nIndex; - tag = GetUInt32(t->ptr + tdoffset + 12, 16 * i, 1); + const sal_uInt32 nStart = tdoffset + 12; + const sal_uInt32 nOffset = 16 * i; + if (nStart + nOffset + sizeof(sal_uInt32) <= static_cast<sal_uInt32>(t->fsize)) + tag = GetUInt32(t->ptr + nStart, nOffset, 1); + else + tag = static_cast<sal_uInt32>(-1); switch( tag ) { case T_maxp: nIndex = O_maxp; break; case T_glyf: nIndex = O_glyf; break; commit d50431b28e5bd5cda4d4a410eb80f9d9becb278e Author: Caolán McNamara <[email protected]> Date: Wed Feb 7 16:51:32 2018 +0000 what matters is the availability of the last element, not the first Change-Id: I23d3abdbe62b735d66261fb337613da88cc4206b Reviewed-on: https://gerrit.libreoffice.org/49380 Reviewed-by: Michael Stahl <[email protected]> Tested-by: Michael Stahl <[email protected]> diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 3378b35344e8..dfe66eb5d58c 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -2553,7 +2553,8 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, TTGlobalFontInfo *info) info->symbolEncoded = (ttf->cmapType == CMAP_MS_Symbol); const sal_uInt8* table = getTable(ttf, O_OS2); - if (table) { + sal_uInt32 table_size = getTableSize(ttf, O_OS2); + if (table && table_size >= 42) { info->weight = GetUInt16(table, 4, 1); info->width = GetUInt16(table, 6, 1); @@ -2561,12 +2562,13 @@ void GetTTGlobalFontInfo(TrueTypeFont *ttf, TTGlobalFontInfo *info) * Microsoft old (78 bytes long) and Microsoft new (86 bytes long,) * Apple's documentation recommends looking at the table length. */ - if (getTableSize(ttf, O_OS2) > 68) { + if (table_size >= 78) { info->typoAscender = XUnits(UPEm,GetInt16(table, 68, 1)); info->typoDescender = XUnits(UPEm, GetInt16(table, 70, 1)); info->typoLineGap = XUnits(UPEm, GetInt16(table, 72, 1)); info->winAscent = XUnits(UPEm, GetUInt16(table, 74, 1)); info->winDescent = XUnits(UPEm, GetUInt16(table, 76, 1)); + /* sanity check; some fonts treat winDescent as signed * violating the standard */ if( info->winDescent > 5*UPEm ) commit 54e8adbaaaaca4a34ed2bf42895d2f2491e699f8 Author: Caolán McNamara <[email protected]> Date: Wed Feb 7 16:57:27 2018 +0000 check kern table size Change-Id: I65b5f0a8950d54c00d6fd7c385ca1c5dca2ef2c8 Reviewed-on: https://gerrit.libreoffice.org/49384 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 0d24beaf4428..3378b35344e8 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1368,7 +1368,7 @@ static void GetKern(TrueTypeFont *ttf) if( !table ) goto badtable; - if (GetUInt16(table, 0, 1) == 0) { /* Traditional Microsoft style table with sal_uInt16 version and nTables fields */ + if (nTableSize >= 4 && GetUInt16(table, 0, 1) == 0) { /* Traditional Microsoft style table with sal_uInt16 version and nTables fields */ ttf->nkern = GetUInt16(table, 2, 1); ttf->kerntype = KT_MICROSOFT; ptr = table + 4; @@ -1400,7 +1400,7 @@ static void GetKern(TrueTypeFont *ttf) return; } - if (GetUInt32(table, 0, 1) == 0x00010000) { /* MacOS style kern tables: fixed32 version and sal_uInt32 nTables fields */ + if (nTableSize >= 8 && GetUInt32(table, 0, 1) == 0x00010000) { /* MacOS style kern tables: fixed32 version and sal_uInt32 nTables fields */ ttf->nkern = GetUInt32(table, 4, 1); ttf->kerntype = KT_APPLE_NEW; ptr = table + 8; commit 6115d5ae1e58471e8925565b99d1c00971098103 Author: Caolán McNamara <[email protected]> Date: Wed Feb 7 12:29:32 2018 +0000 sanity check cmap table size Change-Id: I010c2fd221bcd86a62efd9996a0c34930828cb6d Reviewed-on: https://gerrit.libreoffice.org/49350 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx index 2385d2676033..0d24beaf4428 100644 --- a/vcl/source/fontsubset/sft.cxx +++ b/vcl/source/fontsubset/sft.cxx @@ -1245,6 +1245,12 @@ static void FindCmap(TrueTypeFont *ttf) { const sal_uInt8* table = getTable(ttf, O_cmap); sal_uInt32 table_size = getTableSize(ttf, O_cmap); + if (table_size < 4) + { + SAL_WARN("vcl.fonts", "Parsing error in " << OUString::createFromAscii(ttf->fname) << + "cmap table size too short"); + return; + } sal_uInt16 ncmaps = GetUInt16(table, 2, 1); sal_uInt32 AppleUni = 0; // Apple Unicode sal_uInt32 ThreeZero = 0; /* MS Symbol */ commit d7e4f63c0d030f5fbdbbbe569c7e396985fce609 Author: Caolán McNamara <[email protected]> Date: Tue May 1 12:57:02 2018 +0100 set Referer