tdf#78506 RTF import: fix handling of invalid \levelnumbers

In case ';' is written in \u form in \levelnumbers, then Word ignores the whole
\levelnumbers contents, do the same.

Change-Id: I93ce5810af2b5ed703e804199c0b236d2c4c36b5
Reviewed-on: https://gerrit.libreoffice.org/27869
Reviewed-by: Miklos Vajna <vmiklos@collabora.co.uk>
Tested-by: Jenkins <ci@libreoffice.org>

5 files changed, 64 insertions, 2 deletions

diff --git a/sw/qa/extras/rtfimport/data/tdf78506.rtf b/sw/qa/extras/rtfimport/data/tdf78506.rtf
new file mode 100644
index 000000000000..2978734137c7
--- /dev/null
+++ b/sw/qa/extras/rtfimport/data/tdf78506.rtf
@@ -0,0 +1,24 @@
+{\rtf \ansi \ansicpg0 \deff0 \stshfdbch1 \stshfloch0 \stshfhich0 \deflang1033 \deflangfe1033 
+{\*\listtable 
+{\list \listtemplateid700648999 \listhybrid 
+{\listlevel \levelnfc0 \levelnfcn0 \leveljc0 \leveljcn0 \levelstartat1 \levelfollow0 \levelspace0 \levelindent0 \levellegal0 \levelnorestart0
+{\leveltext
+{\uc1 \u2 ?}
+{\uc1 \u0 ?}
+{\uc1 \u46 ?}
+{\uc1 \u59 ?}
+}
+{\levelnumbers \'01
+{\uc1 \u59 ?}
+}
+\li720 \lin720 \fi-360 }
+{\listname ;}
+\listid697112958 }
+}
+{\*\listoverridetable 
+{\listoverride \listid697112958 \listoverridecount0 \ls1 }
+}
+\pard \plain \ls1
+Test.
+\par
+}
diff --git a/sw/qa/extras/rtfimport/rtfimport.cxx b/sw/qa/extras/rtfimport/rtfimport.cxx
index 19f44e35738a..048eecdc7d8c 100644
--- a/sw/qa/extras/rtfimport/rtfimport.cxx
+++ b/sw/qa/extras/rtfimport/rtfimport.cxx
@@ -2661,6 +2661,23 @@ DECLARE_RTFIMPORT_TEST(testFlip, "flip.rtf")
     CPPUNIT_ASSERT(!aMap["MirroredY"].hasValue());
 }
 
+DECLARE_RTFIMPORT_TEST(testTdf78506, "tdf78506.rtf")
+{
+    uno::Reference<beans::XPropertySet> xPropertySet(getStyles("NumberingStyles")->getByName("WWNum1"), uno::UNO_QUERY);
+    uno::Reference<container::XIndexAccess> xLevels(xPropertySet->getPropertyValue("NumberingRules"), uno::UNO_QUERY);
+    uno::Sequence<beans::PropertyValue> aProps;
+    xLevels->getByIndex(0) >>= aProps; // 1sd level
+
+    for (int i = 0; i < aProps.getLength(); ++i)
+    {
+        const beans::PropertyValue& rProp = aProps[i];
+
+        if (rProp.Name == "Suffix")
+            // This was '0', invalid \levelnumbers wasn't ignored.
+            CPPUNIT_ASSERT_EQUAL(CHAR_ZWSP, rProp.Value.get<OUString>().toChar());
+    }
+}
+
 CPPUNIT_PLUGIN_IMPLEMENT();
 
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/writerfilter/source/rtftok/rtfdispatchvalue.cxx b/writerfilter/source/rtftok/rtfdispatchvalue.cxx
index efd71cba54c0..30621f9afeeb 100644
--- a/writerfilter/source/rtftok/rtfdispatchvalue.cxx
+++ b/writerfilter/source/rtftok/rtfdispatchvalue.cxx
@@ -628,6 +628,9 @@ RTFError RTFDocumentImpl::dispatchValue(RTFKeyword nKeyword, int nParam)
             {
                 if (nParam != ';')
                     m_aStates.top().aLevelNumbers.push_back(sal_Int32(nParam));
+                else
+                    // ';' in \u form is not considered valid.
+                    m_aStates.top().bLevelNumbersValid = false;
             }
             else
                 m_aUnicodeBuffer.append(static_cast<sal_Unicode>(nParam));
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
index 909dc8643fc5..578751e85dfd 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
@@ -2007,11 +2007,16 @@ RTFError RTFDocumentImpl::popState()
     }
     break;
     case Destination::LEVELNUMBERS:
-        if (aState.aTableSprms.find(NS_ooxml::LN_CT_Lvl_lvlText))
+    {
+        bool bNestedLevelNumbers = false;
+        if (m_aStates.size() > 1)
+            // Current destination is levelnumbers and parent destination is levelnumbers as well.
+            bNestedLevelNumbers = m_aStates[m_aStates.size() - 2].eDestination == Destination::LEVELNUMBERS;
+        if (!bNestedLevelNumbers && aState.aTableSprms.find(NS_ooxml::LN_CT_Lvl_lvlText))
         {
             RTFSprms& rAttributes = aState.aTableSprms.find(NS_ooxml::LN_CT_Lvl_lvlText)->getAttributes();
             RTFValue::Pointer_t pValue = rAttributes.find(NS_ooxml::LN_CT_LevelText_val);
-            if (pValue)
+            if (pValue && aState.bLevelNumbersValid)
             {
                 OUString aOrig = pValue->getString();
 
@@ -2032,8 +2037,12 @@ RTFError RTFDocumentImpl::popState()
 
                 pValue->setString(aBuf.makeStringAndClear());
             }
+            else if (pValue)
+                // Have a value, but levelnumbers is not valid -> ignore it.
+                pValue->setString(OUString());
         }
         break;
+    }
     case Destination::SHAPEPROPERTYNAME:
         if (&m_aStates.top().aDestinationText != m_aStates.top().pDestinationText)
             break; // not for nested group
@@ -2914,7 +2923,13 @@ RTFError RTFDocumentImpl::popState()
         break;
     case Destination::LEVELNUMBERS:
         if (!m_aStates.empty())
+        {
             m_aStates.top().aTableSprms = aState.aTableSprms;
+            if (aState.eDestination == Destination::LEVELNUMBERS)
+                // Both current and parent state is levelnumbers: mark parent
+                // as invalid as well if necessary.
+                m_aStates.top().bLevelNumbersValid = aState.bLevelNumbersValid;
+        }
         break;
     case Destination::FIELDINSTRUCTION:
         if (!m_aStates.empty())
@@ -3171,6 +3186,7 @@ RTFParserState::RTFParserState(RTFDocumentImpl* pDocumentImpl)
       nListLevelNum(0),
       aListLevelEntries(),
       aLevelNumbers(),
+      bLevelNumbersValid(true),
       aPicture(),
       aShape(),
       aDrawingObject(),
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.hxx b/writerfilter/source/rtftok/rtfdocumentimpl.hxx
index 83d205b87237..0c46d80935d7 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.hxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.hxx
@@ -258,6 +258,8 @@ public:
 
     /// List of character positions in leveltext to replace.
     std::vector<sal_Int32> aLevelNumbers;
+    /// If aLevelNumbers should be read at all.
+    bool bLevelNumbersValid;
 
     RTFPicture aPicture;
     RTFShape aShape;