Merge commit 'ooo/OOO330_m17' into libreoffice-3-3

5 files changed, 57 insertions, 23 deletions

diff --git a/basegfx/source/polygon/b2dtrapezoid.cxx b/basegfx/source/polygon/b2dtrapezoid.cxx
index 261f045b4a7f..f095a6658119 100644
--- a/basegfx/source/polygon/b2dtrapezoid.cxx
+++ b/basegfx/source/polygon/b2dtrapezoid.cxx
@@ -799,6 +799,7 @@ namespace basegfx
                                         if(splitEdgeAtGivenPoint(aLeft, *pNewLeft, aCurrent))
                                         {
                                             maNewPoints.push_back(pNewLeft);
+                                            bDone = true;
                                         }
                                         else
                                         {
@@ -810,13 +811,12 @@ namespace basegfx
                                         if(splitEdgeAtGivenPoint(aRight, *pNewRight, aCurrent))
                                         {
                                             maNewPoints.push_back(pNewRight);
+                                            bDone = true;
                                         }
                                         else
                                         {
                                             delete pNewRight;
                                         }
-
-                                        bDone = true;
                                     }
                                 }
 
diff --git a/vcl/aqua/source/gdi/salatslayout.cxx b/vcl/aqua/source/gdi/salatslayout.cxx
index 6f21be3f5c49..f79da3559b35 100644
--- a/vcl/aqua/source/gdi/salatslayout.cxx
+++ b/vcl/aqua/source/gdi/salatslayout.cxx
@@ -751,9 +751,10 @@ int ATSLayout::GetTextBreak( long nMaxWidth, long nCharExtra, int nFactor ) cons
     // initial measurement of text break position
     UniCharArrayOffset nBreakPos = mnMinCharPos;
     const ATSUTextMeasurement nATSUMaxWidth = Vcl2Fixed( nPixelWidth );
+    if( nATSUMaxWidth <= 0xFFFF ) // #i108584# avoid ATSU rejecting the parameter
+        return mnMinCharPos;      //           or do ATSUMaxWidth=0x10000;
     OSStatus eStatus = ATSUBreakLine( maATSULayout, mnMinCharPos,
         nATSUMaxWidth, false, &nBreakPos );
-
     if( (eStatus != noErr) && (eStatus != kATSULineBreakInWord) )
         return STRING_LEN;
 
@@ -778,7 +779,7 @@ int ATSLayout::GetTextBreak( long nMaxWidth, long nCharExtra, int nFactor ) cons
     if( eStatus != noErr )
         return nBreakPos;
     const ATSUTextMeasurement nATSURemWidth = nATSUMaxWidth - (nRight - nLeft);
-    if( nATSURemWidth <= 0 )
+    if( nATSURemWidth <= 0xFFFF ) // #i108584# avoid ATSU rejecting the parameter
         return nBreakPos;
     UniCharArrayOffset nBreakPosInWord = nBreakPos;
     eStatus = ATSUBreakLine( maATSULayout, nBreakPos, nATSURemWidth, false, &nBreakPosInWord );
diff --git a/vcl/source/gdi/metaact.cxx b/vcl/source/gdi/metaact.cxx
index 25afe9946ccb..3c999ef9762a 100644
--- a/vcl/source/gdi/metaact.cxx
+++ b/vcl/source/gdi/metaact.cxx
@@ -1442,19 +1442,35 @@ void MetaTextArrayAction::Read( SvStream& rIStm, ImplMetaReadData* pData )
     rIStm   >> mnLen;
     rIStm   >> nAryLen;
 
+    if ( mnIndex > mnLen )
+    {
+        mnIndex = 0;
+        mpDXAry = 0;
+        return;
+    }
+
     if( nAryLen )
     {
         // #i9762#, #106172# Ensure that DX array is at least mnLen entries long
-        const ULONG nIntAryLen( Max(nAryLen, static_cast<sal_uInt32>(mnLen)) );
-        mpDXAry = new sal_Int32[ nIntAryLen ];
-
-        ULONG i;
-        for( i = 0UL; i < nAryLen; i++ )
-            rIStm >> mpDXAry[ i ];
+        if ( mnLen >= nAryLen )
+        {
+            mpDXAry = new (std::nothrow)sal_Int32[ mnLen ];
+            if ( mpDXAry )
+            {
+                   ULONG i;
+                for( i = 0UL; i < nAryLen; i++ )
+                    rIStm >> mpDXAry[ i ];
 