on link mediadescriptor to allow determining if the source document is from a trusted/untrusted location Reviewed-on: https://gerrit.libreoffice.org/53693 Tested-by: Jenkins <[email protected]> Reviewed-by: Stephan Bergmann <[email protected]> (cherry picked from commit cd25a97bbadc0a5c1fd6b0e8603c8b6ebd051926) Reviewed-on: https://gerrit.libreoffice.org/53803 Reviewed-by: Miklos Vajna <[email protected]> Reviewed-by: Mike Kaganski <[email protected]> Tested-by: Mike Kaganski <[email protected]> (cherry picked from commit 2d87c267267530077a94c894bc619831b01d1c04) Conflicts: sw/source/filter/xml/xmltexti.cxx Change-Id: I780568652d2ef0cc8543c27ba26289277b5d9d0c diff --git a/sw/source/filter/xml/xmltexti.cxx b/sw/source/filter/xml/xmltexti.cxx index 710f010b1cdc..943db05c75bf 100644 --- a/sw/source/filter/xml/xmltexti.cxx +++ b/sw/source/filter/xml/xmltexti.cxx @@ -577,16 +577,21 @@ uno::Reference< XPropertySet > SwXMLTextImportHelper::createAndInsertOOoLink( uno::Sequence< beans::PropertyValue > aMediaDescriptor( 1 ); aMediaDescriptor[0].Name = "URL"; aMediaDescriptor[0].Value <<= OUString( aURLObj.GetMainURL( INetURLObject::NO_DECODE ) ); - if ( pDoc->GetDocShell() && pDoc->GetDocShell()->GetMedium() ) + + if (SfxMedium* pMedium = pDoc->GetDocShell() ? pDoc->GetDocShell()->GetMedium() : nullptr) { - uno::Reference< task::XInteractionHandler > xInteraction = - pDoc->GetDocShell()->GetMedium()->GetInteractionHandler(); + uno::Reference< task::XInteractionHandler > xInteraction = pMedium->GetInteractionHandler(); if ( xInteraction.is() ) { aMediaDescriptor.realloc( 2 ); aMediaDescriptor[1].Name = "InteractionHandler"; aMediaDescriptor[1].Value <<= xInteraction; } + + const auto nLen = aMediaDescriptor.getLength() + 1; + aMediaDescriptor.realloc(nLen); + aMediaDescriptor[nLen - 1].Name = "Referer"; + aMediaDescriptor[nLen - 1].Value <<= pMedium->GetName(); } uno::Reference < embed::XEmbeddedObject > xObj( commit 97e72057157da0afd579730c45cc64cf0f8b660a Author: Caolán McNamara <[email protected]> Date: Mon Nov 27 16:29:37 2017 +0000 keep track of available data Change-Id: Idc54cdef0f3a4355a7e26f25cdc5b50d65d9d583 Reviewed-on: https://gerrit.libreoffice.org/45354 Reviewed-by: Michael Stahl <[email protected]> Tested-by: Jenkins <[email protected]> (cherry picked from commit 35376a21e6bd3d7eede07b1e8f359f728b5c54c9) diff --git a/package/source/zipapi/MemoryByteGrabber.hxx b/package/source/zipapi/MemoryByteGrabber.hxx index 2beb8f5eccb7..e3326e2b9d33 100644 --- a/package/source/zipapi/MemoryByteGrabber.hxx +++ b/package/source/zipapi/MemoryByteGrabber.hxx @@ -39,6 +39,8 @@ public: } const sal_Int8 * getCurrentPos () { return mpBuffer + mnCurrent; } + sal_Int32 remainingSize() const { return mnEnd - mnCurrent; } + // XInputStream chained void SAL_CALL skipBytes( sal_Int32 nBytesToSkip ) diff --git a/package/source/zipapi/ZipFile.cxx b/package/source/zipapi/ZipFile.cxx index 8153aee7e0fd..037e08e2eaad 100644 --- a/package/source/zipapi/ZipFile.cxx +++ b/package/source/zipapi/ZipFile.cxx @@ -946,6 +946,9 @@ sal_Int32 ZipFile::readCEN() if ( aEntry.nExtraLen < 0 ) throw ZipException("unexpected extra header info length" ); + if (aEntry.nPathLen > aMemGrabber.remainingSize()) + throw ZipException("name too long"); + // read always in UTF8, some tools seem not to set UTF8 bit aEntry.sPath = OUString::intern ( reinterpret_cast<char const *>(aMemGrabber.getCurrentPos()), aEntry.nPathLen, commit d58d138b03b63d34e844049cc0017f980fdc55c7 Author: Caolán McNamara <[email protected]> Date: Fri Feb 9 10:49:39 2018 +0000 ofz#6173 check index before use Change-Id: I09d15ab324af0a8b3566f11868eb3266a68c4afe Reviewed-on: https://gerrit.libreoffice.org/49500 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> (cherry picked from commit e355d7d691cfe9719b06e15129d86ec22a2bd7a4) diff --git a/sw/source/filter/ww8/ww8toolbar.cxx b/sw/source/filter/ww8/ww8toolbar.cxx index 056839aae6e9..abdc9458f212 100644 --- a/sw/source/filter/ww8/ww8toolbar.cxx +++ b/sw/source/filter/ww8/ww8toolbar.cxx @@ -166,7 +166,9 @@ bool SwCTBWrapper::Read( SvStream& rS ) std::vector< sal_Int16 >::iterator it_end = dropDownMenuIndices.end(); for ( std::vector< sal_Int16 >::iterator it = dropDownMenuIndices.begin(); it != it_end; ++it ) { - rCustomizations[ *it ].bIsDroppedMenuTB = true; + if (*it < 0 || static_cast<size_t>(*it) >= rCustomizations.size()) + continue; + rCustomizations[*it].bIsDroppedMenuTB = true; } return rS.good(); } commit ff24333bf964d37e025410a240826c33ff41c38c Author: Caolán McNamara <[email protected]> Date: Sat Jan 27 19:38:12 2018 +0000 ofz#5747 short->sal_Int32 like in StgDataStrm Change-Id: I254c00b1142d7187beabe5d18532efec036de494 Reviewed-on: https://gerrit.libreoffice.org/48757 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> (cherry picked from commit 59cf6c6128f67d807de58fae2d7fae2b4909ad68) diff --git a/sot/source/sdstor/stgstrms.cxx b/sot/source/sdstor/stgstrms.cxx index 4f749486c1cc..212949d546d2 100644 --- a/sot/source/sdstor/stgstrms.cxx +++ b/sot/source/sdstor/stgstrms.cxx @@ -1047,7 +1047,7 @@ sal_Int32 StgSmallStrm::Read( void* pBuf, sal_Int32 n ) // small stream is likely to be < 64 KBytes. if( ( m_nPos + n ) > m_nSize ) n = m_nSize - m_nPos; - short nDone = 0; + sal_Int32 nDone = 0; while( n ) { short nBytes = m_nPageSize - m_nOffset; @@ -1078,7 +1078,7 @@ sal_Int32 StgSmallStrm::Write( const void* pBuf, sal_Int32 n ) { // you can safely assume that reads are not huge, since the // small stream is likely to be < 64 KBytes. - short nDone = 0; + sal_Int32 nDone = 0; if( ( m_nPos + n ) > m_nSize ) { sal_Int32 nOld = m_nPos; commit 8e60f4d5635460a520559824ea34e1ae4e496abb Author: Caolán McNamara <[email protected]> Date: Mon Mar 26 12:49:54 2018 +0100 forcepoint #33 ensure payload is a EMFPPath Change-Id: I0a9f332cc66e43caa4e1611006fa765cad063539 Reviewed-on: https://gerrit.libreoffice.org/51916 Tested-by: Jenkins <[email protected]> Reviewed-by: Markus Mohrhard <[email protected]> diff --git a/cppcanvas/source/mtfrenderer/emfplus.cxx b/cppcanvas/source/mtfrenderer/emfplus.cxx index 4a7bf06e631a..3e041557ee96 100644 --- a/cppcanvas/source/mtfrenderer/emfplus.cxx +++ b/cppcanvas/source/mtfrenderer/emfplus.cxx @@ -1986,7 +1986,7 @@ namespace cppcanvas SAL_INFO("cppcanvas.emf", "EMF+ FillPath slot: " << index); - EMFPPath* path = static_cast<EMFPPath*>(aObjects[index]); + EMFPPath* path = dynamic_cast<EMFPPath*>(aObjects[index]); if (path) EMFPPlusFillPolygon(path->GetPolygon (*this), rFactoryParms, rState, rCanvas, flags & 0x8000, brushIndexOrColor); else @@ -2113,7 +2113,7 @@ namespace cppcanvas SAL_INFO("cppcanvas.emf", "EMF+ DrawPath"); SAL_INFO("cppcanvas.emf", "EMF+\tpen: " << penIndex); - EMFPPath* path = static_cast<EMFPPath*>( aObjects [flags & 0xff] ); + EMFPPath* path = dynamic_cast<EMFPPath*>( aObjects [flags & 0xff] ); if (path) EMFPPlusDrawPolygon(path->GetPolygon (*this), rFactoryParms, rState, rCanvas, penIndex); else commit 7d612363a3f7f89067c9c34d676a1716d393d42f Author: Caolán McNamara <[email protected]> Date: Mon Mar 26 13:44:31 2018 +0100 forcepoint #34 survive missing autostyles Change-Id: I742816297659d614e836a8d5e8965b1c55154719 Reviewed-on: https://gerrit.libreoffice.org/51892 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/sc/source/filter/xml/xmlcelli.cxx b/sc/source/filter/xml/xmlcelli.cxx index 4670aed7b050..3d7c2eb15a87 100644 --- a/sc/source/filter/xml/xmlcelli.cxx +++ b/sc/source/filter/xml/xmlcelli.cxx @@ -389,6 +389,8 @@ void ScXMLTableRowCellContext::PushFormat(sal_Int32 nBegin, sal_Int32 nEnd, cons sal_Int32 nEntryCount = xMapper->GetEntryCount(); SvXMLStylesContext* pAutoStyles = GetImport().GetAutoStyles(); + if (!pAutoStyles) + return; // Style name for text span corresponds with the name of an automatic style. const XMLPropStyleContext* pStyle = dynamic_cast<const XMLPropStyleContext*>( commit 8e3ed2aa430b563f67dac91057aae111f79200f6 Author: Caolán McNamara <[email protected]> Date: Mon Mar 26 12:59:14 2018 +0100 forcepoint #32 survive missing value range Change-Id: I90315f0481bf73c4d9071959bf5408f4a2690257 Reviewed-on: https://gerrit.libreoffice.org/51886 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/sc/source/filter/excel/xichart.cxx b/sc/source/filter/excel/xichart.cxx index adff4074cf62..1ab405d0524a 100644 --- a/sc/source/filter/excel/xichart.cxx +++ b/sc/source/filter/excel/xichart.cxx @@ -3363,15 +3363,19 @@ Reference< XAxis > XclImpChAxis::CreateAxis( const XclImpChTypeGroup& rTypeGroup { case cssc2::AxisType::CATEGORY: