forcepoint#108 sw: prevent creating SwRangeRedline anchored in itself

the SwRangeRedline in frame #8 triggers deleting itself at frame #0
which repeats the DeleteSection attempt which is already in progress

 #0  SwRangeRedline::~SwRangeRedline() (this=0x5335300) at sw/source/core/doc/docredln.cxx:1168
 #1  0x00007fffc9b91aab in SwRedlineTable::DeleteAndDestroy(unsigned long) (this=0x4f388f8, nP=0) at sw/source/core/doc/docredln.cxx:669
 #2  0x00007fffc9c8454a in sw::DocumentRedlineManager::DeleteRedline(SwPaM const&, bool, RedlineType) (this=0x4f388e0, rRange=SwPaM = {...}, bSaveInUndo=true, nDelType=RedlineType::Any)
     at sw/source/core/doc/DocumentRedlineManager.cxx:2578
 #3  0x00007fffc9c84a2f in sw::DocumentRedlineManager::DeleteRedline(SwStartNode const&, bool, RedlineType) (this=0x4f388e0, rNode=..., bSaveInUndo=true, nDelType=RedlineType::Any)
     at sw/source/core/doc/DocumentRedlineManager.cxx:2676
 #4  0x00007fffc9c1c57f in sw::DocumentContentOperationsManager::DeleteSection(SwNode*) (this=0x4f3b460, pNode=0x5331780) at sw/source/core/doc/DocumentContentOperationsManager.cxx:2092
 #5  0x00007fffc9cbfea7 in sw::DocumentLayoutManager::DelLayoutFormat(SwFrameFormat*) (this=0x4edad40, pFormat=0x53318b0) at sw/source/core/doc/DocumentLayoutManager.cxx:285
 #6  0x00007fffc9a9abd2 in DelFlyInRange(SwNode&, SwNode&, SwContentIndex const*, SwContentIndex const*) (rMkNd=..., rPtNd=..., pMkIdx=0x0, pPtIdx=0x0) at sw/source/core/doc/docedt.cxx:254
 #7  0x00007fffc9c1c53d in sw::DocumentContentOperationsManager::DeleteSection(SwNode*) (this=0x4f3b460, pNode=0x532a1f0) at sw/source/core/doc/DocumentContentOperationsManager.cxx:2091
 #8  0x00007fffc9b965f7 in SwRangeRedline::MoveFromSection(unsigned long) (this=0x5335300, nMyPos=0) at sw/source/core/doc/docredln.cxx:1834
 #9  0x00007fffc9b951f8 in SwRangeRedline::Show(unsigned short, unsigned long, bool) (this=0x5335300, nLoop=1, nMyPos=0, bForced=false) at sw/source/core/doc/docredln.cxx:1277
 #10 0x00007fffc9c7d64b in sw::DocumentRedlineManager::SetRedlineFlags(RedlineFlags) (this=0x4f388e0, eMode=RedlineFlags::ShowMask) at sw/source/core/doc/DocumentRedlineManager.cxx:1149
 #11 0x00007fffcb129668 in SwXTextDocument::setPropertyValue(rtl::OUString const&, com::sun::star::uno::Any const&) (this=0x4f52730, rPropertyName="ShowChanges", aValue=uno::Any("boolean": 1 '\001'))
     at sw/source/uibase/uno/unotxdoc.cxx:1795
 #12 0x00007fffcab7ce8d in XMLRedlineImportHelper::~XMLRedlineImportHelper() (this=0x52792f0) at sw/source/filter/xml/XMLRedlineImportHelper.cxx:341
 #13 0x00007fffcac2366d in SwXMLTextImportHelper::~SwXMLTextImportHelper() (this=0x527cae0) at sw/source/filter/xml/xmltexti.cxx:157
 #14 0x00007fffcac236a9 in SwXMLTextImportHelper::~SwXMLTextImportHelper() (this=0x527cae0) at sw/source/filter/xml/xmltexti.cxx:152
 #15 0x00007fffea9d5ee2 in salhelper::SimpleReferenceObject::release() (this=0x527cae0) at include/salhelper/simplereferenceobject.hxx:76
 #16 0x00007fffeabc2619 in rtl::Reference<XMLTextImportHelper>::clear() (this=0x525cd60) at include/rtl/ref.hxx:196
 #17 0x00007fffeabb07e0 in SvXMLImport::cleanup() (this=0x525ccd0) at xmloff/source/core/xmlimp.cxx:458
 #18 0x00007fffeabb08bf in SvXMLImport::~SvXMLImport() (this=0x525ccd0) at xmloff/source/core/xmlimp.cxx:464

