recreated tag libreoffice-3.3.4.1 which had these commits:

commit 7395bd10579c3756281efefcdbac61307c23df94 (tag: refs/tags/libreoffice-3.3.4.1, refs/remotes/origin/libreoffice-3-3)
Author: Petr Mladek <pmladek@suse.cz>
Date:   Tue Aug 2 14:56:33 2011 +0200

Version 3.3.4.1, tag libreoffice-3.3.4.1 (3.3.4-rc1)

commit a935029385159ee137418730363257599f67e5d6
Author: Radek Doulik <rodo@novell.com>
Date:   Mon Jul 11 20:36:47 2011 +0200

fix regression in SvGlobalName::operator <

- it was comparing wrong parts and ommiting part of ID's, resulting
in wrong results and thus ::std::map didn't work well with default
less compare function of it's keys
- fixes fdo#32709
(cherry picked from commit 345dc7961bc142f167a1b8e5f43f4439e8234f06)

Signed-off-by: Caolán McNamara <caolanm@redhat.com>

tools/source/ref/globname.cxx |    4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)

commit eba378ee13564125a8b6ee522901d586f9bb78f5
Author: Caolán McNamara <caolanm@redhat.com>
Date:   Wed Jul 6 13:41:52 2011 +0100

handle busted emf lengths

Conflicts:

svtools/source/filter.vcl/wmf/enhwmf.cxx

svtools/source/filter.vcl/wmf/enhwmf.cxx |   35 ++++++++++++++++++------------
1 files changed, 21 insertions(+), 14 deletions(-)

2 files changed, 23 insertions, 16 deletions

diff --git a/svtools/source/filter.vcl/wmf/enhwmf.cxx b/svtools/source/filter.vcl/wmf/enhwmf.cxx
index 1dd5c64ce11e..2406de9ff167 100644
--- a/svtools/source/filter.vcl/wmf/enhwmf.cxx
+++ b/svtools/source/filter.vcl/wmf/enhwmf.cxx
@@ -261,22 +261,27 @@ void EnhWMFReader::ReadEMFPlusComment(sal_uInt32 length, sal_Bool& bHaveDC)
     }
     bEMFPlus = true;
 
+    sal_Size pos = pWMF->Tell();
     void *buffer = malloc( length );
-
-    int pos = pWMF->Tell();
     pOut->PassEMFPlus( buffer, pWMF->Read( buffer, length ) );
+    free( buffer );
     pWMF->Seek( pos );
 
     bHaveDC = false;
 
-    length -= 4;
+    OSL_ASSERT(length >= 4);
+    //reduce by 32bit length itself, skip in SeekRel if
+    //impossibly unavailble
+    sal_uInt32 nRemainder = length >= 4 ? length-4 : length;
 
-    while (length > 0) {
-        UINT16 type, flags;
-        UINT32 size, dataSize;
-        sal_uInt32 next;
+    const size_t nRequiredHeaderSize = 12;
+    while (nRemainder > nRequiredHeaderSize)
+    {
+        sal_uInt16 type(0), flags(0);
+        sal_uInt32 size(0), dataSize(0);
 
         *pWMF >> type >> flags >> size >> dataSize;
+        nRemainder -= nRequiredHeaderSize;
 
         EMFP_DEBUG(printf ("\t\tEMF+ record type: %d\n", type));
 
@@ -286,14 +291,16 @@ void EnhWMFReader::ReadEMFPlusComment(sal_uInt32 length, sal_Bool& bHaveDC)
             EMFP_DEBUG(printf ("\t\tEMF+ lock DC (device context)\n", type));
         }
 
-        next = pWMF->Tell() + ( size - 12 );
-
-        length -= size;
-
-        pWMF->Seek( next );
+        //Get the length of the remaining data of this record based
+        //on the alleged size
+        sal_uInt32 nRemainingRecordData = size >= nRequiredHeaderSize ?
+            size-nRequiredHeaderSize : 0;
+        //clip to available size
+        nRemainingRecordData = std::min(nRemainingRecordData, nRemainder);
+        pWMF->SeekRel(nRemainingRecordData);
+        nRemainder -= nRemainingRecordData;
     }
-
-    free( buffer );
+    pWMF->SeekRel(nRemainder);
 }
 
 void EnhWMFReader::ReadGDIComment()
diff --git a/tools/source/ref/globname.cxx b/tools/source/ref/globname.cxx
index 7a7f5c56c738..c78aeb57f62f 100644
--- a/tools/source/ref/globname.cxx
+++ b/tools/source/ref/globname.cxx
@@ -208,10 +208,10 @@ BOOL SvGlobalName::operator < ( const SvGlobalName & rObj ) const
     else if( Data2_a == Data2_b )
     {
         sal_uInt32 Data1_a;
-        memcpy(&Data1_a, pImp->szData+4, sizeof(sal_uInt32));
+        memcpy(&Data1_a, pImp->szData, sizeof(sal_uInt32));
 
         sal_uInt32 Data1_b;
-        memcpy(&Data1_b, rObj.pImp->szData+4, sizeof(sal_uInt32));
+        memcpy(&Data1_b, rObj.pImp->szData, sizeof(sal_uInt32));
 
         return Data1_a  < Data1_b;
     }