case cssc2::AxisType::SERIES: - OSL_ENSURE( mxLabelRange, "Missing Label Range" ); // #i71684# radar charts have reversed rotation direction if (mxLabelRange) mxLabelRange->Convert( aAxisProp, aScaleData, rTypeInfo.meTypeCateg == EXC_CHTYPECATEG_RADAR ); + else + SAL_WARN("sc.filter", "missing LabelRange"); break; case cssc2::AxisType::REALNUMBER: case cssc2::AxisType::PERCENT: // #i85167# pie/donut charts have reversed rotation direction (at Y axis!) - mxValueRange->Convert( aScaleData, rTypeInfo.meTypeCateg == EXC_CHTYPECATEG_PIE ); + if (mxValueRange) + mxValueRange->Convert( aScaleData, rTypeInfo.meTypeCateg == EXC_CHTYPECATEG_PIE ); + else + SAL_WARN("sc.filter", "missing ValueRange"); break; default: OSL_FAIL( "XclImpChAxis::CreateAxis - unknown axis type" ); @@ -3420,12 +3424,18 @@ void XclImpChAxis::ConvertAxisPosition( ScfPropertySet& rPropSet, const XclImpCh { if( ((GetAxisType() == EXC_CHAXIS_X) && rTypeGroup.GetTypeInfo().mbCategoryAxis) || (GetAxisType() == EXC_CHAXIS_Z) ) { - OSL_ENSURE( mxLabelRange, "Missing Label Range" ); if (mxLabelRange) mxLabelRange->ConvertAxisPosition( rPropSet, rTypeGroup.Is3dChart() ); + else + SAL_WARN("sc.filter", "missing LabelRange"); } else - mxValueRange->ConvertAxisPosition( rPropSet ); + { + if (mxValueRange) + mxValueRange->ConvertAxisPosition( rPropSet ); + else + SAL_WARN("sc.filter", "missing ValueRange"); + } } void XclImpChAxis::ReadChAxisLine( XclImpStream& rStrm ) commit f74490d0f004668cba9b72c8444ef3a8d5183165 Author: Caolán McNamara <[email protected]> Date: Mon Mar 26 12:50:20 2018 +0100 forcepoint #31 check validity of another group range Change-Id: I82ff3e47a033c91581b108e1685b1ff4d5865895 Reviewed-on: https://gerrit.libreoffice.org/51883 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx index 47a69052d660..712ca69fbe10 100644 --- a/sc/source/core/data/column3.cxx +++ b/sc/source/core/data/column3.cxx @@ -3024,6 +3024,8 @@ public: { // Previous cell is a regular cell and current cell is a group. nRow += xCurGrp->mnLength; + if (xCurGrp->mnLength > std::distance(it, itEnd)) + throw css::lang::IllegalArgumentException(); std::advance(it, xCurGrp->mnLength); pPrev->SetCellGroup(xCurGrp); xCurGrp->mpTopCell = pPrev; commit 6e003a905bd69fd5955472490791cb8f17208255 Author: Caolán McNamara <[email protected]> Date: Mon Mar 26 09:32:14 2018 +0100 forcepoint #31 survive missing control model Change-Id: I37e4af560b46b4f6d9e0b87fe58493818f366d3c Reviewed-on: https://gerrit.libreoffice.org/51878 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/oox/source/ole/vbacontrol.cxx b/oox/source/ole/vbacontrol.cxx index 805bb2d7a504..e6f0d14b99da 100644 --- a/oox/source/ole/vbacontrol.cxx +++ b/oox/source/ole/vbacontrol.cxx @@ -431,7 +431,13 @@ void VbaFormControl::importStorage( StorageBase& rStrg, const AxClassTable& rCla for ( ; it != it_end; ++it ) { - if ( (*it)->mxCtrlModel->getControlType() == API_CONTROL_PAGE ) + auto& elem = (*it)->mxCtrlModel; + if (!elem) + { + SAL_WARN("oox", "empty control model"); + continue; + } + if (elem->getControlType() == API_CONTROL_PAGE) { VbaSiteModelRef xPageSiteRef = (*it)->mxSiteModel; if ( xPageSiteRef.get() ) @@ -439,7 +445,7 @@ void VbaFormControl::importStorage( StorageBase& rStrg, const AxClassTable& rCla } else { - AxTabStripModel* pTabStrip = static_cast<AxTabStripModel*> ( (*it)->mxCtrlModel.get() ); + AxTabStripModel* pTabStrip = static_cast<AxTabStripModel*>(elem.get()); sCaptions = pTabStrip->maItems; pMultiPage->mnActiveTab = pTabStrip->mnListIndex; pMultiPage->mnTabStyle = pTabStrip->mnTabStyle; commit becf51f1c5d11cedac84670d5acf934049f2bdad Author: Caolán McNamara <[email protected]> Date: Mon Mar 26 12:14:23 2018 +0100 forcepoint #32 survive missing emf paths Change-Id: Ic27c3bbac12f66b30ff2f30f558180127cc73a51 Reviewed-on: https://gerrit.libreoffice.org/51876 Tested-by: Jenkins <[email protected]> Reviewed-by: Miklos Vajna <[email protected]> diff --git a/cppcanvas/source/mtfrenderer/emfplus.cxx b/cppcanvas/source/mtfrenderer/emfplus.cxx index 9154f92b92bf..4a7bf06e631a 100644 --- a/cppcanvas/source/mtfrenderer/emfplus.cxx +++ b/cppcanvas/source/mtfrenderer/emfplus.cxx @@ -1986,7 +1986,12 @@ namespace cppcanvas SAL_INFO("cppcanvas.emf", "EMF+ FillPath slot: " << index); - EMFPPlusFillPolygon( static_cast<EMFPPath*>( aObjects [index])->GetPolygon (*this), rFactoryParms, rState, rCanvas, flags & 0x8000, brushIndexOrColor); + EMFPPath* path = static_cast<EMFPPath*>(aObjects[index]); + if (path) + EMFPPlusFillPolygon(path->GetPolygon (*this), rFactoryParms, rState, rCanvas, flags & 0x8000, brushIndexOrColor); + else + SAL_WARN("cppcanvas.emf", "EmfPlusRecordTypeFillPath missing path"); + } break; case EmfPlusRecordTypeDrawEllipse: @@ -2109,9 +2114,10 @@ namespace cppcanvas SAL_INFO("cppcanvas.emf", "EMF+\tpen: " << penIndex); EMFPPath* path = static_cast<EMFPPath*>( aObjects [flags & 0xff] ); - SAL_WARN_IF( !path, "cppcanvas.emf", "EmfPlusRecordTypeDrawPath missing path" ); - - EMFPPlusDrawPolygon (path->GetPolygon (*this), rFactoryParms, rState, rCanvas, penIndex); + if (path) + EMFPPlusDrawPolygon(path->GetPolygon (*this), rFactoryParms, rState, rCanvas, penIndex); + else + SAL_WARN("cppcanvas.emf", "EmfPlusRecordTypeDrawPath missing path"); break; } commit eb1a13d954173da44062e18da940047fc502fe72 Author: Caolán McNamara <[email protected]> Date: Mon Mar 26 09:23:48 2018 +0100 forcepoint #30 check validity of group range Change-Id: Ie0611f36809b051ce46030e44c137b4e1f8d2fe0 Reviewed-on: https://gerrit.libreoffice.org/51865 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls b/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls new file mode 100755 index 000000000000..1aca9c7f113e Binary files /dev/null and b/sc/qa/unit/data/xls/fail/forcepoint-group-range-1.xls differ diff --git a/sc/source/core/data/column3.cxx b/sc/source/core/data/column3.cxx index 27abbbf249fe..47a69052d660 100644 --- a/sc/source/core/data/column3.cxx +++ b/sc/source/core/data/column3.cxx @@ -3000,6 +3000,8 @@ public: xPrevGrp->mnLength += xCurGrp->mnLength; pCur->SetCellGroup(xPrevGrp); sc::formula_block::iterator itGrpEnd = it; + if (xCurGrp->mnLength > std::distance(itGrpEnd, itEnd)) + throw css::lang::IllegalArgumentException(); std::advance(itGrpEnd, xCurGrp->mnLength); for (++it; it != itGrpEnd; ++it) { commit aefd8752c18c48d3a783ee9e605d776d82551b3d Author: Caolán McNamara <[email protected]> Date: Mon Mar 26 08:57:09 2018 +0100 forcepoint #29 detect illegal self series add Change-Id: I3bba0f942780c54951a3a810c05cc3b56ca18a5e Reviewed-on: https://gerrit.libreoffice.org/51862 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/sc/qa/unit/data/xls/pass/forcepoint-selfseriesadd.xls b/sc/qa/unit/data/xls/pass/forcepoint-selfseriesadd.xls new file mode 100755 index 000000000000..e5eafd262520 Binary files /dev/null and b/sc/qa/unit/data/xls/pass/forcepoint-selfseriesadd.xls differ diff --git a/sc/source/filter/excel/xichart.cxx b/sc/source/filter/excel/xichart.cxx index 09bd891da9c5..adff4074cf62 100644 --- a/sc/source/filter/excel/xichart.cxx +++ b/sc/source/filter/excel/xichart.cxx @@ -1873,6 +1873,11 @@ void XclImpChSeries::SetDataLabel( const XclImpChTextRef& xLabel ) void XclImpChSeries::AddChildSeries( const XclImpChSeries& rSeries ) { OSL_ENSURE( !HasParentSeries(), "XclImpChSeries::AddChildSeries - not allowed for child series" ); + if (&rSeries == this) + { + SAL_WARN("sc.filter", "self add attempt"); + return; + } /* In Excel, trend lines and error bars are stored as own series. In Calc, these are properties of the parent series. This function adds the commit 6da3d300eeb4b94320d2bb5e1558f35f152b35ff Author: Caolán McNamara <[email protected]> Date: Mon Mar 26 08:45:21 2018 +0100 forcepoint #28 missing cell on abw import Change-Id: I7633a17afab5aa2eb9e47a552bd5d92c87d383c7 Reviewed-on: https://gerrit.libreoffice.org/51853 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/sw/source/filter/xml/xmltbli.cxx b/sw/source/filter/xml/xmltbli.cxx index d8f0d8d7ae60..8669290fa20b 100644 --- a/sw/source/filter/xml/xmltbli.cxx +++ b/sw/source/filter/xml/xmltbli.cxx @@ -19,6 +19,7 @@ #include "hintids.hxx" +#include <com/sun/star/lang/IndexOutOfBoundsException.hpp> #include <com/sun/star/lang/XMultiServiceFactory.hpp> #include <com/sun/star/text/XTextTable.hpp> #include <com/sun/star/table/XCellRange.hpp> @@ -1658,8 +1659,10 @@ void SwXMLTableContext::InsertCell( const OUString& rStyleName, for( sal_uInt32 j=nRowSpan; j>0UL; --j ) { const bool bCovered = i != nColSpan || j != nRowSpan; - GetCell( nRowsReq-j, nColsReq-i ) - ->Set( sStyleName, j, i, pStartNode, + SwXMLTableCell_Impl *pCell = GetCell( nRowsReq-j, nColsReq-i ); + if (!pCell) + throw css::lang::IndexOutOfBoundsException(); + pCell->Set( sStyleName, j, i, pStartNode, pTable, bProtect, pFormula, bHasValue, bCovered, fValue, pStringValue, i_rXmlId ); } commit 181202b4c052f646f3665dd7d12e83cb240ea95c Author: Caolán McNamara <[email protected]> Date: Mon Mar 26 14:06:34 2018 +0100 forcepoint #35 handle odd number of dimension fragments Change-Id: I97e4e1b38d80276077b3427c90ae33023afb5e59 Reviewed-on: https://gerrit.libreoffice.org/51901 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/xmloff/source/draw/ximpcustomshape.cxx b/xmloff/source/draw/ximpcustomshape.cxx index 9f482d98092e..0fcff9160672 100644 --- a/xmloff/source/draw/ximpcustomshape.cxx +++ b/xmloff/source/draw/ximpcustomshape.cxx @@ -481,7 +481,7 @@ void GetSizeSequence( std::vector< css::beans::PropertyValue >& rDest, if ( !vNum.empty() ) { - uno::Sequence< awt::Size > aSizeSeq( vNum.size() / 2 ); + uno::Sequence< awt::Size > aSizeSeq((vNum.size() + 1) / 2); std::vector< sal_Int32 >::const_iterator aIter = vNum.begin(); std::vector< sal_Int32 >::const_iterator aEnd = vNum.end(); awt::Size* pValues = aSizeSeq.getArray(); commit 6f7c3c91d82ab1003b99d3bd2ae5838bd01d8487 Author: Caolán McNamara <[email protected]> Date: Thu Mar 29 17:42:12 2018 +0100 forcepoint#36 avoid dangling SvTextShapeImportHelper in case of exceptions Change-Id: Ibdbc047029c31d2b06d2349d68e1cbd9b15fd514 Reviewed-on: https://gerrit.libreoffice.org/52137 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/sw/qa/core/data/odt/fail/forcepoint-dtor-1.odt b/sw/qa/core/data/odt/fail/forcepoint-dtor-1.odt new file mode 100755 index 000000000000..6442200cdeda Binary files /dev/null and b/sw/qa/core/data/odt/fail/forcepoint-dtor-1.odt differ diff --git a/sw/source/filter/xml/xmlimp.cxx b/sw/source/filter/xml/xmlimp.cxx index 8ee58ceb6bfc..e056f1078047 100644 --- a/sw/source/filter/xml/xmlimp.cxx +++ b/sw/source/filter/xml/xmlimp.cxx @@ -420,6 +420,11 @@ SwXMLImport::SwXMLImport( SwXMLImport::~SwXMLImport() throw () { + if (HasShapeImport()) + { + SAL_WARN("sw", "endDocument skipped, dropping shapes now to avoid dangling SvTextShapeImportHelper pointing to this"); + ClearShapeImport(); + } delete m_pDocElemTokenMap; delete m_pTableElemTokenMap; delete m_pTableCellAttrTokenMap; commit dba936eb93360609dda9d31de88b7b612613b641 Author: Caolán McNamara <[email protected]> Date: Mon Mar 12 10:24:55 2018 +0000 forcepoint #24 back() on empty vector Thanks to Antti Levomäki and Christian Jalio from Forcepoint. Change-Id: Idb6723b53a1ae8aaca80847bfe643bc4abaedd21 Reviewed-on: https://gerrit.libreoffice.org/51123 Tested-by: Jenkins <[email protected]> Reviewed-by: Michael Stahl <[email protected]> diff --git a/sw/qa/core/data/rtf/fail/forcepoint-7.rtf b/sw/qa/core/data/rtf/fail/forcepoint-7.rtf new file mode 100755 index 000000000000..e5b227346108 --- /dev/null +++ b/sw/qa/core/data/rtf/fail/forcepoint-7.rtf @@ -0,0 +1,517 @@ +{\rtf1\�nsi\ansicpg1252\deflang3081\ftnbj\uc1\deff0 +{\fonttbl{\f0 \fswiss \fcharset1 Arial;}{\f1 \froman \fcharset2 Times New Roman;}{\f2 \froman \fcharset2 Symbol;}{\f3 \fswiss \fcharset0 Times New Roman;}{\f4 \fswiss \fcharset2 Symbol;}{\f5 \froman \fcharset0 Arial;}{\f6 \fswiss \fcharset0 Lucida Sans;}{\f7 \fswiss \fcharset0 Arial;}{\f8 \fswiss \fcharset1 Wingdings;}} +{\colortbl ;\red0\green0\blue0 ;\red255\green255\blue255 ;\red255\green255\blue128 ;\red0\green64\blue128 ;\red0\green0\blue255 ;\red0\green0\blue160 ;} +{\stylesheet{\f0\fs20\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Normal;}{\cs1\f0\fs24\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0 Default Paragraph Font;}{\cs2\f6\fs16\b\protect\cf1\cb3\chcbpat3\expnd0\expndtw0\charscalex100\dn0 SSBookmark;}{\s3\snext0\outlinelevel0\f0\fs32\b\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel0 Heading 1;}{\s4\snext0\outlinelevel1\f0\fs24\b\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel1 Heading 2;}{\s5\snext0\outlinelevel2\f0\fs24\b\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel2 Heading 3 +;}{\s6\snext0\outlinelevel3\f0\fs24\b\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel3 