fdo#54612 don't crash on RTF_DPPTX before RTF_DPPOLYCOUNT

Change-Id: I35bf580df157dee429d9dca193945ea95616d678

2 files changed, 44 insertions, 0 deletions

diff --git a/sw/qa/extras/rtfimport/data/fdo54612.rtf b/sw/qa/extras/rtfimport/data/fdo54612.rtf
new file mode 100644
index 000000000000..3867d0edfe5b
--- /dev/null
+++ b/sw/qa/extras/rtfimport/data/fdo54612.rtf
@@ -0,0 +1,34 @@
+{\rtf 
+{\do\dobxpage\dobypage\dptxbx\dptxbxmar0 
+{\dptxbxtext\plain 
+\par}
+\dpx720\dpy1305\dpxsize10005\dpysize2910\dplinehollow0
+\dpfillpat0}
+{\do\dobxpage\dobypage\dpline\dpptx0\dppty0\dpptx9870\dppty0\dpx735\dpy4830
+\dpxsize9870\dpysize0\dplinesolid0\dplinecor0\dplinecog128\dplinecob128
+\dplinew30}
+{\do\dobxpage\dobypage\dptxbx\dptxbxmar0 
+{\dptxbxtext\plain\f1\fs36\b\ul 
+\par}
+\dpx4605\dpy4935\dpxsize2640\dpysize435\dplinehollow0\dpfillpat0
+}
+{\do\dobxpage\dobypage\dpline\dpptx0\dppty0\dpptx9870\dppty0\dpx735\dpy5550
+\dpxsize9870\dpysize0\dplinesolid0\dplinecor0\dplinecog128\dplinecob128
+\dplinew30}
+{\do\dobxpage\dobypage\dptxbx\dptxbxmar0 
+{\dptxbxtext\plain\f1\fs19\b 
+\par}
+\dpx3555\dpy5910\dpxsize2235\dpysize240\dplinehollow0
+\dpfillpat0}
+{\do\dobxpage\dobypage\dptxbx\dptxbxmar0 
+{\dptxbxtext\plain\f1\fs19\b 
+\par}
+\dpx3900\dpy6195\dpxsize1995\dpysize240\dplinehollow0
+\dpfillpat0}
+{\do\dobxpage\dobypage\dptxbx\dptxbxmar0 
+{\dptxbxtext\plain\f1\fs19
+\par}
+\dpx5835\dpy6195\dpxsize1245\dpysize240\dplinehollow0\dpfillpat0}
+{\do\dobxpage\dobypage\dpline\dpptx0\dppty0\dpptx3480\dppty0\dpx6720\dpy6765
+\dpxsize3480\dpysize0\dplinesolid0\dplinecor0\dplinecog0\dplinecob0\dplinew0}
+}
diff --git a/sw/qa/extras/rtfimport/rtfimport.cxx b/sw/qa/extras/rtfimport/rtfimport.cxx
index 37c4fa4791f8..be8c34de2aaf 100644
--- a/sw/qa/extras/rtfimport/rtfimport.cxx
+++ b/sw/qa/extras/rtfimport/rtfimport.cxx
@@ -133,6 +133,7 @@ public:
     void testFdo58076();
     void testFdo57678();
     void testFdo45183();
+    void testFdo54612();
 
     CPPUNIT_TEST_SUITE(Test);
 #if !defined(MACOSX) && !defined(WNT)
@@ -216,6 +217,7 @@ void Test::run()
         {"fdo58076.rtf", &Test::testFdo58076},
         {"fdo57678.rtf", &Test::testFdo57678},
         {"fdo45183.rtf", &Test::testFdo45183},
+        {"fdo54612.rtf", &Test::testFdo54612},
     };
     header();
     for (unsigned int i = 0; i < SAL_N_ELEMENTS(aMethods); ++i)
@@ -1005,6 +1007,14 @@ void Test::testFdo45183()
     CPPUNIT_ASSERT_EQUAL(sal_Int32(16237), getProperty<sal_Int32>(xTables->getByIndex(0), "Width"));
 }
 
+void Test::testFdo54612()
+{
+    // \dpptx without a \dppolycount caused a crash.
+    uno::Reference<drawing::XDrawPageSupplier> xDrawPageSupplier(mxComponent, uno::UNO_QUERY);
+    uno::Reference<container::XIndexAccess> xDraws(xDrawPageSupplier->getDrawPage(), uno::UNO_QUERY);
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(8), xDraws->getCount());
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(Test);
 
 CPPUNIT_PLUGIN_IMPLEMENT();