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138191
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
(cherry picked from commit a8b3953531035bf93306ed90142c4172cc32ac43)

forcepoint#108 sw: tweak a bit
* the fly-at-fly case didn't work, iteration also skips it
* delete the bad redline section in the nodes array

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138434
Tested-by: Jenkins
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
(cherry picked from commit 477e489e71b4a96ff10d9f2d2b802d91dec3e319)

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/138289
Tested-by: Jenkins
Reviewed-by: Thorsten Behrens <thorsten.behrens@allotropia.de>
(cherry picked from commit 2d16f0639b74bcc9328fbb77f774cf9141d1675b)

Change-Id: I640874df3fd10af935cf05df707d45bea2c9fd6e

3 files changed, 168 insertions, 1 deletions

diff --git a/sw/qa/extras/odfimport/data/forcepoint108.fodt b/sw/qa/extras/odfimport/data/forcepoint108.fodt
new file mode 100644
index 000000000000..4328ea65f61d
--- /dev/null
+++ b/sw/qa/extras/odfimport/data/forcepoint108.fodt
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<office:document xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" xmlns:style="urn:oasis:names:tc:opendocument:xmlns:style:1.0" xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0" xmlns:table="urn:oasis:names:tc:opendocument:xmlns:table:1.0" xmlns:draw="urn:oasis:names:tc:opendocument:xmlns:drawing:1.0" xmlns:fo="urn:oasis:names:tc:opendocument:xmlns:xsl-fo-compatible:1.0" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:meta="urn:oasis:names:tc:opendocument:xmlns:meta:1.0" xmlns:number="urn:oasis:names:tc:opendocument:xmlns:datastyle:1.0" xmlns:svg="urn:oasis:names:tc:opendocument:xmlns:svg-compatible:1.0" xmlns:chart="urn:oasis:names:tc:opendocument:xmlns:chart:1.0" xmlns:dr3d="urn:oasis:names:tc:opendocument:xmlns:dr3d:1.0" xmlns:math="http://www.w3.org/1998/Math/MathML" xmlns:form="urn:oasis:names:tc:opendocument:xmlns:form:1.0" xmlns:script="urn:oasis:names:tc:opendocument:xmlns:script:1.0" xmlns:config="urn:oasis:names:tc:opendocument:xmlns:config:1.0" xmlns:ooo="http://openoffice.org/2004/office" xmlns:ooow="http://openoffice.org/2004/writer" xmlns:oooc="http://openoffice.org/2004/calc" xmlns:dom="http://www.w3.org/2001/xml-events" xmlns:xforms="http://www.w3.org/2002/xforms" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:rpt="http://openoffice.org/2005/report" xmlns:of="urn:oasis:names:tc:opendocument:xmlns:of:1.2" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:grddl="http://www.w3.org/2003/g/data-view#" xmlns:officeooo="http://openoffice.org/2009/office" xmlns:tableooo="http://openoffice.org/2009/table" xmlns:drawooo="http://openoffice.org/2010/draw" xmlns:calcext="urn:org:documentfoundation:names:experimental:calc:xmlns:calcext:1.0" xmlns:loext="urn:org:documentfoundation:names:experimental:office:xmlns:loext:1.0" xmlns:field="urn:openoffice:names:experimental:ooo-ms-interop:xmlns:field:1.0" xmlns:formx="urn:openoffice:names:experimental:ooxml-odf-interop:xmlns:form:1.0" xmlns:css3t="http://www.w3.org/TR/css3-text/" office:version="1.2" office:mimetype="application/vnd.oasis.opendocument.text">
+ <office:meta><meta:initial-creator>ms </meta:initial-creator><meta:creation-date>2015-08-24T21:49:45.305718699</meta:creation-date><meta:document-statistic meta:table-count="0" meta:image-count="0" meta:object-count="0" meta:page-count="1" meta:paragraph-count="0" meta:word-count="0" meta:character-count="0" meta:non-whitespace-character-count="0"/><meta:generator>LibreOfficeDev/4.3.7.2$Linux_X86_64 LibreOffice_project/8a35821d8636a03b8bf4e15b48f59794652c68ba</meta:generator></office:meta>
+ <office:font-face-decls>
+  <style:font-face style:name="Lohit Devanagari1" svg:font-family="&apos;Lohit Devanagari&apos;"/>
+  <style:font-face style:name="Liberation Serif" svg:font-family="&apos;Liberation Serif&apos;" style:font-family-generic="roman" style:font-pitch="variable"/>
+  <style:font-face style:name="Liberation Sans" svg:font-family="&apos;Liberation Sans&apos;" style:font-family-generic="swiss" style:font-pitch="variable"/>
+  <style:font-face style:name="Lohit Devanagari" svg:font-family="&apos;Lohit Devanagari&apos;" style:font-family-generic="system" style:font-pitch="variable"/>
+  <style:font-face style:name="Source Han Sans CN Regular" svg:font-family="&apos;Source Han Sans CN Regular&apos;" style:font-family-generic="system" style:font-pitch="variable"/>
+ </office:font-face-decls>
+ <office:styles>
+  <style:default-style style:family="graphic">