-        // #106172# setup remainder
-        for( ; i < nIntAryLen; i++ )
-            mpDXAry[ i ] = 0;
+                // #106172# setup remainder
+                for( ; i < mnLen; i++ )
+                    mpDXAry[ i ] = 0;
+            }
+        }
+        else
+        {
+            mpDXAry = NULL;
+            return;
+        }
     }
     else
         mpDXAry = NULL;
diff --git a/vcl/source/gdi/pdfwriter_impl.cxx b/vcl/source/gdi/pdfwriter_impl.cxx
index b3e5362be198..ccd6bc173634 100644
--- a/vcl/source/gdi/pdfwriter_impl.cxx
+++ b/vcl/source/gdi/pdfwriter_impl.cxx
@@ -7366,7 +7366,14 @@ void PDFWriterImpl::drawLayout( SalLayout& rLayout, const String& rText, bool bT
                 // try to handle ligatures and such
                 if( i < nGlyphs-1 )
                 {
-                    pUnicodesPerGlyph[i] = nChars = pCharPosAry[i+1] - pCharPosAry[i];
+                    nChars = pCharPosAry[i+1] - pCharPosAry[i];
+                    // #i115618# fix for simple RTL+CTL cases
+                    // TODO: sanitize for RTL ligatures, more complex CTL, etc.
+                    if( nChars < 0 )
+                        nChars = -nChars;
+            else if( nChars == 0 )
+                        nChars = 1;
+                    pUnicodesPerGlyph[i] = nChars;
                     for( int n = 1; n < nChars; n++ )
                         aUnicodes.push_back( rText.GetChar( sal::static_int_cast<xub_StrLen>(pCharPosAry[i]+n) ) );
                 }
diff --git a/vcl/source/gdi/pngread.cxx b/vcl/source/gdi/pngread.cxx
index a2094c97a77c..990f5d4cdc9a 100644
--- a/vcl/source/gdi/pngread.cxx
+++ b/vcl/source/gdi/pngread.cxx
@@ -412,7 +412,9 @@ BitmapEx PNGReaderImpl::GetBitmapEx( const Size& rPreviewSizeHint )
 
             case PNGCHUNK_IDAT :
             {
-                if ( !mbIDAT )      // the gfx is finished, but there may be left a zlibCRC of about 4Bytes
+                if ( !mpInflateInBuf )  // taking care that the header has properly been read
+                    mbStatus = FALSE;
+                else if ( !mbIDAT )     // the gfx is finished, but there may be left a zlibCRC of about 4Bytes
                     ImplReadIDAT();
             }
             break;
@@ -523,7 +525,7 @@ BOOL PNGReaderImpl::ImplReadHeader( const Size& rPreviewSizeHint )
     mbIDAT = mbAlphaChannel = mbTransparent = FALSE;
     mbGrayScale = mbRGBTriple = FALSE;
     mnTargetDepth = mnPngDepth;
-    mnScansize = ( ( maOrigSize.Width() * mnPngDepth ) + 7 ) >> 3;
+    sal_uInt64 nScansize64 = ( ( static_cast< sal_uInt64 >( maOrigSize.Width() ) * mnPngDepth ) + 7 ) >> 3;
 
     // valid color types are 0,2,3,4 & 6
     switch ( mnColorType )
@@ -553,7 +555,7 @@ BOOL PNGReaderImpl::ImplReadHeader( const Size& rPreviewSizeHint )
         case 2 :    // each pixel is an RGB triple
         {
             mbRGBTriple = TRUE;
-            mnScansize *= 3;
+            nScansize64 *= 3;
             switch ( mnPngDepth )
             {
                 case 16 :           // we have to reduce the bitmap
@@ -586,7 +588,7 @@ BOOL PNGReaderImpl::ImplReadHeader( const Size& rPreviewSizeHint )
 
         case 4 :    // each pixel is a grayscale sample followed by an alpha sample
         {
-            mnScansize *= 2;
+            nScansize64 *= 2;
             mbAlphaChannel = TRUE;
             switch ( mnPngDepth )
             {
@@ -604,7 +606,7 @@ BOOL PNGReaderImpl::ImplReadHeader( const Size& rPreviewSizeHint )
         case 6 :    // each pixel is an RGB triple followed by an alpha sample
         {
             mbRGBTriple = TRUE;
-            mnScansize *= 4;
+            nScansize64 *= 4;
             mbAlphaChannel = TRUE;
             switch (mnPngDepth )
             {
@@ -622,16 +624,24 @@ BOOL PNGReaderImpl::ImplReadHeader( const Size& rPreviewSizeHint )
             return FALSE;
     }
 
-    mnBPP = mnScansize / maOrigSize.Width();
+    mnBPP = static_cast< sal_uInt32 >( nScansize64 / maOrigSize.Width() );
     if ( !mnBPP )
         mnBPP = 1;
 
-    mnScansize++;       // each scanline includes one filterbyte
+    nScansize64++;       // each scanline includes one filterbyte
+
+    if ( nScansize64 > SAL_MAX_UINT32 )
+        return FALSE;
+
+    mnScansize = static_cast< sal_uInt32 >( nScansize64 );
 
     // TODO: switch between both scanlines instead of copying
-    mpInflateInBuf = new BYTE[ mnScansize ];
+    mpInflateInBuf = new (std::nothrow) BYTE[ mnScansize ];
     mpScanCurrent = mpInflateInBuf;
-    mpScanPrior = new BYTE[ mnScansize ];
+    mpScanPrior = new (std::nothrow) BYTE[ mnScansize ];
+
+    if ( !mpInflateInBuf || !mpScanPrior )
+        return FALSE;
 
     // calculate target size from original size and the preview hint
     if( rPreviewSizeHint.Width() || rPreviewSizeHint.Height() )