Heading 4;}{\s7\snext0\outlinelevel4\f0\fs24\b\i\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel4 Heading 5;}{\s8\snext0\outlinelevel5\f0\fs20\b\cf1\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel5 Heading 6;}{\s9\snext0\outlinelevel6\f0\fs24\cf4\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel6 Heading 7;}{\s10\snext0\outlinelevel7\f0\fs24\i\cf4\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel7 Heading 8 +;}{\s11\snext0\outlinelevel8\f0\fs22\cf4\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0\outlinelevel8 Heading 9;}{\s12\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 TOC 1;}{\s13\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li180\ri0\sb0\sa0\sl0\shading0 TOC 2;}{\s14\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li360\ri0\sb0\sa0\sl0\shading0 TOC 3;}{\s15\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li540\ri0\sb0\sa0\sl0\shading0 TOC 4;}{\s16\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li720\ri0\sb0\sa0\sl0\shading0 TOC 5 +;}{\s17\snext0\f0\fs24\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li900\ri0\sb0\sa0\sl0\shading0 TOC 6;}{\s18\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li1080\ri0\sb0\sa0\sl0\shading0 TOC 7;}{\s19\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li1260\ri0\sb0\sa0\sl0\shading0 TOC 8;}{\s20\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li1440\ri0\sb0\sa0\sl0\shading0 TOC 9;}{\s21\snext0\f0\fs32\b\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb240\sa60\sl0\shading0\qc Title;}{\s22\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi-360\li360\ri0\sb0\sa0\sl0\shading0 Numbered List +;}{\s23\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi-360\li360\ri0\sb0\sa0\sl0\shading0 Bulleted List;}{\s24\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa120\sl0\shading0 Body Text;}{\s25\snext0\f0\fs18\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa120\sl0\sl480\slmult1\shading0 Body Text 2;}{\s26\snext0\f0\fs16\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa120\sl0\shading0 Body Text 3;}{\s27\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Note Heading;}{\s28\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Plain Text +;}{\s29\snext0\f0\fs20\b\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Strong;}{\s30\snext0\f0\fs20\i\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Emphasis;}{\s31\snext0\f0\fs20\ul\cf5\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Hyperlink;}{\s32\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Footer;}{\s33\snext0\f0\fs20\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Header;}{\s34\snext0\f0\fs18\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 Code +;}{\cs35\f0\fs20\i\cf4\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0 Field Label;}{\cs36\f0\fs22\b\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0 Table Heading;}{\cs37\f0\fs20\b\ul\cf0\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0 Object type;}{\s38\snext0\f0\fs20\b\i\cf6\cb2\chcbpat2\expnd0\expndtw0\charscalex100\dn0\fi0\li0\ri0\sb0\sa0\sl0\shading0 List Header;}{\s39\snext24\f0\fs20\i\cf5\fi0\li0\ri0\sb0\sa120\sl240 InfoBlue;}} +{\*\revtbl{Unknown;}} +{\*\listtable +{\list\listtemplateid1 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} +{\listname List1;}\listid1 +} +{\list\listtemplateid2 +{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} +{\listname List2;}\listid2 +} +{\list\listtemplateid3 +{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f1\fs24} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} +{\listname List3;}\listid3 +} +{\list\listtemplateid4 +{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f1\fs24} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} +{\listname List4;}\listid4 +} +{\list\listtemplateid5 +{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2\fs24} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} +{\listname List5;}\listid5 +} +{\list\listtemplateid6 +{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2\fs24} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} +{\listname List6;}\listid6 +} +{\list\listtemplateid7 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}\f3\fs24} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} +{\listname