dr78: #i109800# SHEET record may not point to BOF but to any record in the sheet substream

4 files changed, 43 insertions, 22 deletions

diff --git a/oox/source/dump/biffdumper.cxx b/oox/source/dump/biffdumper.cxx
index 3d6f20ed62ba..709fa22b41e0 100644
--- a/oox/source/dump/biffdumper.cxx
+++ b/oox/source/dump/biffdumper.cxx
@@ -2461,6 +2461,12 @@ void WorkbookStreamObject::implDumpRecordBody()
             dumpDec< sal_Int32 >( "sst-idx" );
         break;
 
+        case BIFF_ID_MERGEDCELLS:
+            mxOut->resetItemIndex();
+            for( sal_uInt16 nIdx = 0, nCount = dumpDec< sal_uInt16 >( "count" ); !rStrm.isEof() && (nIdx < nCount); ++nIdx )
+                dumpRange( "#range" );
+        break;
+
         case BIFF_ID_MSODRAWING:
         case BIFF_ID_MSODRAWINGGROUP:
         case BIFF_ID_MSODRAWINGSEL:
@@ -2560,6 +2566,16 @@ void WorkbookStreamObject::implDumpRecordBody()
             }
         break;
 
+        case BIFF_ID_PALETTE:
+            mxOut->resetItemIndex();
+            for( sal_uInt16 nIdx = 0, nCount = dumpDec< sal_uInt16 >( "count" ); !rStrm.isEof() && (nIdx < nCount); ++nIdx )
+            {
+                OUStringBuffer aColorName;
+                StringHelper::appendHex( aColorName, dumpColorABGR( "#color" ) );
+                mxColors->setName( nIdx, aColorName.makeStringAndClear() );
+            }
+        break;
+
         case BIFF_ID_PANE:
             dumpDec< sal_uInt16 >( "x-pos", "CONV-TWIP-TO-CM" );
             dumpDec< sal_uInt16 >( "y-pos", "CONV-TWIP-TO-CM" );
diff --git a/oox/source/dump/dumperbase.ini b/oox/source/dump/dumperbase.ini
index 34ef302c784c..f9b776c9d99a 100644
--- a/oox/source/dump/dumperbase.ini
+++ b/oox/source/dump/dumperbase.ini
@@ -35,7 +35,7 @@ show-trailing-unknown=1
 # Shows the absolute stream position of records in the record header field
 # (default=on).
 #   0=off, 1=on
-show-record-position=0
+show-record-position=1
 
 # name lists =================================================================
 #
diff --git a/oox/source/xls/excelhandlers.cxx b/oox/source/xls/excelhandlers.cxx
index aaf551424483..a02009ec1898 100644
--- a/oox/source/xls/excelhandlers.cxx
+++ b/oox/source/xls/excelhandlers.cxx
@@ -140,28 +140,10 @@ BiffFragmentHandler::BiffFragmentHandler( const BiffFragmentHandler& rHandler )
 
 BiffFragmentType BiffFragmentHandler::startFragment( BiffType eBiff )
 {
-    return mrStrm.startNextRecord() ? implStartFragment( eBiff ) : BIFF_FRAGMENT_UNKNOWN;
-}
-
-BiffFragmentType BiffFragmentHandler::startFragment( BiffType eBiff, sal_Int64 nRecHandle )
-{
-    return mrStrm.startRecordByHandle( nRecHandle ) ? implStartFragment( eBiff ) : BIFF_FRAGMENT_UNKNOWN;
-}
-
-bool BiffFragmentHandler::skipFragment()
-{
-    while( mrStrm.startNextRecord() && (mrStrm.getRecId() != BIFF_ID_EOF) )
-        if( isBofRecord() )
-            skipFragment();
-    return !mrStrm.isEof() && (mrStrm.getRecId() == BIFF_ID_EOF);
-}
-
-BiffFragmentType BiffFragmentHandler::implStartFragment( BiffType eBiff )
-{
     BiffFragmentType eFragment = BIFF_FRAGMENT_UNKNOWN;
     /*  #i23425# Don't rely on BOF record ID to read BOF contents, but on
         the detected BIFF version. */
-    if( isBofRecord() )
+    if( mrStrm.startNextRecord() && isBofRecord() )
     {
         // BOF is always written unencrypted
         mrStrm.enableDecoder( false );
@@ -219,6 +201,14 @@ BiffFragmentType BiffFragmentHandler::implStartFragment( BiffType eBiff )
     return eFragment;
 }
 
+bool BiffFragmentHandler::skipFragment()
+{
+    while( mrStrm.startNextRecord() && (mrStrm.getRecId() != BIFF_ID_EOF) )
+        if( isBofRecord() )
+            skipFragment();
+    return !mrStrm.isEof() && (mrStrm.getRecId() == BIFF_ID_EOF);
+}
+
 // ============================================================================
 
 BiffWorkbookFragmentBase::BiffWorkbookFragmentBase( const WorkbookHelper& rHelper, const OUString& rStrmName, bool bCloneDecoder ) :
diff --git a/oox/source/xls/workbookfragment.cxx b/oox/source/xls/workbookfragment.cxx
index 6e43a32495be..fcc9f4972b7d 100644
--- a/oox/source/xls/workbookfragment.cxx
+++ b/oox/source/xls/workbookfragment.cxx
@@ -379,10 +379,25 @@ bool BiffWorkbookFragment::importFragment()
             bool bNextSheet = bRet;
             for( sal_Int32 nWorksheet = 0, nWorksheetCount = rWorksheets.getWorksheetCount(); bNextSheet && (nWorksheet < nWorksheetCount); ++nWorksheet )
             {
-                // try to start a new sheet fragment
+                // calculate progress size for the sheet
                 double fSegmentLength = getProgressBar().getFreeLength() / (nWorksheetCount - nWorksheet);
                 ISegmentProgressBarRef xSheetProgress = getProgressBar().createSegment( fSegmentLength );
-                BiffFragmentType eSheetFragment = startFragment( getBiff(), rWorksheets.getBiffRecordHandle( nWorksheet ) );
+                /*  Try to start a new sheet fragment. The SHEET records point to the
+                    first record of the sheet fragment which is usually a BOF record. */
+                BiffFragmentType eSheetFragment = BIFF_FRAGMENT_UNKNOWN;
+                sal_Int64 nRecHandle = rWorksheets.getBiffRecordHandle( nWorksheet );
+                if( mrStrm.startRecordByHandle( nRecHandle ) )
+                {
+                    /*  #i109800# Stream may point to any record of the sheet fragment.
+                        Check the record identifier before calling startFragment(). */
+                    bool bIsBofRec = isBofRecord();
+                    /*  Rewind the record. If it is the BOF record, it will be read in
+                        startFragment(). In every case, stream will point before the
+                        first available non-BOF record. */
+                    mrStrm.rewindRecord();
+                    // if the BOF record is missing, a regular worksheet will be assumed
+                    eSheetFragment = bIsBofRec ? startFragment( getBiff() ) : BIFF_FRAGMENT_WORKSHEET;
+                }
                 sal_Int16 nCalcSheet = rWorksheets.getCalcSheetIndex( nWorksheet );
                 bNextSheet = importSheetFragment( *xSheetProgress, eSheetFragment, nCalcSheet );
             }