SvxNumberFormat::nFirstLineOffset should have a larger type

...similar to 0d227c96e11d7d03829144183bc66d229e059a4b
"SvxNumberFormat::nAbsLSpace should have a larger type", this time due to:

> Testing file:///home/sbergman/lo/core/sd/qa/unit/data/ppt/pass/hang-10.ppt:
[...]
> filter/source/msfilter/svdfppt.cxx:3793:39: runtime error: implicit conversion from type 'sal_Int32' (aka 'int') of value -142240 (32-bit, signed) to type 'short' changed the value to -11168 (16-bit, signed)
>  #0 in PPTNumberFormatCreator::ImplGetNumberFormat(SdrPowerPointImport const&, SvxNumberFormat&) at filter/source/msfilter/svdfppt.cxx:3793:39 (instdir/program/libmsfilterlo.so +0x79930d)
>  #1 in PPTNumberFormatCreator::GetNumberFormat(SdrPowerPointImport const&, SvxNumberFormat&, unsigned int, PPTParaLevel const&, PPTCharLevel const&, TSS_Type) at filter/source/msfilter/svdfppt.cxx:3674:5 (instdir/program/libmsfilterlo.so +0x797bad)
>  #2 in PPTStyleSheet::PPTStyleSheet(DffRecordHeader const&, SvStream&, SdrPowerPointImport&, PPTTextParagraphStyleAtomInterpreter const&, PPTTextSpecInfo const&) at filter/source/msfilter/svdfppt.cxx:4395:13 (instdir/program/libmsfilterlo.so +0x7ac27d)
>  #3 in SdrPowerPointImport::SdrPowerPointImport(PowerPointImportParam&, rtl::OUString const&) at filter/source/msfilter/svdfppt.cxx:1618:59 (instdir/program/libmsfilterlo.so +0x74759f)
>  #4 in ImplSdPPTImport::ImplSdPPTImport(SdDrawDocument*, SotStorage&, SfxMedium&, PowerPointImportParam&) at sd/source/filter/ppt/pptin.cxx:175:7 (instdir/program/libsdfiltlo.so +0x5f2be8)
>  #5 in SdPPTImport::SdPPTImport(SdDrawDocument*, SvStream&, SotStorage&, SfxMedium&) at sd/source/filter/ppt/pptin.cxx:162:23 (instdir/program/libsdfiltlo.so +0x5ce2bb)
>  #6 in ImportPPT at sd/source/filter/ppt/pptin.cxx:2760:47 (instdir/program/libsdfiltlo.so +0x617c79)
>  #7 in SdPPTFilter::Import() at sd/source/filter/sdpptwrp.cxx:106:32 (instdir/program/libsdlo.so +0x2878233)
>  #8 in sd::DrawDocShell::ConvertFrom(SfxMedium&) at sd/source/ui/docshell/docshel4.cxx:474:46 (instdir/program/libsdlo.so +0x2e163dc)
>  #9 in SfxObjectShell::DoLoad(SfxMedium*) at sfx2/source/doc/objstor.cxx:786:23 (instdir/program/libsfxlo.so +0x2c8c492)
>  #10 in SdFiltersTest::load(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int) at sd/qa/unit/filters-test.cxx:75:31 (workdir/LinkTarget/CppunitTest/libtest_sd_filters_test.so +0x19771)
>  #11 in test::FiltersTest::recursiveScan(test::filterStatus, rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) at unotest/source/cpp/filters-test.cxx:130:20 (workdir/LinkTarget/CppunitTest/../Library/libunotest.so +0x5724c)
>  #12 in test::FiltersTest::testDir(rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, SfxFilterFlags, SotClipboardFormatId, unsigned int, bool) at unotest/source/cpp/filters-test.cxx:155:5 (workdir/LinkTarget/CppunitTest/../Library/libunotest.so +0x57ec9)
>  #13 in SdFiltersTest::testCVEs() at sd/qa/unit/filters-test.cxx:83:5 (workdir/LinkTarget/CppunitTest/libtest_sd_filters_test.so +0x19d6d)

Change-Id: Icd83120e99ac8e7181d75e2cf9d13f49064e65e1
Reviewed-on: https://gerrit.libreoffice.org/59212
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>

