Accepting request 813407 from LibreOffice:Factory

- Fix bsc#1172189 - LO-L3: Impress crashes midway opening a PPTX document
  * bsc1172189.diff

- Fix bsc#1157627 - LO-L3: Some XML-created shapes simply lost upon PPTX import (= earth loses countries)
  * bsc1157627.diff

- Update to 6.4.4.2 bsc#1172795 bsc#1172796:
  * CVE-2020-12802: libreoffice: 'stealth mode' remote resource restrictions bypass
  * CVE-2020-12803: libreoffice: forms in ODF documents can be submitted to file:// URIs

OBS-URL: https://build.opensuse.org/request/show/813407
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/libreoffice?expand=0&rev=205

bsc1157627.diff

@@ -0,0 +1,39 @@
+From d7f313b844be5394af2518fc5843aad80314b9f1 Mon Sep 17 00:00:00 2001
+From: nd101 <Fong@nd.com.cn>
+Date: Tue, 3 Mar 2020 15:19:07 +0800
+Subject: [PATCH] bsc1157627.diff
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+tdf#131082 fix missing fill property of grouped shapes
+
+When shapes are grouped together, and fill property is specified
+at the group level in MSO, it fails to work in IMPRESS.
+
+This fix is to set the fill property when it is being imported.
+
+Change-Id: I89920e71fc558f54d49ef7b065c549a732bc2b10
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/89862
+Tested-by: Jenkins
+Reviewed-by: Xisco Faulí <xiscofauli@libreoffice.org>
+---
+ oox/source/drawingml/shape.cxx | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/oox/source/drawingml/shape.cxx b/oox/source/drawingml/shape.cxx
+index cce8b9ba7bbc..8cb3d00df231 100644
+--- a/oox/source/drawingml/shape.cxx
++++ b/oox/source/drawingml/shape.cxx
+@@ -1042,6 +1042,8 @@ Reference< XShape > const & Shape::createAndInsert(
+             mpTablePropertiesPtr->pushToPropSet( rFilterBase, xSet, mpMasterTextListStyle );
+ 
+         FillProperties aFillProperties = getActualFillProperties(pTheme, &rShapeOrParentShapeFillProps);
++        if (getFillProperties().moFillType.has() && getFillProperties().moFillType.get() == XML_grpFill)
++            getFillProperties().assignUsed(aFillProperties);
+         if(!bIsCroppedGraphic)
+             aFillProperties.pushToPropMap( aShapeProps, rGraphicHelper, mnRotation, nFillPhClr, mbFlipH, mbFlipV );
+         LineProperties aLineProperties = getActualLineProperties(pTheme);
+-- 
+2.26.2
+

