fdo#54612 don't crash on RTF_DPPTX before RTF_DPPOLYCOUNT

Change-Id: I35bf580df157dee429d9dca193945ea95616d678

3 files changed, 55 insertions, 6 deletions

diff --git a/sw/qa/extras/rtfimport/data/fdo54612.rtf b/sw/qa/extras/rtfimport/data/fdo54612.rtf
new file mode 100644
index 000000000000..3867d0edfe5b
--- /dev/null
+++ b/sw/qa/extras/rtfimport/data/fdo54612.rtf
@@ -0,0 +1,34 @@
+{\rtf 
+{\do\dobxpage\dobypage\dptxbx\dptxbxmar0 
+{\dptxbxtext\plain 
+\par}
+\dpx720\dpy1305\dpxsize10005\dpysize2910\dplinehollow0
+\dpfillpat0}
+{\do\dobxpage\dobypage\dpline\dpptx0\dppty0\dpptx9870\dppty0\dpx735\dpy4830
+\dpxsize9870\dpysize0\dplinesolid0\dplinecor0\dplinecog128\dplinecob128
+\dplinew30}
+{\do\dobxpage\dobypage\dptxbx\dptxbxmar0 
+{\dptxbxtext\plain\f1\fs36\b\ul 
+\par}
+\dpx4605\dpy4935\dpxsize2640\dpysize435\dplinehollow0\dpfillpat0
+}
+{\do\dobxpage\dobypage\dpline\dpptx0\dppty0\dpptx9870\dppty0\dpx735\dpy5550
+\dpxsize9870\dpysize0\dplinesolid0\dplinecor0\dplinecog128\dplinecob128
+\dplinew30}
+{\do\dobxpage\dobypage\dptxbx\dptxbxmar0 
+{\dptxbxtext\plain\f1\fs19\b 
+\par}
+\dpx3555\dpy5910\dpxsize2235\dpysize240\dplinehollow0
+\dpfillpat0}
+{\do\dobxpage\dobypage\dptxbx\dptxbxmar0 
+{\dptxbxtext\plain\f1\fs19\b 
+\par}
+\dpx3900\dpy6195\dpxsize1995\dpysize240\dplinehollow0
+\dpfillpat0}
+{\do\dobxpage\dobypage\dptxbx\dptxbxmar0 
+{\dptxbxtext\plain\f1\fs19
+\par}
+\dpx5835\dpy6195\dpxsize1245\dpysize240\dplinehollow0\dpfillpat0}
+{\do\dobxpage\dobypage\dpline\dpptx0\dppty0\dpptx3480\dppty0\dpx6720\dpy6765
+\dpxsize3480\dpysize0\dplinesolid0\dplinecor0\dplinecog0\dplinecob0\dplinew0}
+}
diff --git a/sw/qa/extras/rtfimport/rtfimport.cxx b/sw/qa/extras/rtfimport/rtfimport.cxx
index 37c4fa4791f8..be8c34de2aaf 100644
--- a/sw/qa/extras/rtfimport/rtfimport.cxx
+++ b/sw/qa/extras/rtfimport/rtfimport.cxx
@@ -133,6 +133,7 @@ public:
     void testFdo58076();
     void testFdo57678();
     void testFdo45183();
+    void testFdo54612();
 
     CPPUNIT_TEST_SUITE(Test);
 #if !defined(MACOSX) && !defined(WNT)
@@ -216,6 +217,7 @@ void Test::run()
         {"fdo58076.rtf", &Test::testFdo58076},
         {"fdo57678.rtf", &Test::testFdo57678},
         {"fdo45183.rtf", &Test::testFdo45183},
+        {"fdo54612.rtf", &Test::testFdo54612},
     };
     header();
     for (unsigned int i = 0; i < SAL_N_ELEMENTS(aMethods); ++i)
@@ -1005,6 +1007,14 @@ void Test::testFdo45183()
     CPPUNIT_ASSERT_EQUAL(sal_Int32(16237), getProperty<sal_Int32>(xTables->getByIndex(0), "Width"));
 }
 
+void Test::testFdo54612()
+{
+    // \dpptx without a \dppolycount caused a crash.
+    uno::Reference<drawing::XDrawPageSupplier> xDrawPageSupplier(mxComponent, uno::UNO_QUERY);
+    uno::Reference<container::XIndexAccess> xDraws(xDrawPageSupplier->getDrawPage(), uno::UNO_QUERY);
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(8), xDraws->getCount());
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(Test);
 
 CPPUNIT_PLUGIN_IMPLEMENT();
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
index 2344bfdd487a..58a67cd0d486 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
@@ -3315,19 +3315,24 @@ int RTFDocumentImpl::dispatchValue(RTFKeyword nKeyword, int nParam)
         case RTF_DPPTX:
             {
                 RTFDrawingObject& rDrawingObject = m_aStates.top().aDrawingObject;
+                if (!rDrawingObject.aPolyLinePoints.hasElements())
+                    dispatchValue(RTF_DPPOLYCOUNT, 2);
                 rDrawingObject.aPolyLinePoints[rDrawingObject.aPolyLinePoints.getLength() - rDrawingObject.nPolyLineCount].X = TWIP_TO_MM100(nParam);
             }
             break;
         case RTF_DPPTY:
             {
                 RTFDrawingObject& rDrawingObject = m_aStates.top().aDrawingObject;
-                rDrawingObject.aPolyLinePoints[rDrawingObject.aPolyLinePoints.getLength() - rDrawingObject.nPolyLineCount].Y = TWIP_TO_MM100(nParam);
-                rDrawingObject.nPolyLineCount--;
-                if (rDrawingObject.nPolyLineCount == 0)
+                if (rDrawingObject.aPolyLinePoints.hasElements())
                 {
-                    uno::Sequence< uno::Sequence<awt::Point> >aPointSequenceSequence(1);
-                    aPointSequenceSequence[0] = rDrawingObject.aPolyLinePoints;
-                    rDrawingObject.xPropertySet->setPropertyValue("PolyPolygon", uno::Any(aPointSequenceSequence));
+                    rDrawingObject.aPolyLinePoints[rDrawingObject.aPolyLinePoints.getLength() - rDrawingObject.nPolyLineCount].Y = TWIP_TO_MM100(nParam);
+                    rDrawingObject.nPolyLineCount--;
+                    if (rDrawingObject.nPolyLineCount == 0)
+                    {
+                        uno::Sequence< uno::Sequence<awt::Point> >aPointSequenceSequence(1);
+                        aPointSequenceSequence[0] = rDrawingObject.aPolyLinePoints;
+                        rDrawingObject.xPropertySet->setPropertyValue("PolyPolygon", uno::Any(aPointSequenceSequence));
+                    }
                 }
             }
             break;