From e77c573811dd9d685f2e7e936edc62963739800f Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Wed, 10 Dec 2014 12:54:46 +0000
Subject: fdo#76776 crashes after paste a table from Writer

Change-Id: If859352a7d8d409e5c3c651e0ffea0b3687007db
---
 editeng/source/editeng/eertfpar.cxx | 7 +++++++
 include/svtools/rtftoken.h          | 1 +
 svtools/source/svrtf/rtfkeywd.cxx   | 2 ++
 3 files changed, 10 insertions(+)

diff --git a/editeng/source/editeng/eertfpar.cxx b/editeng/source/editeng/eertfpar.cxx
index 4eb6a03cca58..e3ab1dbe398f 100644
--- a/editeng/source/editeng/eertfpar.cxx
+++ b/editeng/source/editeng/eertfpar.cxx
@@ -197,6 +197,13 @@ void EditRTFParser::NextToken( int nToken )
             ReadField();
         }
         break;
+        case RTF_SHPINST:  // fdo#76776 process contents of shpinst
+        break;
+        case RTF_SP:       // fdo#76776 but skip SP groups
+        {
+            SkipGroup();
+        }
+        break;
         case RTF_PGDSCTBL: // #i29453# ignore \*\pgdsctbl destination
         case RTF_LISTTEXT:
         {
diff --git a/include/svtools/rtftoken.h b/include/svtools/rtftoken.h
index b799526e6d31..cb23f30ebf39 100644
--- a/include/svtools/rtftoken.h
+++ b/include/svtools/rtftoken.h
@@ -1100,6 +1100,7 @@ enum RTF_TOKEN_IDS {
     RTF_SHPTXT,
     RTF_SHPFHDR,
     RTF_SHPGRP,
+    RTF_SHPINST,
     RTF_SHPRIGHT,
     RTF_SHPFBLWTXT,
     RTF_SHPZ,
diff --git a/svtools/source/svrtf/rtfkeywd.cxx b/svtools/source/svrtf/rtfkeywd.cxx
index 18f7ad162fcc..ef032a547009 100644
--- a/svtools/source/svrtf/rtfkeywd.cxx
+++ b/svtools/source/svrtf/rtfkeywd.cxx
@@ -1000,6 +1000,7 @@ static RTF_TokenEntry aRTFTokenTab[] = {
 {{OOO_STRING_SVTOOLS_RTF_SHPFBLWTXT},   RTF_SHPFBLWTXT},
 {{OOO_STRING_SVTOOLS_RTF_SHPFHDR},      RTF_SHPFHDR},
 {{OOO_STRING_SVTOOLS_RTF_SHPGRP},       RTF_SHPGRP},
+{{OOO_STRING_SVTOOLS_RTF_SHPINST},      RTF_SHPINST},
 {{OOO_STRING_SVTOOLS_RTF_SHPLEFT},      RTF_SHPLEFT},
 {{OOO_STRING_SVTOOLS_RTF_SHPLID},       RTF_SHPLID},
 {{OOO_STRING_SVTOOLS_RTF_SHPLOCKANCHOR},    RTF_SHPLOCKANCHOR},
@@ -1227,6 +1228,7 @@ int GetRTFToken( const OUString& rSearch )
                         sizeof( RTF_TokenEntry ),
                         RTFKeyCompare )))
         nRet = ((RTF_TokenEntry*)pFound)->nToken;
+
     return nRet;
 }
 
-- 
cgit v1.2.3