16 files changed, 29 insertions, 23 deletions

diff --git a/cui/source/tabpages/numpages.cxx b/cui/source/tabpages/numpages.cxx
index 799898390702..0ed2f6b325c9 100644
--- a/cui/source/tabpages/numpages.cxx
+++ b/cui/source/tabpages/numpages.cxx
@@ -3210,7 +3210,7 @@ IMPL_LINK( SvxNumPositionTabPage, DistanceHdl_Impl, SpinField&, rFld, void )
                 {
                     if(0 == i)
                     {
-                        long nTmp = aNumFmt.GetFirstLineOffset();
+                        auto const nTmp = aNumFmt.GetFirstLineOffset();
                         aNumFmt.SetAbsLSpace( nValue - nTmp);
                     }
                     else
@@ -3237,7 +3237,7 @@ IMPL_LINK( SvxNumPositionTabPage, DistanceHdl_Impl, SpinField&, rFld, void )
                 long nDiff = nValue + aNumFmt.GetFirstLineOffset();
                 auto const nAbsLSpace = aNumFmt.GetAbsLSpace();
                 aNumFmt.SetAbsLSpace(nAbsLSpace + nDiff);
-                aNumFmt.SetFirstLineOffset( -static_cast<short>(nValue) );
+                aNumFmt.SetFirstLineOffset( -nValue );
             }
 
             pActNum->SetLevel( i, aNumFmt );
diff --git a/editeng/source/editeng/editdbg.cxx b/editeng/source/editeng/editdbg.cxx
index 51bf4a63498f..28e9b4d53a6f 100644
--- a/editeng/source/editeng/editdbg.cxx
+++ b/editeng/source/editeng/editdbg.cxx
@@ -88,7 +88,7 @@ OString DbgOutItem(const SfxItemPool& rPool, const SfxPoolItem& rItem)
                 if ( pFmt )
                 {
                     aDebStr.append('(');
-                    aDebStr.append(static_cast<sal_Int32>(pFmt->GetFirstLineOffset()));
+                    aDebStr.append(pFmt->GetFirstLineOffset());
                     aDebStr.append(',');
                     aDebStr.append(pFmt->GetAbsLSpace());
                     aDebStr.append(',');
diff --git a/editeng/source/items/numitem.cxx b/editeng/source/items/numitem.cxx
index f85c4aec9855..0e8c012a5df9 100644
--- a/editeng/source/items/numitem.cxx
+++ b/editeng/source/items/numitem.cxx
@@ -197,8 +197,10 @@ SvxNumberFormat::SvxNumberFormat( SvStream &rStream )
     rStream.ReadUInt16( nStart );
     rStream.ReadUInt16( nTmp16 ); cBullet = static_cast<sal_Unicode>(nTmp16);
 
-    rStream.ReadInt16( nFirstLineOffset );
-    sal_Int16 temp;
+    sal_Int16 temp = 0;
+    rStream.ReadInt16( temp );
+    nFirstLineOffset = temp;
+    temp = 0;
     rStream.ReadInt16( temp );
     nAbsLSpace = temp;
     rStream.SeekRel(2); //skip old now unused nLSpace;
@@ -261,7 +263,9 @@ void SvxNumberFormat::Store(SvStream &rStream, FontToSubsFontConverter pConverte
     rStream.WriteUInt16( nStart );
     rStream.WriteUInt16( cBullet );
 
-    rStream.WriteInt16( nFirstLineOffset );
+    rStream.WriteInt16(
+        sal_Int16(o3tl::clamp<sal_Int32>(nFirstLineOffset, SAL_MIN_INT16, SAL_MAX_INT16)) );
+        //TODO: better way to handle out-of-bounds value?
     rStream.WriteInt16(
         sal_Int16(o3tl::clamp<sal_Int32>(nAbsLSpace, SAL_MIN_INT16, SAL_MAX_INT16)) );
         //TODO: better way to handle out-of-bounds value?
@@ -452,11 +456,11 @@ sal_Int32 SvxNumberFormat::GetAbsLSpace() const
            ? nAbsLSpace
            : static_cast<sal_Int32>( GetFirstLineIndent() + GetIndentAt() );
 }
-short SvxNumberFormat::GetFirstLineOffset() const
+sal_Int32 SvxNumberFormat::GetFirstLineOffset() const
 {
     return mePositionAndSpaceMode == LABEL_WIDTH_AND_POSITION
            ? nFirstLineOffset
-           : static_cast<short>( GetFirstLineIndent() );
+           : static_cast<sal_Int32>( GetFirstLineIndent() );
 }
 short SvxNumberFormat::GetCharTextDistance() const
 {
diff --git a/editeng/source/uno/unonrule.cxx b/editeng/source/uno/unonrule.cxx
index 30c7deab2e94..74ac1596146a 100644
--- a/editeng/source/uno/unonrule.cxx
+++ b/editeng/source/uno/unonrule.cxx
@@ -248,7 +248,7 @@ Sequence<beans::PropertyValue> SvxUnoNumberingRules::getNumberingRuleByIndex(sal
     aVal <<= rFmt.GetAbsLSpace();
     pArray[nIdx++] = beans::PropertyValue(UNO_NAME_NRULE_LEFT_MARGIN, -1, aVal, beans::PropertyState_DIRECT_VALUE);
 
