fdo#49666 RTF import: fix crash on picture frame with shape text

The bugdoc contains a shape with type 75 (ESCHER_ShpInst_PictureFrame),
which also has a shape text. Looks like this is an RTF which is
generated by some 3rd-party tool: Word can open it, but it doesn't show
the text on the picture frame, either.

So, let's just ignore the shape text for picture frames at RTF import
time as well, that avoids the crash.

Change-Id: If673122eb16f4a4f7eddf107877fcfa7cb052821

2 files changed, 40 insertions, 9 deletions

diff --git a/writerfilter/qa/cppunittests/rtftok/data/pass/fdo49666.rtf b/writerfilter/qa/cppunittests/rtftok/data/pass/fdo49666.rtf
new file mode 100644
index 000000000000..5a673ca0461c
--- /dev/null
+++ b/writerfilter/qa/cppunittests/rtftok/data/pass/fdo49666.rtf
@@ -0,0 +1,13 @@
+{\rtf1 \ansi \ansicpg1252 \uc1 \deff1 \deflang1033 \deflangfe1033 
+{\shp 
+{\*\shpinst \shpleft144 \shptop490 \shpright2049 \shpbottom1840 \shpfhdr1 \shpbxcolumn \shpbypara \shpwr4 \shpwrk2 \shpfblwtxt1 \shpz0 \shplid2053 
+{\sp 
+{\sn shapeType}
+{\sv 75}
+}
+{\shptxt foo
+}
+}
+}
+\par
+}
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
index c0f14e40a595..eea949880a76 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
@@ -1466,18 +1466,36 @@ int RTFDocumentImpl::dispatchDestination(RTFKeyword nKeyword)
             break;
         case RTF_SHPTXT:
         case RTF_DPTXBXTEXT:
-            m_aStates.top().nDestinationState = DESTINATION_SHAPETEXT;
-            checkFirstRun();
-            dispatchFlag(RTF_PARD);
-            m_bNeedPap = true;
-            if (nKeyword == RTF_SHPTXT)
             {
-                if (!m_aStates.top().pCurrentBuffer)
-                    m_pSdrImport->resolve(m_aStates.top().aShape, false);
+                bool bPictureFrame = false;
+                for (size_t i = 0; i < m_aStates.top().aShape.aProperties.size(); ++i)
+                {
+                    std::pair<OUString, OUString>& rProperty = m_aStates.top().aShape.aProperties[i];
+                    if (rProperty.first == "shapeType" && rProperty.second == OUString::number(ESCHER_ShpInst_PictureFrame))
+                    {
+                        bPictureFrame = true;
+                        break;
+                    }
+                }
+                if (bPictureFrame)
+                    // Skip text on picture frames.
+                    m_aStates.top().nDestinationState = DESTINATION_SKIP;
                 else
                 {
-                    RTFValue::Pointer_t pValue(new RTFValue(m_aStates.top().aShape));
-                    m_aStates.top().pCurrentBuffer->push_back(make_pair(BUFFER_STARTSHAPE, pValue));
+                    m_aStates.top().nDestinationState = DESTINATION_SHAPETEXT;
+                    checkFirstRun();
+                    dispatchFlag(RTF_PARD);
+                    m_bNeedPap = true;
+                    if (nKeyword == RTF_SHPTXT)
+                    {
+                        if (!m_aStates.top().pCurrentBuffer)
+                            m_pSdrImport->resolve(m_aStates.top().aShape, false);
+                        else
+                        {
+                            RTFValue::Pointer_t pValue(new RTFValue(m_aStates.top().aShape));
+                            m_aStates.top().pCurrentBuffer->push_back(make_pair(BUFFER_STARTSHAPE, pValue));
+                        }
+                    }
                 }
             }
             break;