OperationSmiley: Secured quite some places using CustomShape

Changed quite some places of SdrObjCustomShape usage to use
references instead of pointers, thus forcing to more secure
handling. Changed some test and change methods, even found a
memory leak by doing so.

Change-Id: Iba76037a3c54af50bb05e6bd63d7ad04624665a7

2 files changed, 31 insertions, 26 deletions

diff --git a/oox/source/export/drawingml.cxx b/oox/source/export/drawingml.cxx
index 931f77e91a31..bf10bf23febc 100644
--- a/oox/source/export/drawingml.cxx
+++ b/oox/source/export/drawingml.cxx
@@ -2601,7 +2601,9 @@ void DrawingML::WritePresetShape( const char* pShape, MSO_SPT eShapeType, bool b
     mpFS->endElementNS(  XML_a, XML_prstGeom );
 }
 
-bool DrawingML::WriteCustomGeometry( const Reference< XShape >& rXShape, const SdrObjCustomShape* pShape )
+bool DrawingML::WriteCustomGeometry(
+    const Reference< XShape >& rXShape,
+    const SdrObjCustomShape& rSdrObjCustomShape)
 {
     uno::Reference< beans::XPropertySet > aXPropSet;
     uno::Any aAny( rXShape->queryInterface(cppu::UnoType<beans::XPropertySet>::get()));
@@ -2701,8 +2703,8 @@ bool DrawingML::WriteCustomGeometry( const Reference< XShape >& rXShape, const S
 
                     for ( int j = 0; j < aPairs.getLength(); ++j )
                     {
-                        sal_Int32 nX = GetCustomGeometryPointValue(aPairs[j].First, pShape);
-                        sal_Int32 nY = GetCustomGeometryPointValue(aPairs[j].Second, pShape);
+                        sal_Int32 nX = GetCustomGeometryPointValue(aPairs[j].First, rSdrObjCustomShape);
+                        sal_Int32 nY = GetCustomGeometryPointValue(aPairs[j].Second, rSdrObjCustomShape);
                         if (nX < nXMin)
                             nXMin = nX;
                         if (nY < nYMin)
@@ -2733,7 +2735,7 @@ bool DrawingML::WriteCustomGeometry( const Reference< XShape >& rXShape, const S
                             case drawing::EnhancedCustomShapeSegmentCommand::MOVETO :
                             {
                                 mpFS->startElementNS( XML_a, XML_moveTo, FSEND );
-                                WriteCustomGeometryPoint(aPairs[nPairIndex], pShape);
+                                WriteCustomGeometryPoint(aPairs[nPairIndex], rSdrObjCustomShape);
                                 mpFS->endElementNS( XML_a, XML_moveTo );
                                 nPairIndex++;
                                 break;
@@ -2741,7 +2743,7 @@ bool DrawingML::WriteCustomGeometry( const Reference< XShape >& rXShape, const S
                             case drawing::EnhancedCustomShapeSegmentCommand::LINETO :
                             {
                                 mpFS->startElementNS( XML_a, XML_lnTo, FSEND );
-                                WriteCustomGeometryPoint(aPairs[nPairIndex], pShape);
+                                WriteCustomGeometryPoint(aPairs[nPairIndex], rSdrObjCustomShape);
                                 mpFS->endElementNS( XML_a, XML_lnTo );
                                 nPairIndex++;
                                 break;
@@ -2751,7 +2753,7 @@ bool DrawingML::WriteCustomGeometry( const Reference< XShape >& rXShape, const S
                                 mpFS->startElementNS( XML_a, XML_cubicBezTo, FSEND );
                                 for( sal_uInt8 l = 0; l <= 2; ++l )
                                 {
-                                    WriteCustomGeometryPoint(aPairs[nPairIndex+l], pShape);
+                                    WriteCustomGeometryPoint(aPairs[nPairIndex+l], rSdrObjCustomShape);
                                 }
                                 mpFS->endElementNS( XML_a, XML_cubicBezTo );
                                 nPairIndex += 3;
@@ -2782,7 +2784,7 @@ bool DrawingML::WriteCustomGeometry( const Reference< XShape >& rXShape, const S
                                 mpFS->startElementNS( XML_a, XML_quadBezTo, FSEND );
                                 for( sal_uInt8 l = 0; l < 2; ++l )
                                 {
-                                    WriteCustomGeometryPoint(aPairs[nPairIndex+l], pShape);
+                                    WriteCustomGeometryPoint(aPairs[nPairIndex+l], rSdrObjCustomShape);
                                 }
                                 mpFS->endElementNS( XML_a, XML_quadBezTo );
                                 nPairIndex += 2;
@@ -2809,10 +2811,12 @@ bool DrawingML::WriteCustomGeometry( const Reference< XShape >& rXShape, const S
     return false;
 }
 