-    aVal <<= static_cast<sal_Int32>(rFmt.GetFirstLineOffset());
+    aVal <<= rFmt.GetFirstLineOffset();
     pArray[nIdx++] = beans::PropertyValue(UNO_NAME_NRULE_FIRST_LINE_OFFSET, -1, aVal, beans::PropertyState_DIRECT_VALUE);
 
     pArray[nIdx++] = beans::PropertyValue("SymbolTextDistance", -1, aVal, beans::PropertyState_DIRECT_VALUE);
@@ -411,7 +411,7 @@ void SvxUnoNumberingRules::setNumberingRuleByIndex(const Sequence<beans::Propert
             sal_Int32 nMargin = 0;
             if( aVal >>= nMargin )
             {
-                aFmt.SetFirstLineOffset(static_cast<sal_uInt16>(nMargin));
+                aFmt.SetFirstLineOffset(nMargin);
                 continue;
             }
         }
diff --git a/include/editeng/numitem.hxx b/include/editeng/numitem.hxx
index ec0e78248d3c..1fa20df5f1a1 100644
--- a/include/editeng/numitem.hxx
+++ b/include/editeng/numitem.hxx
@@ -124,7 +124,7 @@ private:
     //         LABEL_ALIGNMENT is active.
     SvxNumPositionAndSpaceMode mePositionAndSpaceMode;
 
-    short               nFirstLineOffset;   // First line indent
+    sal_Int32           nFirstLineOffset;   // First line indent
     sal_Int32           nAbsLSpace;         // Distance Border<->Number
     short               nCharTextDistance;  // Distance Number<->Text
 
@@ -197,8 +197,8 @@ public:
 
     void            SetAbsLSpace(sal_Int32 nSet) {nAbsLSpace = nSet;}
     sal_Int32       GetAbsLSpace() const;
-    void            SetFirstLineOffset(short nSet) { nFirstLineOffset = nSet;}
-    short           GetFirstLineOffset() const;
+    void            SetFirstLineOffset(sal_Int32 nSet) { nFirstLineOffset = nSet;}
+    sal_Int32       GetFirstLineOffset() const;
     void            SetCharTextDistance(short nSet) { nCharTextDistance = nSet; }
     short           GetCharTextDistance() const;
 
diff --git a/sd/qa/unit/export-tests-ooxml1.cxx b/sd/qa/unit/export-tests-ooxml1.cxx
index 38ea1323d4a4..98e6dcc57335 100644
--- a/sd/qa/unit/export-tests-ooxml1.cxx
+++ b/sd/qa/unit/export-tests-ooxml1.cxx
@@ -664,7 +664,7 @@ void SdOOXMLExportTest1::testBulletMarginAndIndentation()
     CPPUNIT_ASSERT(pNumFmt);
 
     CPPUNIT_ASSERT_EQUAL_MESSAGE( "Bullet's left margin is wrong!", sal_Int32(1000),pNumFmt->GetNumRule()->GetLevel(0).GetAbsLSpace() ); // left margin is 0.79 cm
-    CPPUNIT_ASSERT_EQUAL_MESSAGE( "Bullet's indentation is wrong!", sal_Int32(-998),sal_Int32(pNumFmt->GetNumRule()->GetLevel(0). GetFirstLineOffset()));
+    CPPUNIT_ASSERT_EQUAL_MESSAGE( "Bullet's indentation is wrong!", sal_Int32(-998),pNumFmt->GetNumRule()->GetLevel(0). GetFirstLineOffset());
 
