some tweaks in RTF filter

6 files changed, 46 insertions, 11 deletions

diff --git a/editeng/source/rtf/svxrtf.cxx b/editeng/source/rtf/svxrtf.cxx
index 48e3efb28f23..2f727e3dddd5 100644
--- a/editeng/source/rtf/svxrtf.cxx
+++ b/editeng/source/rtf/svxrtf.cxx
@@ -28,6 +28,7 @@
 
 
 #include <ctype.h>
+#include <tools/diagnose_ex.h>
 #include <rtl/tencinfo.h>
 #include <svl/itemiter.hxx>
 #include <svl/whiter.hxx>
@@ -1252,7 +1253,8 @@ bool SvxRTFParser::UncompressableStackEntry(const SvxRTFItemStackType &) const
 
 void SvxRTFItemStackType::Compress( const SvxRTFParser& rParser )
 {
-    DBG_ASSERT( pChildList, "There is no child list" );
+    ENSURE_OR_RETURN_VOID(pChildList, "Compress: no ChildList" );
+    ENSURE_OR_RETURN_VOID(!pChildList->empty(), "Compress: ChildList empty");
 
     sal_uInt16 n;
     SvxRTFItemStackType* pTmp = &(*pChildList)[0];
diff --git a/sw/source/core/doc/docnum.cxx b/sw/source/core/doc/docnum.cxx
index fd6eb9283d9e..a0ff16871f07 100644
--- a/sw/source/core/doc/docnum.cxx
+++ b/sw/source/core/doc/docnum.cxx
@@ -89,6 +89,9 @@ namespace {
     }
 }
 
+#include <stdlib.h>
+
+
 inline sal_uInt8 GetUpperLvlChg( sal_uInt8 nCurLvl, sal_uInt8 nLevel, sal_uInt16 nMask )
 {
     if( 1 < nLevel )
@@ -2164,6 +2167,11 @@ SwNumRule* SwDoc::FindNumRulePtr( const String& rName ) const
 
 void SwDoc::AddNumRule(SwNumRule * pRule)
 {
+    if ((SAL_MAX_UINT16 - 1) <= pNumRuleTbl->size())
+    {
+        OSL_ENSURE(false, "SwDoc::AddNumRule: table full.");
+        abort(); // this should never happen on real documents
+    }
     pNumRuleTbl->push_back(pRule);
     maNumRuleMap[pRule->GetName()] = pRule;
     pRule->SetNumRuleMap(&maNumRuleMap);
diff --git a/sw/source/filter/rtf/rtffld.cxx b/sw/source/filter/rtf/rtffld.cxx
index fb96136cb575..b53f13af47db 100644
--- a/sw/source/filter/rtf/rtffld.cxx
+++ b/sw/source/filter/rtf/rtffld.cxx
@@ -155,7 +155,10 @@ static RTF_FLD_TYPES _WhichFld( String& rName, String& rNext )
         {
             rName = rName.Copy( nFndPos, static_cast< xub_StrLen >(nLen) );
             nFndPos += nTokenStt + static_cast< xub_StrLen >(nLen);
-            while( rNext.GetChar( nFndPos ) == ' ' )    ++nFndPos;
+            while ((nFndPos < rNext.Len()) && (rNext.GetChar(nFndPos) == ' '))
+            {
+                ++nFndPos;
+            }
             rNext.Erase( 0, nFndPos );
             rNext = comphelper::string::stripEnd(rNext, ' ');
             return aFldNmArr[n].eFldType;
@@ -387,8 +390,10 @@ int SwRTFParser::MakeFieldInst( String& rFieldStr )
     {
         xub_StrLen nStartDel = nPos;
         nPos += 2;
-        while (aSaveStr.GetChar(nPos) == ' ')
+        while ((nPos < aSaveStr.Len()) && (aSaveStr.GetChar(nPos) == ' '))
+        {
             ++nPos;
+        }
         if (aSaveStr.EqualsIgnoreCaseAscii("MERGEFORMAT", nPos, 11))
         {
             xub_StrLen nNoDel = (nPos + 11 ) - nStartDel;
@@ -430,7 +435,9 @@ int SwRTFParser::MakeFieldInst( String& rFieldStr )
             if( STRING_NOTFOUND != ( nPos = aSaveStr.SearchAscii( "\\*" )) )
             {
                 nPos += 2;
-                while( aSaveStr.GetChar(nPos) == ' ' ) nPos++;
+                while ((nPos < aSaveStr.Len()) &&
+                       (aSaveStr.GetChar(nPos) == ' '))
+                { nPos++; }
                 aSaveStr.Erase( 0, nPos );
 
                 // steht jetzt geanu auf dem Format-Namen
@@ -449,7 +456,9 @@ int SwRTFParser::MakeFieldInst( String& rFieldStr )
             if( STRING_NOTFOUND != ( nPos = aSaveStr.SearchAscii( "\\*" )) )
             {
                 nPos += 2;
-                while( aSaveStr.GetChar(nPos) == ' ' ) nPos++;
+                while ((nPos < aSaveStr.Len()) &&
+                       (aSaveStr.GetChar(nPos) == ' '))
+                { nPos++; }
                 aSaveStr.Erase( 0, nPos );
 
                 // steht jetzt geanu auf dem Format-Namen
@@ -529,7 +538,7 @@ int SwRTFParser::MakeFieldInst( String& rFieldStr )
             // werden:
             //  \\data -> Datenbank-Name als Field
             //  DATA -> Datenbank-Info
-            sal_Bool bField = rFieldStr.GetChar( 0 ) != 'D';
+            bool const bField = rFieldStr.Len() && rFieldStr.GetChar(0) != 'D';
 
