RTF import filter review

Patch by: Michael Stahl

6 files changed, 44 insertions, 25 deletions

diff --git a/sw/source/core/doc/docnum.cxx b/sw/source/core/doc/docnum.cxx
index 95c24f164d70..3e7418bee23d 100644
--- a/sw/source/core/doc/docnum.cxx
+++ b/sw/source/core/doc/docnum.cxx
@@ -60,6 +60,9 @@
 
 #include <map>
 
+#include <stdlib.h>
+
+
 inline sal_uInt8 GetUpperLvlChg( sal_uInt8 nCurLvl, sal_uInt8 nLevel, sal_uInt16 nMask )
 {
     if( 1 < nLevel )
@@ -2466,6 +2469,11 @@ SwNumRule* SwDoc::FindNumRulePtr( const String& rName ) const
 // #i36749#
 void SwDoc::AddNumRule(SwNumRule * pRule)
 {
+    if ((SAL_MAX_UINT16 - 1) <= pNumRuleTbl->Count())
+    {
+        OSL_ENSURE(false, "SwDoc::AddNumRule: table full.");
+        abort(); // this should never happen on real documents
+    }
     pNumRuleTbl->Insert(pRule, pNumRuleTbl->Count());
     maNumRuleMap[pRule->GetName()] = pRule;
     pRule->SetNumRuleMap(&maNumRuleMap);
diff --git a/sw/source/filter/rtf/rtffld.cxx b/sw/source/filter/rtf/rtffld.cxx
index 3b262ae0a016..cb5d4716d8d2 100644
--- a/sw/source/filter/rtf/rtffld.cxx
+++ b/sw/source/filter/rtf/rtffld.cxx
@@ -159,7 +159,10 @@ static RTF_FLD_TYPES _WhichFld( String& rName, String& rNext )
 //          rName = sNm.Copy( nFndPos, nLen );
             rName = rName.Copy( nFndPos, static_cast< xub_StrLen >(nLen) );
             nFndPos += nTokenStt + static_cast< xub_StrLen >(nLen);
-            while( rNext.GetChar( nFndPos ) == ' ' )    ++nFndPos;
+            while ((nFndPos < rNext.Len()) && (rNext.GetChar(nFndPos) == ' '))
+            {
+                ++nFndPos;
+            }
             rNext.Erase( 0, nFndPos );
             rNext.EraseTrailingChars();
             return aFldNmArr[n].eFldType;
@@ -391,8 +394,10 @@ int SwRTFParser::MakeFieldInst( String& rFieldStr )
     {
         xub_StrLen nStartDel = nPos;
         nPos += 2;
-        while (aSaveStr.GetChar(nPos) == ' ')
+        while ((nPos < aSaveStr.Len()) && (aSaveStr.GetChar(nPos) == ' '))
+        {
             ++nPos;
+        }
         if (aSaveStr.EqualsIgnoreCaseAscii("MERGEFORMAT", nPos, 11))
         {
             xub_StrLen nNoDel = (nPos + 11 ) - nStartDel;
@@ -437,7 +442,9 @@ int SwRTFParser::MakeFieldInst( String& rFieldStr )
             if( STRING_NOTFOUND != ( nPos = aSaveStr.SearchAscii( "\\*" )) )
             {
                 nPos += 2;
-                while( aSaveStr.GetChar(nPos) == ' ' ) nPos++;
+                while ((nPos < aSaveStr.Len()) &&
+                       (aSaveStr.GetChar(nPos) == ' '))
+                { nPos++; }
                 aSaveStr.Erase( 0, nPos );
 
                 // steht jetzt geanu auf dem Format-Namen
@@ -456,7 +463,9 @@ int SwRTFParser::MakeFieldInst( String& rFieldStr )
             if( STRING_NOTFOUND != ( nPos = aSaveStr.SearchAscii( "\\*" )) )
             {
                 nPos += 2;
-                while( aSaveStr.GetChar(nPos) == ' ' ) nPos++;
+                while ((nPos < aSaveStr.Len()) &&
+                       (aSaveStr.GetChar(nPos) == ' '))
+                { nPos++; }
                 aSaveStr.Erase( 0, nPos );
 