     xDocShRef->DoClose();
 }
diff --git a/sd/source/core/stlpool.cxx b/sd/source/core/stlpool.cxx
index 905073f548f5..9fa7884d8357 100644
--- a/sd/source/core/stlpool.cxx
+++ b/sd/source/core/stlpool.cxx
@@ -1040,7 +1040,7 @@ void SdStyleSheetPool::setDefaultOutlineNumberFormatBulletAndIndent(sal_uInt16 i
     rNumberFormat.SetBulletRelSize(45);
     const auto nLSpace = (i + 1) * 1200;
     rNumberFormat.SetAbsLSpace(nLSpace);
-    short nFirstLineOffset = -600;
+    sal_Int32 nFirstLineOffset = -600;
 
     switch(i)
     {
diff --git a/sd/source/ui/view/drviews3.cxx b/sd/source/ui/view/drviews3.cxx
index 0aa59655c577..aa433c0d84c7 100644
--- a/sd/source/ui/view/drviews3.cxx
+++ b/sd/source/ui/view/drviews3.cxx
@@ -808,7 +808,7 @@ void  DrawViewShell::ExecRuler(SfxRequest& rReq)
                         aFormat.SetFirstLineOffset(0);
                         aLRSpaceItem.SetTextFirstLineOfst(
                             rItem.GetTextFirstLineOfst()
-                            - aFormat.GetFirstLineOffset()
+                            - aFormat.GetFirstLineOffset() //TODO: overflow
                             + aFormat.GetCharTextDistance());
                     }
 
@@ -911,6 +911,7 @@ void  DrawViewShell::GetRulerState(SfxItemSet& rSet)
                         aLRSpaceItem.SetTextLeft(rFormat.GetAbsLSpace() + rLRSpaceItem.GetTextLeft());
                         aLRSpaceItem.SetTextFirstLineOfst(
                             rLRSpaceItem.GetTextFirstLineOfst() + rFormat.GetFirstLineOffset()
+                                //TODO: overflow
                             - rFormat.GetCharTextDistance());
                     }
 
diff --git a/sw/source/core/doc/DocumentStylePoolManager.cxx b/sw/source/core/doc/DocumentStylePoolManager.cxx
index d2cbedbada6d..aafd5fffab7f 100644
--- a/sw/source/core/doc/DocumentStylePoolManager.cxx
+++ b/sw/source/core/doc/DocumentStylePoolManager.cxx
@@ -206,6 +206,7 @@ namespace
                 {
                     SvxLRSpaceItem aLR( pColl->GetFormatAttr( RES_LR_SPACE ) );
                     aLR.SetTextFirstLineOfstValue( rNFormat.GetFirstLineOffset() );
+                        //TODO: overflow
                     aLR.SetTextLeft( rNFormat.GetAbsLSpace() );
                     pColl->SetFormatAttr( aLR );
                 }
diff --git a/sw/source/core/txtnode/ndtxt.cxx b/sw/source/core/txtnode/ndtxt.cxx
index e168db451d14..859f33e5f30c 100644
--- a/sw/source/core/txtnode/ndtxt.cxx
+++ b/sw/source/core/txtnode/ndtxt.cxx
@@ -2888,7 +2888,7 @@ bool SwTextNode::GetFirstLineOfsWithNum( short& rFLOffset ) const
             const SwNumFormat& rFormat = pRule->Get(lcl_BoundListLevel(GetActualListLevel()));
             if ( rFormat.GetPositionAndSpaceMode() == SvxNumberFormat::LABEL_WIDTH_AND_POSITION )
             {
-                rFLOffset = rFormat.GetFirstLineOffset();
+                rFLOffset = rFormat.GetFirstLineOffset(); //TODO: overflow
 
