CWS-TOOLING: integrate CWS hb22

5 files changed, 32 insertions, 9 deletions

diff --git a/sw/source/core/doc/number.cxx b/sw/source/core/doc/number.cxx
index 7af292626f06..847c6b229fd1 100644
--- a/sw/source/core/doc/number.cxx
+++ b/sw/source/core/doc/number.cxx
@@ -101,8 +101,15 @@ const SwNumFmt& SwNumRule::Get( USHORT i ) const
 
 const SwNumFmt* SwNumRule::GetNumFmt( USHORT i ) const
 {
+    const SwNumFmt * pResult = NULL;
+
     ASSERT_ID( i < MAXLEVEL && eRuleType < RULE_END, ERR_NUMLEVEL);
-    return aFmts[ i ];
+    if ( i < MAXLEVEL && eRuleType < RULE_END)
+    {
+        pResult = aFmts[ i ];
+    }
+
+    return pResult;
 }
 
 // --> OD 2008-07-08 #i91400#
diff --git a/sw/source/core/docnode/ndtbl.cxx b/sw/source/core/docnode/ndtbl.cxx
index b213eb1d075d..f0683ae700a5 100644
--- a/sw/source/core/docnode/ndtbl.cxx
+++ b/sw/source/core/docnode/ndtbl.cxx
@@ -334,7 +334,13 @@ BOOL SwNodes::InsBoxen( SwTableNode* pTblNd,
         new SwEndNode( aEndIdx, *pSttNd );
 
         pPrvBox = new SwTableBox( pBoxFmt, *pSttNd, pLine );
-        pLine->GetTabBoxes().C40_INSERT( SwTableBox, pPrvBox, nInsPos + n );
+
+        SwTableBoxes & rTabBoxes = pLine->GetTabBoxes();
+        USHORT nRealInsPos = nInsPos + n;
+        if (nRealInsPos > rTabBoxes.Count())
+            nRealInsPos = rTabBoxes.Count();
+
+        rTabBoxes.C40_INSERT( SwTableBox, pPrvBox, nRealInsPos );
 
         //if( NO_NUMBERING == pTxtColl->GetOutlineLevel()//#outline level,zhaojianwei
         if( ! pTxtColl->IsAssignedToListLevelOfOutlineStyle()//<-end,zhaojianwei
diff --git a/sw/source/filter/rtf/rtfnum.cxx b/sw/source/filter/rtf/rtfnum.cxx
index 84719b2f1255..507f35375ed6 100644
--- a/sw/source/filter/rtf/rtfnum.cxx
+++ b/sw/source/filter/rtf/rtfnum.cxx
@@ -806,8 +806,8 @@ SwNumRule *SwRTFParser::ReadNumSecLevel( int nToken )
         // suche die Rule - steht unter Nummer 3
         nListNo = 3;
         bContinus = FALSE;
-        nLevel = MAXLEVEL <= nTokenValue ? MAXLEVEL - 1
-                                         : BYTE( nTokenValue - 1 );
+        nLevel = MAXLEVEL <= (unsigned long) nTokenValue ? MAXLEVEL - 1
+            : (!nTokenValue ? 0 : BYTE( nTokenValue - 1 ));
     }
     else
     {
@@ -815,9 +815,9 @@ SwNumRule *SwRTFParser::ReadNumSecLevel( int nToken )
         {
         case RTF_PNLVL:         nListNo = 3;
                                 bContinus = FALSE;
-                                nLevel = MAXLEVEL <= nTokenValue
+                                nLevel = MAXLEVEL <= (unsigned long) nTokenValue
                                                     ? MAXLEVEL - 1
-                                                    : BYTE( nTokenValue-1 );
+                                    : (!nTokenValue ? 0 : BYTE( nTokenValue-1 ));
                                 break;
 
         case RTF_PNLVLBODY:
diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index 75454dddbc58..a9a60a01147a 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -1400,7 +1400,9 @@ WW8ListManager::WW8ListManager(SvStream& rSt_, SwWW8ImplReader& rReader_)
                         pLFOInfo->pNumRule->Set(aLFOLVL.nLevel, aNumFmt);
                     }
                     bLVLOk = true;
-                    pLFOInfo->maOverrides[aLFOLVL.nLevel] = aLFOLVL;
+
+                    if (nMaxLevel > aLFOLVL.nLevel)
+                        pLFOInfo->maOverrides[aLFOLVL.nLevel] = aLFOLVL;
                 }
                 if( !bLVLOk )
                     break;
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index d318522100cf..d64e207313d8 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -7179,8 +7179,16 @@ void WW8DopTypography::ReadFromMem(BYTE *&pData)
     for (i=0; i < nMaxLeading; ++i)
         rgxchLPunct[i] = Get_Short(pData);
 
-    rgxchFPunct[cchFollowingPunct]=0;
-    rgxchLPunct[cchLeadingPunct]=0;
+    if (cchFollowingPunct >= 0 && cchFollowingPunct < nMaxFollowing)
+        rgxchFPunct[cchFollowingPunct]=0;
+    else
+        rgxchFPunct[nMaxFollowing - 1]=0;
+
+    if (cchLeadingPunct >= 0 && cchLeadingPunct < nMaxLeading)
+        rgxchLPunct[cchLeadingPunct]=0;
+    else
+        rgxchLPunct[nMaxLeading - 1]=0;
+
 }
 
 void WW8DopTypography::WriteToMem(BYTE *&pData) const