                 // steht jetzt geanu auf dem Format-Namen
@@ -536,7 +545,7 @@ int SwRTFParser::MakeFieldInst( String& rFieldStr )
             // werden:
             //  \\data -> Datenbank-Name als Field
             //  DATA -> Datenbank-Info
-            sal_Bool bField = rFieldStr.GetChar( 0 ) != 'D';
+            bool const bField = rFieldStr.Len() && rFieldStr.GetChar(0) != 'D';
 
             // nur der Name interressiert
             if( STRING_NOTFOUND != (nPos = aSaveStr.Search( '.' )) )
diff --git a/sw/source/filter/rtf/rtffly.cxx b/sw/source/filter/rtf/rtffly.cxx
index 375f9beb9265..598d0d6cc13f 100644
--- a/sw/source/filter/rtf/rtffly.cxx
+++ b/sw/source/filter/rtf/rtffly.cxx
@@ -280,7 +280,8 @@ void SwRTFParser::SetFlysInDoc()
 
         // liegt Ende und Start vom Naechsten im gleichen Node, dann muss
         // gesplittet werden
-        if( n + 1 < aFlyArr.Count() && pFlySave->nEndCnt &&
+        if (((static_cast<size_t>(n) + 1) < aFlyArr.Count()) &&
+            pFlySave->nEndCnt &&
             pFlySave->nEndNd == aFlyArr[ n + 1 ]->nSttNd )
         {
             SwCntntNode *const pCNd = pFlySave->nEndNd.GetNode().GetCntntNode();
@@ -1249,6 +1250,10 @@ void SwRTFParser::InsPicture( const String& rGrfNm, const Graphic* pGrf,
     if ( bReadSwFly && !mbReadCellWhileReadSwFly )
     // <--
     {
+        OSL_ENSURE(aFlyArr.Count(),
+            "SwRTFParser::InsPicture: fly array empty.");
+        if (aFlyArr.Count())
+        {
         // erzeuge nur einen normalen GrafikNode und ersetze diesen gegen
         // den vorhandenen Textnode
         SwNodeIndex& rIdx = pPam->GetPoint()->nNode;
@@ -1386,6 +1391,7 @@ void SwRTFParser::_SetPictureSize( const SwNoTxtNode& rNd,
             if( aSize.Width() > nBoxWidth )
                 aSize.Width() = nBoxWidth;
         }
+        }
     }
 
     //JP 8.11.2001: bug 94450 - if no size exist, then the size is set by
diff --git a/sw/source/filter/rtf/rtftbl.cxx b/sw/source/filter/rtf/rtftbl.cxx
index 2615524a8fd1..661697ace9ce 100644
--- a/sw/source/filter/rtf/rtftbl.cxx
+++ b/sw/source/filter/rtf/rtftbl.cxx
@@ -216,6 +216,11 @@ void SwRTFParser::ReadTable( int nToken )
 
     sal_Int16 eVerOrient = text::VertOrientation::NONE;
     long nLineHeight = 0;
+    if (aMergeBoxes.empty()) // can this actually happen?
+    {
+        OSL_ASSERT(false);
+        aMergeBoxes.push_back(sal_False);
+    }
     size_t nBoxCnt = aMergeBoxes.size()-1;
     SwBoxFrmFmts aBoxFmts;
     SwTableBoxFmt* pBoxFmt = pDoc->MakeTableBoxFmt();
@@ -306,8 +311,11 @@ void SwRTFParser::ReadTable( int nToken )
                         {
                             --m_nCurrentBox;
                         }
-                        pFmt = static_cast<SwTableBoxFmt*>(
-                            pLine->GetTabBoxes()[ m_nCurrentBox ]->GetFrmFmt());
+                        if (m_nCurrentBox < pLine->GetTabBoxes().Count())
+                        {
+                            pFmt = static_cast<SwTableBoxFmt*>(
+                              pLine->GetTabBoxes()[m_nCurrentBox]->GetFrmFmt());
+                        }
                     }
                     else
                         pFmt = aBoxFmts[ aBoxFmts.Count()-1 ];
@@ -646,12 +654,6 @@ void SwRTFParser::ReadTable( int nToken )
 
