ports/editors/openoffice-devel/files/patch-security

Index: comphelper/source/container/embeddedobjectcontainer.cxx
===================================================================
--- comphelper/source/container/embeddedobjectcontainer.cxx	(revision 1813062)
+++ comphelper/source/container/embeddedobjectcontainer.cxx	(working copy)
@@ -127,7 +127,7 @@
     pImpl = new EmbedImpl;
     pImpl->mxStorage = ::comphelper::OStorageHelper::GetTemporaryStorage();
     pImpl->mbOwnsStorage = true;
-    pImpl->mbUserAllowsLinkUpdate = false;
+    pImpl->mbUserAllowsLinkUpdate = true;
     pImpl->mpTempObjectContainer = 0;
 }
 
@@ -136,7 +136,7 @@
     pImpl = new EmbedImpl;
     pImpl->mxStorage = rStor;
     pImpl->mbOwnsStorage = false;
-    pImpl->mbUserAllowsLinkUpdate = false;
+    pImpl->mbUserAllowsLinkUpdate = true;
     pImpl->mpTempObjectContainer = 0;
 }
 
@@ -145,7 +145,7 @@
     pImpl = new EmbedImpl;
     pImpl->mxStorage = rStor;
     pImpl->mbOwnsStorage = false;
-    pImpl->mbUserAllowsLinkUpdate = false;
+    pImpl->mbUserAllowsLinkUpdate = true;
     pImpl->mpTempObjectContainer = 0;
     pImpl->m_xModel = xModel;
 }
Index: sc/source/core/data/documen2.cxx
===================================================================
--- sc/source/core/data/documen2.cxx	(revision 1813062)
+++ sc/source/core/data/documen2.cxx	(working copy)
@@ -229,7 +229,10 @@
 	if ( eMode == SCDOCMODE_DOCUMENT )
 	{
 		if ( pDocShell )
-			pLinkManager = new sfx2::LinkManager( pDocShell );
+		{
+			pLinkManager = new sfx2::LinkManager(pDocShell);
+			pLinkManager->SetAutoAskUpdateAllLinks();
+		}
 
 		xPoolHelper = new ScPoolHelper( this );
 
@@ -269,6 +272,7 @@
     if ( bAutoCalc && !pLinkManager && pShell)
 	{
 		pLinkManager = new sfx2::LinkManager( pShell );
+		pLinkManager->SetAutoAskUpdateAllLinks();
     }
     return pLinkManager; 
 }
Index: sfx2/inc/sfx2/linkmgr.hxx
===================================================================
--- sfx2/inc/sfx2/linkmgr.hxx	(revision 1813062)
+++ sfx2/inc/sfx2/linkmgr.hxx	(working copy)
@@ -54,6 +54,13 @@
 	SvLinkSources aServerTbl;
 
     SfxObjectShell *pPersist; // LinkMgr has to be deallocated before SfxObjectShell
+
+	sal_Bool mAutoAskUpdateAllLinks;
+	sal_Bool mUpdateAsked;
+	sal_Bool mAllowUpdate;
+
+	sal_Bool GetUserAllowsLinkUpdate(Window *pParent);
+	void SetUserAllowsLinkUpdate(SvBaseLink *pLink, sal_Bool allows);
 protected:
 	sal_Bool 		InsertLink( SvBaseLink* pLink, sal_uInt16 nObjType, sal_uInt16 nUpdateType,
 							const String* pName = 0 );
@@ -104,6 +111,10 @@
 
     SvLinkSourceRef CreateObj( SvBaseLink* );
 
+	
+	// Automatically ask user about update all links, on first insert
+	void SetAutoAskUpdateAllLinks();
+
 	void 		UpdateAllLinks( sal_Bool bAskUpdate = sal_True,
 								sal_Bool bCallErrHdl = sal_True,
                                 sal_Bool bUpdateGrfLinks = sal_False,
Index: sfx2/source/appl/linkmgr2.cxx
===================================================================
--- sfx2/source/appl/linkmgr2.cxx	(revision 1813062)
+++ sfx2/source/appl/linkmgr2.cxx	(working copy)
@@ -65,11 +65,12 @@
 SV_IMPL_PTRARR( SvBaseLinks, SvBaseLinkRefPtr )
 
 LinkManager::LinkManager(SfxObjectShell* p)
-	: pPersist( p )
+	: pPersist(p),
+	mUpdateAsked(sal_False),
+	mAutoAskUpdateAllLinks(sal_False)
 {
 }
 
