tdf#78506 RTF import: fix handling of invalid \levelnumbers

In case ';' is written in \u form in \levelnumbers, then Word ignores the whole
\levelnumbers contents, do the same.

(cherry picked from commit 428a1da60b88415e7db21353a42bed85b8b76ed9)

Change-Id: I93ce5810af2b5ed703e804199c0b236d2c4c36b5
Reviewed-on: https://gerrit.libreoffice.org/27873
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

3 files changed, 23 insertions, 2 deletions

diff --git a/writerfilter/source/rtftok/rtfdispatchvalue.cxx b/writerfilter/source/rtftok/rtfdispatchvalue.cxx
index 4302f27afc25..dfd9dff99d06 100644
--- a/writerfilter/source/rtftok/rtfdispatchvalue.cxx
+++ b/writerfilter/source/rtftok/rtfdispatchvalue.cxx
@@ -627,6 +627,9 @@ RTFError RTFDocumentImpl::dispatchValue(RTFKeyword nKeyword, int nParam)
             {
                 if (nParam != ';')
                     m_aStates.top().aLevelNumbers.push_back(sal_Int32(nParam));
+                else
+                    // ';' in \u form is not considered valid.
+                    m_aStates.top().bLevelNumbersValid = false;
             }
             else
                 m_aUnicodeBuffer.append(static_cast<sal_Unicode>(nParam));
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
index 9dc5f7915414..8268a2f05ef5 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
@@ -2004,11 +2004,16 @@ RTFError RTFDocumentImpl::popState()
     }
     break;
     case Destination::LEVELNUMBERS:
-        if (aState.aTableSprms.find(NS_ooxml::LN_CT_Lvl_lvlText))
+    {
+        bool bNestedLevelNumbers = false;
+        if (m_aStates.size() > 1)
+            // Current destination is levelnumbers and parent destination is levelnumbers as well.
+            bNestedLevelNumbers = m_aStates[m_aStates.size() - 2].eDestination == Destination::LEVELNUMBERS;
+        if (!bNestedLevelNumbers && aState.aTableSprms.find(NS_ooxml::LN_CT_Lvl_lvlText))
         {
             RTFSprms& rAttributes = aState.aTableSprms.find(NS_ooxml::LN_CT_Lvl_lvlText)->getAttributes();
             RTFValue::Pointer_t pValue = rAttributes.find(NS_ooxml::LN_CT_LevelText_val);
-            if (pValue)
+            if (pValue && aState.bLevelNumbersValid)
             {
                 OUString aOrig = pValue->getString();
 
@@ -2029,8 +2034,12 @@ RTFError RTFDocumentImpl::popState()
 
                 pValue->setString(aBuf.makeStringAndClear());
             }
+            else if (pValue)
+                // Have a value, but levelnumbers is not valid -> ignore it.
+                pValue->setString(OUString());
         }
         break;
+    }
     case Destination::SHAPEPROPERTYNAME:
         if (&m_aStates.top().aDestinationText != m_aStates.top().pDestinationText)
             break; // not for nested group
@@ -2911,7 +2920,13 @@ RTFError RTFDocumentImpl::popState()
         break;
     case Destination::LEVELNUMBERS:
         if (!m_aStates.empty())
+        {
             m_aStates.top().aTableSprms = aState.aTableSprms;
+            if (aState.eDestination == Destination::LEVELNUMBERS)
+                // Both current and parent state is levelnumbers: mark parent
+                // as invalid as well if necessary.
+                m_aStates.top().bLevelNumbersValid = aState.bLevelNumbersValid;
+        }
         break;
     case Destination::FIELDINSTRUCTION:
         if (!m_aStates.empty())
@@ -3168,6 +3183,7 @@ RTFParserState::RTFParserState(RTFDocumentImpl* pDocumentImpl)
       nListLevelNum(0),
       aListLevelEntries(),
       aLevelNumbers(),
+      bLevelNumbersValid(true),
       aPicture(),
       aShape(),
       aDrawingObject(),
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.hxx b/writerfilter/source/rtftok/rtfdocumentimpl.hxx
index 8f20e6b46955..88707378c9a9 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.hxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.hxx
@@ -258,6 +258,8 @@ public:
 
     /// List of character positions in leveltext to replace.
     std::vector<sal_Int32> aLevelNumbers;
+    /// If aLevelNumbers should be read at all.
+    bool bLevelNumbersValid;
 
     RTFPicture aPicture;
     RTFShape aShape;