fdo#49666 RTF import: fix crash on picture frame with shape text

The bugdoc contains a shape with type 75 (ESCHER_ShpInst_PictureFrame),
which also has a shape text. Looks like this is an RTF which is
generated by some 3rd-party tool: Word can open it, but it doesn't show
the text on the picture frame, either.

So, let's just ignore the shape text for picture frames at RTF import
time as well, that avoids the crash.

Change-Id: If673122eb16f4a4f7eddf107877fcfa7cb052821

writerfilter/qa/cppunittests/rtftok/data/pass/fdo49666.rtf

+{\rtf1 \ansi \ansicpg1252 \uc1 \deff1 \deflang1033 \deflangfe1033 
+{\shp 
+{\*\shpinst \shpleft144 \shptop490 \shpright2049 \shpbottom1840 \shpfhdr1 \shpbxcolumn \shpbypara \shpwr4 \shpwrk2 \shpfblwtxt1 \shpz0 \shplid2053 
+{\sp 
+{\sn shapeType}
+{\sv 75}
+}
+{\shptxt foo
+}
+}
+}
+\par
+}

writerfilter/source/rtftok/rtfdocumentimpl.cxx

@@ -1466,18 +1466,36 @@ int RTFDocumentImpl::dispatchDestination(RTFKeyword nKeyword)
             break;
         case RTF_SHPTXT:
         case RTF_DPTXBXTEXT:
-            m_aStates.top().nDestinationState = DESTINATION_SHAPETEXT;
-            checkFirstRun();
-            dispatchFlag(RTF_PARD);
-            m_bNeedPap = true;
-            if (nKeyword == RTF_SHPTXT)
             {
-                if (!m_aStates.top().pCurrentBuffer)
-                    m_pSdrImport->resolve(m_aStates.top().aShape, false);
+                bool bPictureFrame = false;
+                for (size_t i = 0; i < m_aStates.top().aShape.aProperties.size(); ++i)
+                {
+                    std::pair<OUString, OUString>& rProperty = m_aStates.top().aShape.aProperties[i];
+                    if (rProperty.first == "shapeType" && rProperty.second == OUString::number(ESCHER_ShpInst_PictureFrame))
+                    {
+                        bPictureFrame = true;
+                        break;
+                    }
+                }
+                if (bPictureFrame)
+                    // Skip text on picture frames.
+                    m_aStates.top().nDestinationState = DESTINATION_SKIP;
                 else
                 {
-                    RTFValue::Pointer_t pValue(new RTFValue(m_aStates.top().aShape));
-                    m_aStates.top().pCurrentBuffer->push_back(make_pair(BUFFER_STARTSHAPE, pValue));
+                    m_aStates.top().nDestinationState = DESTINATION_SHAPETEXT;
+                    checkFirstRun();
+                    dispatchFlag(RTF_PARD);
+                    m_bNeedPap = true;
+                    if (nKeyword == RTF_SHPTXT)
+                    {
+                        if (!m_aStates.top().pCurrentBuffer)
+                            m_pSdrImport->resolve(m_aStates.top().aShape, false);
+                        else
+                        {
+                            RTFValue::Pointer_t pValue(new RTFValue(m_aStates.top().aShape));
+                            m_aStates.top().pCurrentBuffer->push_back(make_pair(BUFFER_STARTSHAPE, pValue));
+                        }
+                    }
                 }
             }
             break;