         pOldTblNd = pTableNode;
         bNewTbl = sal_False;
-
-        {
-            // JP 13.08.98: TabellenUmrandungen optimieren - Bug 53525
-            void* p = pFmt;
-            aTblFmts.Insert( p, aTblFmts.Count() );
-        }
     }
     else
     {
@@ -746,12 +748,6 @@ void SwRTFParser::ReadTable( int nToken )
 
             m_nCurrentBox = 0;
             pOldTblNd = pTableNode;
-
-            {
-                // JP 13.08.98: TabellenUmrandungen optimieren - Bug 53525
-                void* p = pFmt;
-                aTblFmts.Insert( p, aTblFmts.Count() );
-            }
         }
     }
 
@@ -911,7 +907,7 @@ void SwRTFParser::GotoNextBox()
         }
 
         if (bMove &&
-                (static_cast<size_t>(m_nCurrentBox + 1) == aMergeBoxes.size()))
+               ((static_cast<size_t>(m_nCurrentBox) + 1) == aMergeBoxes.size()))
             // dann hinter die Tabelle
             pPam->Move( fnMoveForward, fnGoNode );
     }
diff --git a/sw/source/filter/rtf/swparrtf.cxx b/sw/source/filter/rtf/swparrtf.cxx
index a4a95c36f50b..5888455fd326 100644
--- a/sw/source/filter/rtf/swparrtf.cxx
+++ b/sw/source/filter/rtf/swparrtf.cxx
@@ -190,7 +190,6 @@ SwRTFParser::SwRTFParser(SwDoc* pD,
     maCharStyleMapper(*pD),
     maSegments(*this),
     maInsertedTables(*pD),
-    aTblFmts(0, 10),
     mpBookmarkStart(0),
     mpRedlineStack(0),
     pAuthorInfos(0),
@@ -562,7 +561,9 @@ bool rtfSections::SetCols(SwFrmFmt &rFmt, const rtfSection &rSection,
     {
         aCol._SetOrtho(false);
         sal_uInt16 nWishWidth = 0, nHalfPrev = 0;
-        for(sal_uInt16 n=0, i=0; n < rSection.maPageInfo.maColumns.size() && i < nCols; n += 2, ++i )
+        for (sal_uInt16 n=0, i=0;
+             (static_cast<size_t>(n)+1) < rSection.maPageInfo.maColumns.size() && i < nCols;
+             n += 2, ++i)
         {
             SwColumn* pCol = aCol.GetColumns()[ i ];
             pCol->SetLeft( nHalfPrev );
@@ -2782,7 +2783,7 @@ sal_Bool lcl_SetFmtCol( SwFmt& rFmt, sal_uInt16 nCols, sal_uInt16 nColSpace,
         {
             aCol._SetOrtho( sal_False );
             sal_uInt16 nWishWidth = 0, nHalfPrev = 0;
-            for( sal_uInt16 n = 0, i = 0; n < rColumns.Count(); n += 2, ++i )
+            for (sal_uInt16 n = 0, i = 0; (n+1) < rColumns.Count(); n += 2, ++i)
             {
                 SwColumn* pCol = aCol.GetColumns()[ i ];
                 pCol->SetLeft( nHalfPrev );
diff --git a/sw/source/filter/rtf/swparrtf.hxx b/sw/source/filter/rtf/swparrtf.hxx
index e4726c407ed3..5c5671732e83 100644
--- a/sw/source/filter/rtf/swparrtf.hxx
+++ b/sw/source/filter/rtf/swparrtf.hxx
@@ -295,7 +295,6 @@ class SwRTFParser : public SvxRTFParser
     SwFlySaveArr aFlyArr;               // Flys als Letzes im Doc setzen
     SvBools aMergeBoxes;                // Flags fuer gemergte Zellen
     SwListArr aListArr;
-    SvPtrarr aTblFmts;
     SvPtrarr aRubyCharFmts;
     BookmarkPosition* mpBookmarkStart;
     sw::util::RedlineStack *mpRedlineStack;