filter/source/msfilter/escherex.cxx             |    6 +++---
 include/filter/msfilter/escherex.hxx            |    4 ++--
 sw/source/core/inc/txtfrm.hxx                   |    2 +-
 sw/source/core/text/frmcrsr.cxx                 |    2 +-
 sw/source/core/text/txtfrm.cxx                  |    6 +++---
 sw/source/core/text/txtftn.cxx                  |    2 +-
 ucb/source/cacher/cachedcontentresultset.cxx    |    3 +--
 vcl/source/bitmap/dibtools.cxx                  |   18 ++++++++++++++----
 xmloff/source/text/xmlcontentcontrolcontext.cxx |    2 +-
 9 files changed, 27 insertions(+), 18 deletions(-)

New commits:
commit d6f97dc4ff5249637650b256ffa7cbd80a151985
Author:     Caolán McNamara <[email protected]>
AuthorDate: Thu Aug 7 21:30:15 2025 +0100
Commit:     Xisco Fauli <[email protected]>
CommitDate: Wed Aug 13 20:10:53 2025 +0200

    expand default argument of unusual SetPara method
    
    Change-Id: I8e6212f1e2b9905929e967ba3da1869d06c43d89
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189140
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189485

diff --git a/sw/source/core/inc/txtfrm.hxx b/sw/source/core/inc/txtfrm.hxx
index 7b61c8029d82..2190dd0f34ff 100644
--- a/sw/source/core/inc/txtfrm.hxx
+++ b/sw/source/core/inc/txtfrm.hxx
@@ -300,7 +300,7 @@ class SW_DLLPUBLIC SwTextFrame final : public SwContentFrame
 
     bool GetDropRect_( SwRect &rRect ) const;
 
-    void SetPara( SwParaPortion *pNew, bool bDelete = true );
+    void SetPara(SwParaPortion *pNew, bool bDelete);
 
     bool IsFootnoteNumFrame_() const;
 
diff --git a/sw/source/core/text/frmcrsr.cxx b/sw/source/core/text/frmcrsr.cxx
index a2545c300abf..2324e99daccf 100644
--- a/sw/source/core/text/frmcrsr.cxx
+++ b/sw/source/core/text/frmcrsr.cxx
@@ -129,7 +129,7 @@ bool sw_ChangeOffset(SwTextFrame* pFrame, TextFrameIndex 
nNew)
                     nNew = TextFrameIndex(0);
                 }
                 pFrame->SetOffset( nNew );
-                pFrame->SetPara( nullptr );
+                pFrame->SetPara(nullptr, true);
                 pFrame->GetFormatted();
                 if( pFrame->getFrameArea().HasArea() )
                     pFrame->getRootFrame()->GetCurrShell()->InvalidateWindows( 
pFrame->getFrameArea() );
diff --git a/sw/source/core/text/txtfrm.cxx b/sw/source/core/text/txtfrm.cxx
index bea6d81e3b44..6e6687faabc8 100644
--- a/sw/source/core/text/txtfrm.cxx
+++ b/sw/source/core/text/txtfrm.cxx
@@ -3469,7 +3469,7 @@ SwTestFormat::~SwTestFormat()
         aPrt.setSwRect(aOldPrt);
     }
 
-    pFrame->SetPara( pOldPara );
+    pFrame->SetPara(pOldPara, true);
 }
 
 bool SwTextFrame::TestFormat( const SwFrame* pPrv, SwTwips &rMaxHeight, bool 
&bSplit )
@@ -3721,7 +3721,7 @@ SwTwips SwTextFrame::CalcFitToContent()
         aPrt.Width( nOldPrtWidth );
     }
 
-    SetPara( pOldPara );
+    SetPara(pOldPara, true);
 
     // tdf#164932 handle numbering list offset
     const SwTextNode* pTextNode( GetTextNodeForParaProps() );
@@ -3814,7 +3814,7 @@ void SwTextFrame::CalcAdditionalFirstLineOffset()
     }
 
     // restore paragraph portion
-    SetPara( pOldPara );
+    SetPara(pOldPara, true);
 }
 