-void DrawingML::WriteCustomGeometryPoint(const drawing::EnhancedCustomShapeParameterPair& rParamPair, const SdrObjCustomShape* pShape)
+void DrawingML::WriteCustomGeometryPoint(
+    const drawing::EnhancedCustomShapeParameterPair& rParamPair,
+    const SdrObjCustomShape& rSdrObjCustomShape)
 {
-    sal_Int32 nX = GetCustomGeometryPointValue(rParamPair.First, pShape);
-    sal_Int32 nY = GetCustomGeometryPointValue(rParamPair.Second, pShape);
+    sal_Int32 nX = GetCustomGeometryPointValue(rParamPair.First, rSdrObjCustomShape);
+    sal_Int32 nY = GetCustomGeometryPointValue(rParamPair.Second, rSdrObjCustomShape);
 
     mpFS->singleElementNS( XML_a, XML_pt,
         XML_x, OString::number(nX).getStr(),
@@ -2820,18 +2824,15 @@ void DrawingML::WriteCustomGeometryPoint(const drawing::EnhancedCustomShapeParam
         FSEND );
 }
 
-sal_Int32 DrawingML::GetCustomGeometryPointValue(const css::drawing::EnhancedCustomShapeParameter& rParam, const SdrObjCustomShape* pShape)
+sal_Int32 DrawingML::GetCustomGeometryPointValue(
+    const css::drawing::EnhancedCustomShapeParameter& rParam,
+    const SdrObjCustomShape& rSdrObjCustomShape)
 {
-    sal_Int32 nValue = 0;
-    if(pShape)
-    {
-        const EnhancedCustomShape2d aCustoShape2d (const_cast<SdrObjCustomShape*>(pShape));
-        double fValue = 0.0;
-        aCustoShape2d.GetParameter(fValue, rParam, false, false);
-        nValue = std::lround(fValue);
-    }
-    else
-        rParam.Value >>= nValue;
+    const EnhancedCustomShape2d aCustoShape2d(const_cast< SdrObjCustomShape& >(rSdrObjCustomShape));
+    double fValue = 0.0;
+    aCustoShape2d.GetParameter(fValue, rParam, false, false);
+    sal_Int32 nValue(std::lround(fValue));
+
     return nValue;
 }
 
diff --git a/oox/source/export/shapes.cxx b/oox/source/export/shapes.cxx
index 97e1368f4368..c52c6a62b3cb 100644
--- a/oox/source/export/shapes.cxx
+++ b/oox/source/export/shapes.cxx
@@ -729,8 +729,12 @@ ShapeExport& ShapeExport::WriteCustomShape( const Reference< XShape >& xShape )
     OUString sShapeType;
     ShapeFlag nMirrorFlags = ShapeFlag::NONE;
     MSO_SPT eShapeType = EscherPropertyContainer::GetCustomShapeType( xShape, nMirrorFlags, sShapeType );
-    SdrObjCustomShape* pShape = static_cast<SdrObjCustomShape*>( GetSdrObjectFromXShape( xShape ) );
-    bool bIsDefaultObject = EscherPropertyContainer::IsDefaultObject( pShape, eShapeType );
+    OSL_ENSURE(nullptr != dynamic_cast< SdrObjCustomShape* >(GetSdrObjectFromXShape(xShape)), "Not a SdrObjCustomShape (!)");
+    SdrObjCustomShape& rSdrObjCustomShape(static_cast< SdrObjCustomShape& >(*GetSdrObjectFromXShape(xShape)));
+    const bool bIsDefaultObject(
+        EscherPropertyContainer::IsDefaultObject(
+            rSdrObjCustomShape,
+            eShapeType));
     const char* sPresetShape = msfilter::util::GetOOXMLPresetGeometry( USS( sShapeType ) );
     SAL_INFO("oox.shape", "custom shape type: " << sShapeType << " ==> " << sPresetShape);
     Sequence< PropertyValue > aGeometrySeq;
@@ -845,10 +849,10 @@ ShapeExport& ShapeExport::WriteCustomShape( const Reference< XShape >& xShape )
     else if( bHasHandles )
         bCustGeom = true;
 
-    if (bHasHandles && bCustGeom && pShape)
+    if (bHasHandles && bCustGeom)
     {
         WriteShapeTransformation( xShape, XML_a, bFlipH, bFlipV, false, true );// do not flip, polypolygon coordinates are flipped already
-        tools::PolyPolygon aPolyPolygon( pShape->GetLineGeometry(true) );
+        tools::PolyPolygon aPolyPolygon( rSdrObjCustomShape.GetLineGeometry(true) );
         sal_Int32 nRotation = 0;
         // The RotateAngle property's value is independent from any flipping, and that's exactly what we need here.
         uno::Reference<beans::XPropertySet> xPropertySet(xShape, uno::UNO_QUERY);
@@ -864,7 +868,7 @@ ShapeExport& ShapeExport::WriteCustomShape( const Reference< XShape >& xShape )
     else if (bCustGeom)
     {
         WriteShapeTransformation( xShape, XML_a, bFlipH, bFlipV );
-        bool bSuccess = WriteCustomGeometry( xShape, pShape );
+        bool bSuccess = WriteCustomGeometry(xShape, rSdrObjCustomShape);
         if (!bSuccess)
             WritePresetShape( sPresetShape );
     }