-
 LinkManager::~LinkManager()
 {
 	SvBaseLinkRef** ppRef = (SvBaseLinkRef**)aLinkTbl.GetData();
@@ -157,6 +158,12 @@
 	SvBaseLinkRef* pTmp = new SvBaseLinkRef( pLink );
     pLink->SetLinkManager( this );
 	aLinkTbl.Insert( pTmp, aLinkTbl.Count() );
+	Window *parent = GetPersist()->GetDialogParent();
+	if (mAutoAskUpdateAllLinks)
+	{
+		SetUserAllowsLinkUpdate(pLink, GetUserAllowsLinkUpdate(parent));
+	}
+	
 	return sal_True;
 }
 
@@ -268,7 +275,36 @@
 	return bRet;
 }
 
+void LinkManager::SetAutoAskUpdateAllLinks()
+{
+	mAutoAskUpdateAllLinks = sal_True;
+}
 
+sal_Bool LinkManager::GetUserAllowsLinkUpdate(Window *pParentWin)
+{
+	if (!mUpdateAsked)
+	{
+		if (QueryBox(pParentWin, WB_YES_NO | WB_DEF_NO, SfxResId(STR_QUERY_UPDATE_LINKS)).Execute() == RET_YES)
+			mAllowUpdate = sal_True;
+		else
+			mAllowUpdate = sal_False;
+		mUpdateAsked = sal_True;
+	}
+	return mAllowUpdate;
+}
+
+void LinkManager::SetUserAllowsLinkUpdate(SvBaseLink *pLink, sal_Bool allows)
+{
+	SfxObjectShell* pShell = pLink->GetLinkManager()->GetPersist();
+
+	if (pShell)
+	{
+		comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = pShell->getEmbeddedObjectContainer();
+		rEmbeddedObjectContainer.setUserAllowsLinkUpdate(allows);
+	}
+}
+
+
 void LinkManager::UpdateAllLinks( 
     sal_Bool bAskUpdate, 
     sal_Bool /*bCallErrHdl*/,
@@ -312,26 +348,20 @@
 		if( !pLink->IsVisible() ||
 			( !bUpdateGrfLinks && OBJECT_CLIENT_GRF == pLink->GetObjType() ))
 			continue;
-
-		if( bAskUpdate )
+		
+		sal_Bool allows = sal_True;
+			
+		if (bAskUpdate)
 		{
-            int nRet = QueryBox( pParentWin, WB_YES_NO | WB_DEF_NO, SfxResId( STR_QUERY_UPDATE_LINKS ) ).Execute();
-            SfxObjectShell* pShell = pLink->GetLinkManager()->GetPersist();
+			allows = GetUserAllowsLinkUpdate(pParentWin);
+		}
 
-            if(pShell)
-            {
-                comphelper::EmbeddedObjectContainer& rEmbeddedObjectContainer = pShell->getEmbeddedObjectContainer();
-                rEmbeddedObjectContainer.setUserAllowsLinkUpdate(RET_YES == nRet);
-            }
+		SetUserAllowsLinkUpdate(pLink, allows);
+	    bAskUpdate = sal_False;		// one time is OK
 
-		    if (RET_YES != nRet)
-			{
-				return;		// nothing should be updated
-            }
-			bAskUpdate = sal_False;		// one time is OK
-		}
+		if (allows)
+			pLink->Update();
 
-		pLink->Update();
 	}
 }
 
Index: sw/source/filter/ww8/ww8scan.cxx
===================================================================
--- sw/source/filter/ww8/ww8scan.cxx	(revision 1813062)
+++ sw/source/filter/ww8/ww8scan.cxx	(working copy)
@@ -6467,6 +6467,12 @@
 
     if( nMax )
     {
+        // Check size consistency
+        if(nMax > nFFn)
+        {
+			throw std::out_of_range("WW8 beyond end of buffer");            
+        }
+
         // allocate Index Array
         pFontA = new WW8_FFN[ nMax ];
         p = pFontA;
@@ -6585,6 +6591,7 @@
 
                 // Zeiger auf Ursprungsarray einen Font nach hinten setzen
                 pVer8 = (WW8_FFN_Ver8*)( ((sal_uInt8*)pVer8) + pVer8->cbFfnM1 + 1 );
+
             }
         }
     }