 /**
diff --git a/sw/source/core/text/txtftn.cxx b/sw/source/core/text/txtftn.cxx
index cea62efffb6a..a941e5eca2d8 100644
--- a/sw/source/core/text/txtftn.cxx
+++ b/sw/source/core/text/txtftn.cxx
@@ -166,7 +166,7 @@ bool SwTextFrame::CalcPrepFootnoteAdjust()
             SwTextFormatInfo aInf( getRootFrame()->GetCurrShell()->GetOut(), 
this );
             SwTextFormatter aLine( this, &aInf );
             aLine.TruncLines();
-            SetPara( nullptr ); // May be deleted!
+            SetPara(nullptr, true); // May be deleted!
             ResetPreps();
             return false;
         }
commit f5dee7f91e47c435c13797ba5848a96fa481956e
Author:     Caolán McNamara <[email protected]>
AuthorDate: Wed Aug 6 09:06:05 2025 +0100
Commit:     Xisco Fauli <[email protected]>
CommitDate: Wed Aug 13 20:10:47 2025 +0200

    cid#1659628 can only reach this line in the case of a caught exception
    
    so move it into that block protected by the rGuard.lock()
    
    Change-Id: I8e0bde5a7de6ec5428b405f734d6c8e54fb1645e
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/188994
    Reviewed-by: Caolán McNamara <[email protected]>
    Tested-by: Jenkins
    (cherry picked from commit a2bbf65bb44229cadd1bc325ef174322b625a36b)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189483
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/ucb/source/cacher/cachedcontentresultset.cxx 
b/ucb/source/cacher/cachedcontentresultset.cxx
index 4a554f7ff768..9fa929cdf343 100644
--- a/ucb/source/cacher/cachedcontentresultset.cxx
+++ b/ucb/source/cacher/cachedcontentresultset.cxx
@@ -754,9 +754,8 @@ bool CachedContentResultSet
             }
             else
                 throw;
+            return nRow == m_nLastAppliedPos;
         }
-
-        return nRow == m_nLastAppliedPos;
     }
     return true;
 };
commit 62ec25eac3fdb06435750d323db3e1c693dfe682
Author:     Caolán McNamara <[email protected]>
AuthorDate: Sat Aug 9 19:23:13 2025 +0100
Commit:     Xisco Fauli <[email protected]>
CommitDate: Wed Aug 13 20:10:40 2025 +0200

    cid#1660111 Overflowed constant
    
    Change-Id: I5afba320e5792d7b491d704c859e2b60a2b64f8e
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189274
    Reviewed-by: Caolán McNamara <[email protected]>
    Tested-by: Caolán McNamara <[email protected]>
    (cherry picked from commit d0b48fac7e8f73bd058c83d76580496be2c54fe6)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189360
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/xmloff/source/text/xmlcontentcontrolcontext.cxx 
b/xmloff/source/text/xmlcontentcontrolcontext.cxx
index 364cb79cdc30..b105286df96e 100644
--- a/xmloff/source/text/xmlcontentcontrolcontext.cxx
+++ b/xmloff/source/text/xmlcontentcontrolcontext.cxx
@@ -162,7 +162,7 @@ void XMLContentControlContext::startFastElement(
             }
             case XML_ELEMENT(LO_EXT, XML_TAB_INDEX):
             {
-                if (sax::Converter::convertNumber(nTmp, rIter.toView()))
+                if (sax::Converter::convertNumber(nTmp, rIter.toView(), 0, 
SAL_MAX_INT32))
                 {
                     m_nTabIndex = nTmp;
                 }
commit 30bdffb69d8dba0d453aefd488c7d04e58e78216
Author:     Caolán McNamara <[email protected]>
AuthorDate: Tue Aug 12 09:58:41 2025 +0100
Commit:     Xisco Fauli <[email protected]>
CommitDate: Wed Aug 13 20:10:35 2025 +0200

    cid#1660214 Overflowed constant
    
    make types consistent here
    
    Change-Id: I9e0b44d53d0affa2220f956dcaef8a613ff51e7a
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189411
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit e3a9f2bb2f370e76fe641e7de743bf3ed8fc00da)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189482
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/filter/source/msfilter/escherex.cxx 
b/filter/source/msfilter/escherex.cxx
index 1fbba9923dc2..9345454b4dec 100644
--- a/filter/source/msfilter/escherex.cxx
+++ b/filter/source/msfilter/escherex.cxx
@@ -4390,7 +4390,7 @@ struct EscherShapeListEntry
     {}
 };
 
-sal_uInt32 EscherConnectorListEntry::GetClosestPoint( const tools::Polygon& 
rPoly, const awt::Point& rPoint )
+sal_Int32 EscherConnectorListEntry::GetClosestPoint( const tools::Polygon& 
rPoly, const awt::Point& rPoint )
 {
     sal_uInt16 nCount = rPoly.GetSize();
     sal_uInt16 nClosest = nCount;
@@ -4415,9 +4415,9 @@ sal_uInt32 EscherConnectorListEntry::GetClosestPoint( 
const tools::Polygon& rPol
 //          2 ->Bottom      4 ->Bottom
 //          3 ->Right       6 ->Right
 
