svx/source/svdraw/svdpage.cxx       |    4 ++--
 sw/source/filter/ww8/docxexport.cxx |    5 +++++
 sw/source/filter/ww8/docxexport.hxx |    2 ++
 sw/source/filter/ww8/rtfexport.hxx  |    2 ++
 sw/source/filter/ww8/wrtw8sty.cxx   |    1 +
 sw/source/filter/ww8/wrtww8.hxx     |    4 ++++
 6 files changed, 16 insertions(+), 2 deletions(-)

New commits:
commit 960e315c6ebdf5fb566b20c6a1936db07edc0d2a
Author:     Caolán McNamara <[email protected]>
AuthorDate: Tue Jan 13 21:15:14 2026 +0000
Commit:     Xisco Fauli <[email protected]>
CommitDate: Thu Jan 15 12:46:37 2026 +0100

    Don't null-deref if pView is not present
    
    And default to COL_WHITE as view background if not present.
    
    Related: tdf#168710
    Change-Id: I184fb018d16ac83381b689093e751167bad2c2fb
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/197222
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit 1772c60c7a8b31edd1baebf60b0b589dc6d865df)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/197254
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit a93fb25df806bb00f60fa652de066ab9420eb732)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/197299

diff --git a/svx/source/svdraw/svdpage.cxx b/svx/source/svdraw/svdpage.cxx
index 2f754255967c..bee2bc5f6d6c 100644
--- a/svx/source/svdraw/svdpage.cxx
+++ b/svx/source/svdraw/svdpage.cxx
@@ -1792,7 +1792,7 @@ SfxStyleSheet* SdrPage::GetTextStyleSheetForObject( 
SdrObject* pObj ) const
 // #i75566# GetBackgroundColor -> GetPageBackgroundColor and bScreenDisplay 
hint value
 Color SdrPage::GetPageBackgroundColor( SdrPageView const * pView, bool 
bScreenDisplay ) const
 {
-    Color aColor;
+    Color aColor(COL_WHITE);
 
     if(bScreenDisplay && (!pView || pView->GetApplicationDocumentColor() == 
COL_AUTO))
     {
@@ -1804,7 +1804,7 @@ Color SdrPage::GetPageBackgroundColor( SdrPageView const 
* pView, bool bScreenDi
             aColor = aColorConfig.GetColorValue( svtools::DOCCOLOR ).nColor;
         }
     }
-    else
+    else if (pView)
     {
         aColor = pView->GetApplicationDocumentColor();
     }
commit 12b8d0102ac9fca65706b810502610b51f1517ae
Author:     Noel Grandin <[email protected]>
AuthorDate: Wed Jan 14 11:07:21 2026 +0200
Commit:     Xisco Fauli <[email protected]>
CommitDate: Thu Jan 15 12:46:27 2026 +0100

    officeotron: fillcolor is not valid for framePr
    
    because of some generic code adding attributes to the flyAttrList, we end 
with:
    
    <w:pPr>
        ...
        <w:framePr fillcolor="#FF00FF"/>
    
    inside word/header1.xml, which is not valid.
    
    Unfortunately, the code structure here does not allow an elegant solution,
    we need a new virtual method to be able to get at the flyAttrList and clear 
it,
    to prevent attributes leaking into elements they are not meant for.
    
    Change-Id: I2bfd6b1afd78e722a29d79cf853a4678b7d0dea4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/197248
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit f748949b6ffe6e8ef2a7fd27c70669efe8ac3818)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/197297
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit 71928bd740832dbc75b856252edf999afd678d70)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/197315

diff --git a/sw/source/filter/ww8/docxexport.cxx 
b/sw/source/filter/ww8/docxexport.cxx
index 10313ee9c4ea..7548c3499b68 100644
--- a/sw/source/filter/ww8/docxexport.cxx
+++ b/sw/source/filter/ww8/docxexport.cxx
@@ -725,6 +725,11 @@ void DocxExport::PrepareNewPageDesc( const SfxItemSet* 
pSet,
 
 }
 
+void DocxExport::ClearFlyAttrList()
+{
+    SdrExporter().getFlyAttrList().clear();
+}
+
 void DocxExport::InitStyles()
 {
     m_pStyles.reset(new MSWordStyles( *this, /*bListStyles =*/ true ));
diff --git a/sw/source/filter/ww8/docxexport.hxx 
b/sw/source/filter/ww8/docxexport.hxx
index d8ee2bc50caf..2b8253b9a03e 100644
--- a/sw/source/filter/ww8/docxexport.hxx
+++ b/sw/source/filter/ww8/docxexport.hxx
@@ -238,6 +238,8 @@ protected:
                                      const SwPageDesc* pNewPgDesc,
                                      bool bExtraPageBreak = false) override;
 
+    virtual void ClearFlyAttrList() override;
+
 private:
     /// Setup pStyles and write styles.xml
     void InitStyles();
diff --git a/sw/source/filter/ww8/rtfexport.hxx 
b/sw/source/filter/ww8/rtfexport.hxx
index 6b285dbab485..2187a789993a 100644
--- a/sw/source/filter/ww8/rtfexport.hxx
+++ b/sw/source/filter/ww8/rtfexport.hxx
@@ -147,6 +147,8 @@ protected:
     void AppendSection(const SwPageDesc* pPageDesc, const SwSectionFormat* 
pFormat,
                        sal_uLong nLnNum) override;
 
+    void ClearFlyAttrList() override {}
+
 public:
     /// Pass the pDocument, pCurrentPam and pOriginalPam to the base class.
     RtfExport(RtfExportFilter* pFilter, SwDoc& rDocument, 
std::shared_ptr<SwUnoCursor>& pCurrentPam,
diff --git a/sw/source/filter/ww8/wrtw8sty.cxx 
b/sw/source/filter/ww8/wrtw8sty.cxx
index 1b4b4d4f9493..e5e9436d761e 100644
--- a/sw/source/filter/ww8/wrtw8sty.cxx
+++ b/sw/source/filter/ww8/wrtw8sty.cxx
@@ -1867,6 +1867,7 @@ void MSWordExportBase::SectionProperties( const 
WW8_SepInfo& rSepInfo, WW8_PdAtt
             }
 
             AttrOutput().OutputStyleItemSet( pPdFormat->GetAttrSet(), false );
+            ClearFlyAttrList(); // so they do not leak into other elements
 
             if (titlePage)
             {
diff --git a/sw/source/filter/ww8/wrtww8.hxx b/sw/source/filter/ww8/wrtww8.hxx
index dc7f37e3d959..7346a6a57f1b 100644
--- a/sw/source/filter/ww8/wrtww8.hxx
+++ b/sw/source/filter/ww8/wrtww8.hxx
@@ -925,6 +925,8 @@ protected:
 
     virtual bool IsDummyFloattableAnchor(SwNode& /*rNode*/) const { return 
false; }
 
+    virtual void ClearFlyAttrList() = 0;
+
 public:
     MSWordExportBase(SwDoc& rDocument, std::shared_ptr<SwUnoCursor> & 
pCurrentPam, SwPaM* pOriginalPam);
     virtual ~MSWordExportBase();
@@ -1224,6 +1226,8 @@ protected:
 
     virtual void AppendSection( const SwPageDesc *pPageDesc, const 
SwSectionFormat* pFormat, sal_uLong nLnNum ) override;
 
+    virtual void ClearFlyAttrList() override {}
+
 private:
     WW8Export(const WW8Export&) = delete;
     WW8Export& operator=(const WW8Export&) = delete;

Reply via email to