+   <style:graphic-properties svg:stroke-color="#3465a4" draw:fill-color="#729fcf" fo:wrap-option="no-wrap" draw:shadow-offset-x="0.3cm" draw:shadow-offset-y="0.3cm" draw:start-line-spacing-horizontal="0.283cm" draw:start-line-spacing-vertical="0.283cm" draw:end-line-spacing-horizontal="0.283cm" draw:end-line-spacing-vertical="0.283cm" style:flow-with-text="false"/>
+   <style:paragraph-properties style:text-autospace="ideograph-alpha" style:line-break="strict" style:writing-mode="lr-tb" style:font-independent-line-spacing="false">
+    <style:tab-stops/>
+   </style:paragraph-properties>
+   <style:text-properties style:use-window-font-color="true" style:font-name="Liberation Serif" fo:font-size="12pt" fo:language="de" fo:country="DE" style:letter-kerning="true" style:font-name-asian="Source Han Sans CN Regular" style:font-size-asian="10.5pt" style:language-asian="zh" style:country-asian="CN" style:font-name-complex="Lohit Devanagari" style:font-size-complex="12pt" style:language-complex="hi" style:country-complex="IN"/>
+  </style:default-style>
+  <style:default-style style:family="paragraph">
+   <style:paragraph-properties fo:hyphenation-ladder-count="no-limit" style:text-autospace="ideograph-alpha" style:punctuation-wrap="hanging" style:line-break="strict" style:tab-stop-distance="1.251cm" style:writing-mode="page"/>
+   <style:text-properties style:use-window-font-color="true" style:font-name="Liberation Serif" fo:font-size="12pt" fo:language="de" fo:country="DE" style:letter-kerning="true" style:font-name-asian="Source Han Sans CN Regular" style:font-size-asian="10.5pt" style:language-asian="zh" style:country-asian="CN" style:font-name-complex="Lohit Devanagari" style:font-size-complex="12pt" style:language-complex="hi" style:country-complex="IN" fo:hyphenate="false" fo:hyphenation-remain-char-count="2" fo:hyphenation-push-char-count="2"/>
+  </style:default-style>
+  <style:default-style style:family="table">
+   <style:table-properties table:border-model="collapsing"/>
+  </style:default-style>
+  <style:default-style style:family="table-row">
+   <style:table-row-properties fo:keep-together="auto"/>
+  </style:default-style>
+  <style:style style:name="Standard" style:family="paragraph" style:class="text"/>
+ </office:styles>
+ <office:automatic-styles>
+  <style:page-layout style:name="pm1">
+   <style:page-layout-properties fo:page-width="21.001cm" fo:page-height="29.7cm" style:num-format="1" style:print-orientation="portrait" fo:margin-top="2cm" fo:margin-bottom="2cm" fo:margin-left="2cm" fo:margin-right="2cm" style:writing-mode="lr-tb" style:footnote-max-height="0cm">
+    <style:footnote-sep style:width="0.018cm" style:distance-before-sep="0.101cm" style:distance-after-sep="0.101cm" style:line-style="solid" style:adjustment="left" style:rel-width="25%" style:color="#000000"/>
+   </style:page-layout-properties>
+   <style:header-style/>
+   <style:footer-style/>
+  </style:page-layout>
+
+  <style:style style:name="P1" style:family="paragraph" style:parent-style-name="Standard">
+    <style:text-properties officeooo:rsid="000b01fe" officeooo:paragraph-rsid="000b01fe"/>
+  </style:style>
+  <style:style style:name="P2" style:family="paragraph" style:parent-style-name="Standard">
+    <style:text-properties officeooo:rsid="000b01fe" officeooo:paragraph-rsid="000b01fe"/>
+  </style:style>
+  <style:style style:name="fr1" style:family="graphic" style:parent-style-name="Frame">
+    <style:graphic-properties style:vertical-pos="top" style:vertical-rel="paragraph-content" style:horizontal-pos="center" style:horizontal-rel="paragraph"/>
+  </style:style>
+ </office:automatic-styles>
+ <office:master-styles>
+  <style:master-page style:name="Standard" style:page-layout-name="pm1"/>
+ </office:master-styles>
+ <office:body>
+  <office:text>
+
+      <text:tracked-changes>
+        <text:changed-region xml:id="ct58510944" text:id="ct58510944">
+          <text:deletion>
+            <office:change-info>
+              <dc:creator>ms </dc:creator>
+              <dc:date>2015-09-10T15:36:00</dc:date>
+            </office:change-info>
+            <text:p text:style-name="P1"><draw:frame draw:style-name="fr1" draw:name="Frame1" text:anchor-type="char" svg:width="2cm" draw:z-index="-0"><draw:text-box fo:min-height="1.158cm"><text:p text:style-name="P1">foo<text:change text:change-id="ct58510944"/></text:p>
+
+  </office:text>
+ </office:body>
diff --git a/sw/qa/extras/odfimport/odfimport.cxx b/sw/qa/extras/odfimport/odfimport.cxx
index 9ee4f206f5a5..5146f7f7b79f 100644
--- a/sw/qa/extras/odfimport/odfimport.cxx
+++ b/sw/qa/extras/odfimport/odfimport.cxx
@@ -34,10 +34,12 @@
 typedef std::map<OUString, css::uno::Sequence< css::table::BorderLine> > AllBordersMap;
 typedef std::pair<OUString, css::uno::Sequence< css::table::BorderLine> > StringSequencePair;
 