-sal_uInt32 EscherConnectorListEntry::GetConnectorRule( bool bFirst )
+sal_Int32 EscherConnectorListEntry::GetConnectorRule( bool bFirst )
 {
-    sal_uInt32 nRule = 0;
+    sal_Int32 nRule = 0;
 
     uno::Any aAny;
     awt::Point aRefPoint( bFirst ? maPointA : maPointB );
diff --git a/include/filter/msfilter/escherex.hxx 
b/include/filter/msfilter/escherex.hxx
index d6c1b620f077..6849f7e0611c 100644
--- a/include/filter/msfilter/escherex.hxx
+++ b/include/filter/msfilter/escherex.hxx
@@ -460,7 +460,7 @@ struct MSFILTER_DLLPUBLIC EscherConnectorListEntry
     css::awt::Point                               maPointB;
     css::uno::Reference< css::drawing::XShape >   mXConnectToB;
 
-    sal_uInt32      GetConnectorRule( bool bFirst );
+    sal_Int32       GetConnectorRule( bool bFirst );
 
                     EscherConnectorListEntry( css::uno::Reference< 
css::drawing::XShape > xC,
                                         const css::awt::Point& rPA,
@@ -473,7 +473,7 @@ struct MSFILTER_DLLPUBLIC EscherConnectorListEntry
                                             maPointB    ( rPB ),
                                             mXConnectToB(std::move( xSB )) {}
 
-                    static sal_uInt32 GetClosestPoint( const tools::Polygon& 
rPoly, const css::awt::Point& rP );
+    static sal_Int32 GetClosestPoint(const tools::Polygon& rPoly, const 
css::awt::Point& rP);
 };
 
 struct MSFILTER_DLLPUBLIC EscherExContainer
commit 9855b5818f09d91e5af06a2223688e4fefc5309d
Author:     Caolán McNamara <[email protected]>
AuthorDate: Tue Aug 12 09:47:33 2025 +0100
Commit:     Xisco Fauli <[email protected]>
CommitDate: Wed Aug 13 20:10:28 2025 +0200

    cid#1660359 Overflowed constant
    
    Change-Id: I8bfa4d1280f5173d811314ff6354e57db3d2fcba
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189410
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit 44ffdd91804336ba5bcdbad6a1bcc1747c86d504)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189481
    Reviewed-by: Xisco Fauli <[email protected]>

diff --git a/vcl/source/bitmap/dibtools.cxx b/vcl/source/bitmap/dibtools.cxx
index febcab971b86..c8159604560f 100644
--- a/vcl/source/bitmap/dibtools.cxx
+++ b/vcl/source/bitmap/dibtools.cxx
@@ -1061,15 +1061,25 @@ bool ImplReadDIBFileHeader( SvStream& rIStm, sal_uLong& 
rOffset )
             rIStm.ReadUInt16( nTmp16 );
             rIStm.SeekRel( 8 );
             rIStm.ReadUInt32( nTmp32 );
-            rOffset = nTmp32 - 28;
-            bRet = ( 0x4D42 == nTmp16 );
+            if (nTmp32 < 28)
+                rIStm.SetError(SVSTREAM_FILEFORMAT_ERROR);
+            else
+            {
+                rOffset = nTmp32 - 28;
+                bRet = ( 0x4D42 == nTmp16 );
+            }
         }
         else // 0x4D42 == nTmp16, 'MB' from BITMAPFILEHEADER
         {
             rIStm.SeekRel( 8 );        // we are on bfSize member of 
BITMAPFILEHEADER, forward to bfOffBits
             rIStm.ReadUInt32( nTmp32 );            // read bfOffBits
-            rOffset = nTmp32 - 14;    // adapt offset by 
sizeof(BITMAPFILEHEADER)
-            bRet = rIStm.GetError() == ERRCODE_NONE;
+            if (nTmp32 < 14)
+                rIStm.SetError(SVSTREAM_FILEFORMAT_ERROR);
+            else
+            {
+                rOffset = nTmp32 - 14;    // adapt offset by 
sizeof(BITMAPFILEHEADER)
+                bRet = rIStm.GetError() == ERRCODE_NONE;
+            }
         }
 
         if ( rOffset >= nStreamLength )

Reply via email to