Index on WID+memberID in SvxItemPropertySet::aCombineList

...instead of just WID.  For example when loading
caolan/sdrobject_getmergeditemset_null_ptr_dereference.sample (from the
crashtestdata files) under UBSan,

> #4  0x00007fffeeacde54 in SvxItemPropertySet::getPropertyValue(SfxItemPropertySimpleEntry const*) const (this=0x607001a356d0, pMap=0x604000ec2e60) at /home/sbergman/lo/core/editeng/source/uno/unoipset.cxx:219
> #5  0x00007fffda713cb9 in SvxShape::_getPropertyValue(rtl::OUString const&) (this=0x6150015d7980, PropertyName="CharUnderlineColor") at /home/sbergman/lo/core/svx/source/unodraw/unoshape.cxx:1775
> #6  0x00007fffda70dbe9 in SvxShape::getPropertyValue(rtl::OUString const&) (this=0x6150015d7980, PropertyName="CharUnderlineColor") at /home/sbergman/lo/core/svx/source/unodraw/unoshape.cxx:1721
> #7  0x00007fffda713f3e in non-virtual thunk to SvxShape::getPropertyValue(rtl::OUString const&) () at /home/sbergman/lo/core/instdir/program/libsvxcorelo.so
> #8  0x00007fff19e8cfa6 in SwXShape::_getPropAtAggrObj(rtl::OUString const&) (this=0x610000183540, _rPropertyName="CharUnderlineColor") at /home/sbergman/lo/core/sw/source/core/unocore/unodraw.cxx:1735
> #9  0x00007fff19e8b511 in SwXShape::getPropertyValue(rtl::OUString const&) (this=0x610000183540, rPropertyName="CharUnderlineColor") at /home/sbergman/lo/core/sw/source/core/unocore/unodraw.cxx:1665
[...]

would first store an Any with value sal_Int32 -1 (representing an RGBA
255/255/255/255 color) in aCombineList for property CharUnderlineColor with
WID = EE_CHAR_UNDERLINE = 4027 and member-ID = MID_TL_COLOR = 2, but then read
back out that Any for property CharUnderline with the same WID but member-ID =
MID_TL_STYLE = 1 and use it at

> include/svl/eitem.hxx:47:20: runtime error: load of value 4294967295, which is not a valid value for type 'FontLineStyle'
>  #0 in SfxEnumItem<FontLineStyle>::SetValue(FontLineStyle) at include/svl/eitem.hxx:47:20
>  #1 in SvxTextLineItem::PutValue(com::sun::star::uno::Any const&, unsigned char) at editeng/source/items/textitem.cxx:1016:13
>  #2 in SvxItemPropertySet::setPropertyValue(SfxItemPropertySimpleEntry const*, com::sun::star::uno::Any const&, SfxItemSet&, bool) at editeng/source/uno/unoipset.cxx:178:19
>  #3 in SvxItemPropertySet_setPropertyValue(SfxItemPropertySimpleEntry const*, com::sun::star::uno::Any const&, SfxItemSet&) at svx/source/unodraw/unoshape.cxx:4119:5
>  #4 in SvxItemPropertySet_ObtainSettingsFromPropertySet(SvxItemPropertySet const&, SfxItemSet&, com::sun::star::uno::Reference<com::sun::star::beans::XPropertySet> const&, SfxItemPropertyMap const*) at svx/source/unodraw/unoshape.cxx:638:29
>  #5 in SvxShape::ObtainSettingsFromPropertySet(SvxItemPropertySet const&) at svx/source/unodraw/unoshape.cxx:656:9
>  #6 in SvxShape::Create(SdrObject*, SvxDrawPage*) at svx/source/unodraw/unoshape.cxx:413:5
>  #7 in SvxShapeText::Create(SdrObject*, SvxDrawPage*) at svx/source/unodraw/unoshape.cxx:3867:15
>  #8 in SvxDrawPage::add(com::sun::star::uno::Reference<com::sun::star::drawing::XShape> const&) at svx/source/unodraw/unopage.cxx:234:13
>  #9 in SwXDrawPage::add(com::sun::star::uno::Reference<com::sun::star::drawing::XShape> const&) at sw/source/core/unocore/unodraw.cxx:597:19
>  #10 in SwXShape::attach(com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) at sw/source/core/unocore/unodraw.cxx:2056:22
[...]