+char const DATA_DIRECTORY[] = "/sw/qa/extras/odfimport/data/";
+
 class Test : public SwModelTestBase
 {
     public:
-        Test() : SwModelTestBase("/sw/qa/extras/odfimport/data/", "writer8") {}
+        Test() : SwModelTestBase(DATA_DIRECTORY, "writer8") {}
 };
 
 DECLARE_ODFIMPORT_TEST(testEmptySvgFamilyName, "empty-svg-family-name.odt")
@@ -926,5 +928,21 @@ DECLARE_ODFIMPORT_TEST(testTdf123829, "tdf123829.odt")
         pDoc->getIDocumentSettingAccess().get(DocumentSettingId::COLLAPSE_EMPTY_CELL_PARA));
 }
 
+class testForcepoint108 : public Test
+{
+    CPPUNIT_TEST_SUITE(testForcepoint108);
+    CPPUNIT_TEST(test);
+    CPPUNIT_TEST_SUITE_END();
+    void test();
+    CPPUNIT_TEST_SUITE_REGISTRATION(testForcepoint108);
+};
+// just care that it doesn't crash/assert
+void testForcepoint108::test()
+{
+    //load would assert because it fails to load entirely, like testMathMalformedXml
+    OUString aURL = m_directories.getURLFromSrc(DATA_DIRECTORY) + "forcepoint108.fodt";
+    mxComponent = mxDesktop->loadComponentFromURL(aURL, "_default", 0, {});
+}
+
 CPPUNIT_PLUGIN_IMPLEMENT();
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/sw/source/filter/xml/XMLRedlineImportHelper.cxx b/sw/source/filter/xml/XMLRedlineImportHelper.cxx
index 250a31688151..15e6651661b3 100644
--- a/sw/source/filter/xml/XMLRedlineImportHelper.cxx
+++ b/sw/source/filter/xml/XMLRedlineImportHelper.cxx
@@ -31,6 +31,10 @@
 #include <IDocumentStylePoolAccess.hxx>
 #include <tools/datetime.hxx>
 #include <poolfmt.hxx>
+#include <fmtanchr.hxx>
+#include <ftnidx.hxx>
+#include <txtftn.hxx>
+#include <ndtxt.hxx>
 #include <unoredline.hxx>
 #include <o3tl/any.hxx>
 #include <xmloff/xmltoken.hxx>
@@ -562,6 +566,73 @@ inline bool XMLRedlineImportHelper::IsReady(RedlineInfo* pRedline)
              !pRedline->bNeedsAdjustment );
 }
 