                 if (!getIDocumentSettingAccess()->get(DocumentSettingId::IGNORE_FIRST_LINE_INDENT_IN_NUMBERING))
                 {
diff --git a/sw/source/core/unocore/unosett.cxx b/sw/source/core/unocore/unosett.cxx
index a608eaac3031..d88406c9b6a8 100644
--- a/sw/source/core/unocore/unosett.cxx
+++ b/sw/source/core/unocore/unosett.cxx
@@ -1742,7 +1742,7 @@ void SwXNumberingRules::SetPropertiesToNumFormat(
                     pProp->Value >>= nValue;
                     // #i23727# nValue can be positive
                     nValue = convertMm100ToTwip(nValue);
-                    aFormat.SetFirstLineOffset(static_cast<short>(nValue));
+                    aFormat.SetFirstLineOffset(nValue);
                 }
                 break;
                 case 9: // UNO_NAME_POSITION_AND_SPACE_MODE
diff --git a/sw/source/filter/html/htmlcss1.cxx b/sw/source/filter/html/htmlcss1.cxx
index db9e2fb562e7..8518decf45e8 100644
--- a/sw/source/filter/html/htmlcss1.cxx
+++ b/sw/source/filter/html/htmlcss1.cxx
@@ -2188,7 +2188,7 @@ void SwHTMLParser::GetMarginsFromContextWithNumBul( sal_uInt16& nLeft,
                                                             : MAXLEVEL) - 1 );
         const SwNumFormat& rNumFormat = rInfo.GetNumRule()->Get(nLevel);
         nLeft = nLeft + rNumFormat.GetAbsLSpace(); //TODO: overflow
-        nIndent = rNumFormat.GetFirstLineOffset();
+        nIndent = rNumFormat.GetFirstLineOffset(); //TODO: overflow
     }
 }
 
diff --git a/sw/source/filter/html/htmlnumreader.cxx b/sw/source/filter/html/htmlnumreader.cxx
index a910324b4aa6..54c09a7f741d 100644
--- a/sw/source/filter/html/htmlnumreader.cxx
+++ b/sw/source/filter/html/htmlnumreader.cxx
@@ -107,7 +107,7 @@ void SwHTMLParser::NewNumBulList( HtmlTokenId nToken )
 
         sal_Int32 nAbsLSpace = HTML_NUMBUL_MARGINLEFT;
 
-        short nFirstLineIndent  = HTML_NUMBUL_INDENT;
+        sal_Int32 nFirstLineIndent  = HTML_NUMBUL_INDENT;
         if( nLevel > 0 )
         {
             const SwNumFormat& rPrevNumFormat = rInfo.GetNumRule()->Get( nLevel-1 );
diff --git a/sw/source/filter/ww8/rtfattributeoutput.cxx b/sw/source/filter/ww8/rtfattributeoutput.cxx
index 78d64c1c5cc6..09241ae57b26 100644
--- a/sw/source/filter/ww8/rtfattributeoutput.cxx
+++ b/sw/source/filter/ww8/rtfattributeoutput.cxx
@@ -2834,7 +2834,7 @@ void RtfAttributeOutput::ParaNumRule_Impl(const SwTextNode* pTextNd, sal_Int32 n
 
     SvxLRSpaceItem aLR(rNdSet.Get(RES_LR_SPACE));
     aLR.SetTextLeft(aLR.GetTextLeft() + pFormat->GetIndentAt());
-    aLR.SetTextFirstLineOfst(pFormat->GetFirstLineOffset());
+    aLR.SetTextFirstLineOfst(pFormat->GetFirstLineOffset()); //TODO: overflow
 
     sal_uInt16 nStyle = m_rExport.GetId(pFormat->GetCharFormat());
     OString* pString = m_rExport.GetStyle(nStyle);
diff --git a/sw/source/filter/ww8/wrtw8num.cxx b/sw/source/filter/ww8/wrtw8num.cxx
index 120a3b97be68..62ce13405c52 100644
--- a/sw/source/filter/ww8/wrtw8num.cxx
+++ b/sw/source/filter/ww8/wrtw8num.cxx
@@ -127,7 +127,7 @@ sal_Int16 GetWordFirstLineOffset(const SwNumFormat &rFormat)
     if (rFormat.GetNumAdjust() == SvxAdjust::Right)
         nFirstLineOffset = -rFormat.GetCharTextDistance();
     else
-        nFirstLineOffset = rFormat.GetFirstLineOffset();
+        nFirstLineOffset = rFormat.GetFirstLineOffset(); //TODO: overflow
     return nFirstLineOffset;
 }
 
diff --git a/sw/source/ui/misc/num.cxx b/sw/source/ui/misc/num.cxx
index 1fe4198aee8a..c3eaedb5b7e9 100644
--- a/sw/source/ui/misc/num.cxx
+++ b/sw/source/ui/misc/num.cxx
@@ -623,7 +623,7 @@ IMPL_LINK(SwNumPositionTabPage, DistanceHdl, weld::MetricSpinButton&, rField, vo
                 {
                     if(0 == i)
                     {
-                        long nTmp = aNumFormat.GetFirstLineOffset();
+                        auto const nTmp = aNumFormat.GetFirstLineOffset();
                         aNumFormat.SetAbsLSpace( nValue - nTmp );
                     }
                     else