Change-Id: Ic0cf34440507c768b13d1b5b957425d6a43271ac
Reviewed-on: https://gerrit.libreoffice.org/74635
Tested-by: Jenkins
Reviewed-by: Thorsten Behrens <Thorsten.Behrens@CIB.de>

1 files changed, 11 insertions, 8 deletions

diff --git a/editeng/source/uno/unoipset.cxx b/editeng/source/uno/unoipset.cxx
index 8c76af4c45f6..aa6f310c1987 100644
--- a/editeng/source/uno/unoipset.cxx
+++ b/editeng/source/uno/unoipset.cxx
@@ -37,6 +37,7 @@ using namespace ::com::sun::star;
 struct SvxIDPropertyCombine
 {
     sal_uInt16  nWID;
+    sal_uInt8   memberId;
     uno::Any    aAny;
 };
 
@@ -54,21 +55,23 @@ SvxItemPropertySet::~SvxItemPropertySet()
 }
 
 
-uno::Any* SvxItemPropertySet::GetUsrAnyForID(sal_uInt16 nWID) const
+uno::Any* SvxItemPropertySet::GetUsrAnyForID(SfxItemPropertySimpleEntry const & entry) const
 {
     for (auto const & pActual : aCombineList)
     {
-        if( pActual->nWID == nWID )
+        if( pActual->nWID == entry.nWID && pActual->memberId == entry.nMemberId )
             return &pActual->aAny;
     }
     return nullptr;
 }
 
 
-void SvxItemPropertySet::AddUsrAnyForID(const uno::Any& rAny, sal_uInt16 nWID)
+void SvxItemPropertySet::AddUsrAnyForID(
+    const uno::Any& rAny, SfxItemPropertySimpleEntry const & entry)
 {
     std::unique_ptr<SvxIDPropertyCombine> pNew(new SvxIDPropertyCombine);
-    pNew->nWID = nWID;
+    pNew->nWID = entry.nWID;
+    pNew->memberId = entry.nMemberId;
     pNew->aAny = rAny;
     aCombineList.push_back( std::move(pNew) );
 }
@@ -187,7 +190,7 @@ void SvxItemPropertySet::setPropertyValue( const SfxItemPropertySimpleEntry* pMa
 uno::Any SvxItemPropertySet::getPropertyValue( const SfxItemPropertySimpleEntry* pMap ) const
 {
     // Already entered a value? Then finish quickly
-    uno::Any* pUsrAny = GetUsrAnyForID(pMap->nWID);
+    uno::Any* pUsrAny = GetUsrAnyForID(*pMap);
     if(pUsrAny)
         return *pUsrAny;
 
@@ -213,7 +216,7 @@ uno::Any SvxItemPropertySet::getPropertyValue( const SfxItemPropertySimpleEntry*
         if(eState >= SfxItemState::DEFAULT && pItem)
         {
             pItem->QueryValue( aVal, nMemberId );
-            const_cast<SvxItemPropertySet*>(this)->AddUsrAnyForID(aVal, pMap->nWID);
+            const_cast<SvxItemPropertySet*>(this)->AddUsrAnyForID(aVal, *pMap);
         }
     }
 
@@ -238,9 +241,9 @@ uno::Any SvxItemPropertySet::getPropertyValue( const SfxItemPropertySimpleEntry*
 
 void SvxItemPropertySet::setPropertyValue( const SfxItemPropertySimpleEntry* pMap, const uno::Any& rVal ) const
 {
-    uno::Any* pUsrAny = GetUsrAnyForID(pMap->nWID);
+    uno::Any* pUsrAny = GetUsrAnyForID(*pMap);
     if(!pUsrAny)
-        const_cast<SvxItemPropertySet*>(this)->AddUsrAnyForID(rVal, pMap->nWID);
+        const_cast<SvxItemPropertySet*>(this)->AddUsrAnyForID(rVal, *pMap);
     else
         *pUsrAny = rVal;
 }