bsc1172189.diff

@@ -0,0 +1,76 @@
+From 3c5f6a7f81c5882de6bcd0afcc528e8643d95f35 Mon Sep 17 00:00:00 2001
+From: Miklos Vajna <vmiklos@collabora.com>
+Date: Wed, 10 Jun 2020 11:07:43 +0200
+Subject: [PATCH] PPTX import: handle adjust values from both the shape and its
+ placeholder
+
+The direct problem is a crash in CustomShapeProperties::pushToPropSet(),
+the code just hoped that the input file doesn't have more adjust values
+than the # of adjust values we allocate based on the preset type. Fix
+the crash, but there is a deeper problem here...
+
+The shape can inherit custom shape properties from a placeholder, then
+later it can have its own custom shape properties. When it comes to
+adjust values specifically, we used to just append own adjust values to
+the end of the list. This way we got the double of expected adjust
+values. And later rendering took the N expected adjust values from
+the start of the 2N element list, so we used the adjust values of the
+placeholder, not of the actual shape.
+
+Fix this by clearing the custom shape geometry once we know we have our
+own preset geometry.
+
+(cherry picked from commit 408ec7a4470741edbedbb034de07a2d776348593)
+
+Change-Id: I09f669bf59c33b552b906733d323eba7af5548e7
+---
+ oox/qa/unit/data/preset-adjust-value.pptx     | Bin 0 -> 33233 bytes
+ oox/qa/unit/drawingml.cxx                     |  30 +++++++++++++++++-
+ .../drawingml/customshapeproperties.cxx       |   6 +++-
+ .../drawingml/shapepropertiescontext.cxx      |   5 +++
+ 4 files changed, 39 insertions(+), 2 deletions(-)
+ create mode 100644 oox/qa/unit/data/preset-adjust-value.pptx
+
+diff --git a/oox/source/drawingml/customshapeproperties.cxx b/oox/source/drawingml/customshapeproperties.cxx
+index 2f4848088cc4..4a6e3d9eae6d 100644
+--- a/oox/source/drawingml/customshapeproperties.cxx
++++ b/oox/source/drawingml/customshapeproperties.cxx
+@@ -206,7 +206,11 @@ void CustomShapeProperties::pushToPropSet(
+                                     aAdjustmentVal.Value <<= adjustmentGuide.maFormula.toInt32();
+                                     aAdjustmentVal.State = PropertyState_DIRECT_VALUE;
+                                     aAdjustmentVal.Name = adjustmentGuide.maName;
+-                                    aAdjustmentSeq[ nIndex++ ] = aAdjustmentVal;
++                                    if (nIndex < aAdjustmentSeq.getLength())
++                                    {
++                                        aAdjustmentSeq[nIndex] = aAdjustmentVal;
++                                        ++nIndex;
++                                    }
+                                 }
+                             }
+                             rGeoProp.Value <<= aAdjustmentSeq;
+diff --git a/oox/source/drawingml/shapepropertiescontext.cxx b/oox/source/drawingml/shapepropertiescontext.cxx
+index ffedcfa5bf13..eedc338a25e4 100644
+--- a/oox/source/drawingml/shapepropertiescontext.cxx
++++ b/oox/source/drawingml/shapepropertiescontext.cxx
+@@ -34,6 +34,7 @@
+ #include <oox/helper/attributelist.hxx>
+ #include <oox/token/namespaces.hxx>
+ #include <oox/token/tokens.hxx>
++#include <drawingml/customshapeproperties.hxx>
+
+ using namespace oox::core;
+ using namespace ::com::sun::star;
+@@ -77,6 +78,10 @@ ContextHandlerRef ShapePropertiesContext::onCreateContext( sal_Int32 aElementTok
+             {
+                 mrShape.getServiceName() = "com.sun.star.drawing.CustomShape";
+             }
++
++            // We got a preset geometry, forget the geometry inherited from the placeholder shape.
++            mrShape.getCustomShapeProperties() = std::make_shared<CustomShapeProperties>();
++
+             return new PresetShapeGeometryContext( *this, rAttribs, *(mrShape.getCustomShapeProperties()) );
+         }
+
+--
+2.26.2
+

libreoffice.changes

@@ -1,3 +1,15 @@
+-------------------------------------------------------------------
+Wed Jun 10 19:18:41 UTC 2020 - Andras Timar <andras.timar@collabora.com>
+
+- Fix bsc#1172189 - LO-L3: Impress crashes midway opening a PPTX document
+  * bsc1172189.diff
+
+-------------------------------------------------------------------
+Wed Jun 10 16:17:32 UTC 2020 - Andras Timar <andras.timar@collabora.com>
+
+- Fix bsc#1157627 - LO-L3: Some XML-created shapes simply lost upon PPTX import (= earth loses countries)
+  * bsc1157627.diff
+
 -------------------------------------------------------------------
 Mon Jun  1 18:25:46 UTC 2020 - Andras Timar <andras.timar@collabora.com>
 
@@ -15,7 +27,9 @@ Tue May 26 11:25:10 UTC 2020 - Andras Timar <andras.timar@collabora.com>
 -------------------------------------------------------------------
 Thu May 21 09:12:27 UTC 2020 - Tomáš Chvátal <tchvatal@suse.com>
 
-- Update to 6.4.4.2:
+- Update to 6.4.4.2 bsc#1172795 bsc#1172796:
+  * CVE-2020-12802: libreoffice: 'stealth mode' remote resource restrictions bypass
+  * CVE-2020-12803: libreoffice: forms in ODF documents can be submitted to file:// URIs
   * 6.4.4 release
 - Remove merged patch bsc1160687-1.diff
 

libreoffice.spec

@@ -117,6 +117,10 @@ Patch19:        bsc1165849-2.diff
 Patch20:        bsc1165849-3.diff
 # Bug 1146025 - LO-L3: Colored textboxes in PPTX look very odd (SmartArt)
 Patch21:        bsc1146025.diff
+# Bug 1157627 - LO-L3: Some XML-created shapes simply lost upon PPTX import (= earth loses countries)
+Patch22:        bsc1157627.diff
+# Bug 1172189 - LO-L3: Impress crashes midway opening a PPTX document
+Patch23:        bsc1172189.diff
 # try to save space by using hardlinks
 Patch990:       install-with-hardlinks.diff
 # save time by relying on rpm check rather than doing stupid find+grep
@@ -987,6 +991,8 @@ Provides %{langname} translations and additional resources (help files, etc.) fo
 %patch19 -p1
 %patch20 -p1
 %patch21 -p1
+%patch22 -p1
+%patch23 -p1
 %patch990 -p1
 %patch991 -p1