             // nur der Name interressiert
             if( STRING_NOTFOUND != (nPos = aSaveStr.Search( '.' )) )
diff --git a/sw/source/filter/rtf/rtffly.cxx b/sw/source/filter/rtf/rtffly.cxx
index e31d4d3d1bd2..7876c16c9c5b 100644
--- a/sw/source/filter/rtf/rtffly.cxx
+++ b/sw/source/filter/rtf/rtffly.cxx
@@ -274,7 +274,8 @@ void SwRTFParser::SetFlysInDoc()
 
         // liegt Ende und Start vom Naechsten im gleichen Node, dann muss
         // gesplittet werden
-        if( n + 1 < (sal_uInt16)aFlyArr.size() && pFlySave->nEndCnt &&
+        if (((static_cast<size_t>(n) + 1) < aFlyArr.size()) &&
+            pFlySave->nEndCnt &&
             pFlySave->nEndNd == aFlyArr[ n + 1 ]->nSttNd )
         {
             SwCntntNode *const pCNd = pFlySave->nEndNd.GetNode().GetCntntNode();
@@ -1226,6 +1227,10 @@ void SwRTFParser::InsPicture( const String& rGrfNm, const Graphic* pGrf,
     // #i83368# - Assure that graphic node is enclosed by fly frame node.
     if ( bReadSwFly && !mbReadCellWhileReadSwFly )
     {
+        OSL_ENSURE(!aFlyArr.empty(),
+            "SwRTFParser::InsPicture: fly array empty.");
+        if (!aFlyArr.empty())
+        {
         // erzeuge nur einen normalen GrafikNode und ersetze diesen gegen
         // den vorhandenen Textnode
         SwNodeIndex& rIdx = pPam->GetPoint()->nNode;
@@ -1246,6 +1251,7 @@ void SwRTFParser::InsPicture( const String& rGrfNm, const Graphic* pGrf,
             if( pFlySave->nEndNd == rIdx )
                 pFlySave->nEndNd = rIdx.GetIndex() - 1;
         }
+        }
     }
     else
     {
diff --git a/sw/source/filter/rtf/rtftbl.cxx b/sw/source/filter/rtf/rtftbl.cxx
index 9fe764deb2f2..884878be1902 100644
--- a/sw/source/filter/rtf/rtftbl.cxx
+++ b/sw/source/filter/rtf/rtftbl.cxx
@@ -194,6 +194,11 @@ void SwRTFParser::ReadTable( int nToken )
 
     sal_Int16 eVerOrient = text::VertOrientation::NONE;
     long nLineHeight = 0;
+    if (aMergeBoxes.empty()) // can this actually happen?
+    {
+        OSL_ASSERT(false);
+        aMergeBoxes.push_back(sal_False);
+    }
     SwBoxFrmFmts aBoxFmts;
     SwTableBoxFmt* pBoxFmt = pDoc->MakeTableBoxFmt();
     SvxFrameDirection eDir = FRMDIR_HORI_LEFT_TOP;
@@ -283,8 +288,11 @@ void SwRTFParser::ReadTable( int nToken )
                         {
                             --m_nCurrentBox;
                         }
-                        pFmt = static_cast<SwTableBoxFmt*>(
-                            pLine->GetTabBoxes()[ m_nCurrentBox ]->GetFrmFmt());
+                        if (m_nCurrentBox < pLine->GetTabBoxes().size())
+                        {
+                            pFmt = static_cast<SwTableBoxFmt*>(
+                              pLine->GetTabBoxes()[m_nCurrentBox]->GetFrmFmt());
+                        }
                     }
                     else
                         pFmt = aBoxFmts.back();
diff --git a/sw/source/filter/rtf/swparrtf.cxx b/sw/source/filter/rtf/swparrtf.cxx
index db7178353a4d..35ad32b4d66b 100644
--- a/sw/source/filter/rtf/swparrtf.cxx
+++ b/sw/source/filter/rtf/swparrtf.cxx
@@ -593,7 +593,9 @@ bool rtfSections::SetCols(SwFrmFmt &rFmt, const rtfSection &rSection,
     {
         aCol._SetOrtho(false);
         sal_uInt16 nWishWidth = 0, nHalfPrev = 0;
-        for(sal_uInt16 n=0, i=0; n < rSection.maPageInfo.maColumns.size() && i < nCols; n += 2, ++i )
+        for (sal_uInt16 n=0, i=0;
+             (static_cast<size_t>(n)+1) < rSection.maPageInfo.maColumns.size() && i < nCols;
+             n += 2, ++i)
         {
             SwColumn* pCol = &aCol.GetColumns()[ i ];
             pCol->SetLeft( nHalfPrev );
@@ -2746,7 +2748,7 @@ sal_Bool lcl_SetFmtCol( SwFmt& rFmt, sal_uInt16 nCols, sal_uInt16 nColSpace,
         {
             aCol._SetOrtho( sal_False );
             sal_uInt16 nWishWidth = 0, nHalfPrev = 0;
-            for( sal_uInt16 n = 0, i = 0; n < rColumns.size(); n += 2, ++i )
+            for (sal_uInt16 n = 0, i = 0; static_cast<size_t>(n+1) < rColumns.size(); n += 2, ++i)
             {
                 SwColumn* pCol = &aCol.GetColumns()[ i ];
                 pCol->SetLeft( nHalfPrev );