+/// recursively check if rPos or its anchor (if in fly or footnote) is in redline section
+static auto RecursiveContains(SwStartNode const& rRedlineSection, SwNode const& rPos) -> bool
+{
+    if (rRedlineSection.GetIndex() <= rPos.GetIndex()
+        && rPos.GetIndex() <= rRedlineSection.EndOfSectionIndex())
+    {
+        return true;
+    }
+    // loop to iterate "up" in the node tree and find an anchored XText
+    for (SwStartNode const* pStartNode = rPos.StartOfSectionNode();
+        pStartNode != nullptr && pStartNode->GetIndex() != 0;
+        pStartNode = pStartNode->StartOfSectionNode())
+    {
+        switch (pStartNode->GetStartNodeType())
+        {
+            case SwNormalStartNode:
+            case SwTableBoxStartNode:
+                continue;
+            break;
+            case SwFlyStartNode:
+            {
+                SwFrameFormat const*const pFormat(pStartNode->GetFlyFormat());
+                assert(pFormat);
+                SwFormatAnchor const& rAnchor(pFormat->GetAnchor());
+                if (rAnchor.GetAnchorId() == RndStdIds::FLY_AT_PAGE)
+                {
+                    return false;
+                }
+                else if (rAnchor.GetAnchorId() == RndStdIds::FLY_AT_FLY)
+                {   // anchor is on a start node, avoid skipping it:
+                    pStartNode = rAnchor.GetContentAnchor()->nNode.GetNode().GetStartNode();
+                    assert(pStartNode);
+                    // pass the next node to recursive call - it will call
+                    // call StartOfSectionNode on it and go back to pStartNode
+                    SwNodeIndex const next(*pStartNode, +1);
+                    return RecursiveContains(rRedlineSection, next.GetNode());
+                }
+                else
+                {
+                    return RecursiveContains(rRedlineSection, rAnchor.GetContentAnchor()->nNode.GetNode());
+                }
+            }
+            break;
+            case SwFootnoteStartNode:
+            {   // sigh ... need to search
+                for (SwTextFootnote const*const pFootnote : rRedlineSection.GetDoc()->GetFootnoteIdxs())
+                {
+                    if (pStartNode == pFootnote->GetStartNode()->GetNode().GetStartNode())
+                    {
+                        return RecursiveContains(rRedlineSection, pFootnote->GetTextNode());
+                    }
+                }
+                assert(false);
+            }
+            break;
+            case SwHeaderStartNode:
+            case SwFooterStartNode:
+                return false; // headers aren't anchored
+            break;
+            default:
+                assert(false);
+            break;
+        }
+    }
+    return false;
+}
+
 void XMLRedlineImportHelper::InsertIntoDocument(RedlineInfo* pRedlineInfo)
 {
     OSL_ENSURE(nullptr != pRedlineInfo, "need redline info");
@@ -631,6 +702,17 @@ void XMLRedlineImportHelper::InsertIntoDocument(RedlineInfo* pRedlineInfo)
             }
         }
     }
+    else if (pRedlineInfo->pContentIndex != nullptr
+        // should be enough to check 1 position of aPaM bc CheckNodesRange() above
+        && RecursiveContains(*pRedlineInfo->pContentIndex->GetNode().GetStartNode(), aPaM.GetPoint()->nNode.GetNode()))
+    {
+        SAL_WARN("sw.xml", "Recursive change tracking, removing");
+        // reuse aPaM to remove it from nodes that will be deleted
+        *aPaM.GetPoint() = SwPosition(pRedlineInfo->pContentIndex->GetNode());
+        aPaM.SetMark();
+        *aPaM.GetMark() = SwPosition(*pRedlineInfo->pContentIndex->GetNode().EndOfSectionNode());
+        pDoc->getIDocumentContentOperations().DeleteRange(aPaM);
+    }
     else
     {
         // regular file loading: insert redline