List7;}\listid7 +} +{\list\listtemplateid8 +{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2\fs24} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} +{\listname List8;}\listid8 +} +{\list\listtemplateid9 +{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2\fs24} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} +{\listname List9;}\listid9 +} +{\list\listtemplateid10 +{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2\fs24} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} +{\listname List10;}\listid10 +} +{\list\listtemplateid11 +{\listlevel\levelnfc23\levelfollow0\levelstartat1{\leveltext \'01\'b7}{\levelnumbers}\f2\fs24} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'01.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'02.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'03.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'04.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'05.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'06.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'07.}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'08.}{\levelnumbers \'01}} +{\listname List11;}\listid11 +} +{\list\listtemplateid12 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}\b} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}} +{\listname List477861859_1;}\listid477861859 +} +{\list\listtemplateid13 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}\b} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}} +{\listname List735301812_1;}\listid735301812 +} +{\list\listtemplateid14 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}\b} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}} +{\listname List735310515_1;}\listid735310515 +} +{\list\listtemplateid15 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}\b} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}} +{\listname List735674015_1;}\listid735674015 +} +{\list\listtemplateid16 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}} +{\listname List366130062_1;}\listid735674016 +} +{\list\listtemplateid17 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}} +{\listname List366148531_1;}\listid735674017 +} +{\list\listtemplateid18 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'\'03\'05\'07\'09\'b\'d\'f\'11}} +{\listname List366155203_1;}\listid735674018 +} +{\list\listtemplateid19 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}} +{\listname ;}\listid735674019 +} +{\list\listtemplateid20 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'02\'00.}{\levelnumbers \'01}\b} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}} +{\listname List434687953_1;}\listid735674020 +} +{\list\listtemplateid21 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}} +{\listname List435828312_1;}\listid735674021 +} +{\list\listtemplateid22 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}}� {\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}} +{\listname List435835406_1;}\listid735674022 +} +{\list\listtemplateid23 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'03\'00.\'01}{\levelnumbers \'01\'03}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'05\'00.\'01.\'02}{\levelnumbers \'01\'03\'05}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'07\'00.\'01.\'02.\'03}{\levelnumbers \'01\'03\'05\'07}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'09\'00.\'01.\'02.\'03.\'04}{\levelnumbers \'01\'03\'05\'07\'09}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'b\'00.\'01.\'02.\'03.\'04.\'05}{\levelnumbers \'01\'03\'05\'07\'09\'b}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'d\'00.\'01.\'02.\'03.\'04.\'05.\'06}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'f\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f}} +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'11\'00.\'01.\'02.\'03.\'04.\'05.\'06.\'07.\'08}{\levelnumbers \'01\'03\'05\'07\'09\'b\'d\'f\'11}} +{\listname List435856328_1;}\listid735674023 +} +{\list\listtemplateid24 +{\listlevel\levelnfc0\levelfollow0\levelstartat1{\leveltext \'01\'00}{\levelnumbers \'01}} ... etc. - the rest is truncated
_______________________________________________ Libreoffice-commits mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
