tdf#94835: crash while loading RTF with \dppolygon token fixed

RTF token \dppolygon now creates a PolyPolygonShape
test included

Change-Id: I065eaac0ca1b8a59f02c3198363180ab244a3942
Reviewed-on: https://gerrit.libreoffice.org/19665Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Oliver Specht <oliver.specht@cib.de>

sw/qa/extras/rtfimport/data/fdo94835.rtf

+{\rtf\ansi
+{\fonttbl{\f1 Tahoma CE}}
+{\colortbl;\red92\green92\blue92;\red0\green0\blue0;\red51\green51\blue51;}
+{\info {\creatim \yr2015 \mo\Oct \dy06 \hr17 \min02 \sec22} {\author Oracle Reports} {\title izvod_40210333000_92015.rtf}  }
+\viewkind1
+\paperw11900\paperh16840
+
+{{\pard \phpg\pvpg\posx0\posy0\absw5000\absh-1\nowrap      {This file was created by Oracle Reports. Please view this document in Page Layout mode.}\par}
+{\pard \qc \pvpg\phpg\posx255\posy16067\absw10920 \absh-195 {\f1\fs14 \cf1 Za sve reklamacije molimo Vas obratite se u najbliu poslovnicu UniCredit Bank d.d. ili u INFO centar tel: 080 081 051\par}}
+{\do \dobxpage\dobypage \dpline \dplinew0 \dplinecor174\dplincog174\dplinecob174\dpfillpat1
+\dpptx0 \dppty0 \dpptx10920 \dppty0 \dpx270 \dpy16027 \dpxsize10920 \dpysize0
+}
+
+{\pard \qc \pvpg\phpg\posx249\posy15838\absw10920 \absh-195 {\f1\fs14 \cf1 UniCredit Bank - www.unicreditbank.ba - info@unicreditgroup.ba\par}}
+{\pard \qr \pvpg\phpg\posx10095\posy598\absw1127 \absh-210 {\f1\fs16 \cf2 1\par}}
+{\do\dobxpage\dobypage\dprect
+\dpx360\dpy6127\dpxsize10965\dpysize1076
+\dplinew0 \dplinesolid\dplinecor92\dplinecog92\dplinecob92
+}
+{\do\dobxpage\dobypage\dprect
+\dpx401\dpy5877\dpxsize1219\dpysize253
+\dpfillfgcr255\dpfillfgcg255\dpfillfgcb255
+\dpfillbgcr235\dpfillbgcg235\dpfillbgcb235\dpfillpat1
+\dplinew0 \dplinehollow 
+}
+{\pard \ql \pvpg\phpg\posx401\posy5877\absw1219 \absh-253 {\f1\fs18 \cf2  Datum \par}}
+{\do\dobxpage\dobypage\dprect
+\dpx1605\dpy5877\dpxsize4860\dpysize253
+\dpfillfgcr255\dpfillfgcg255\dpfillfgcb255
+\dpfillbgcr235\dpfillbgcg235\dpfillbgcb235\dpfillpat1
+\dplinew0 \dplinehollow 
+}
+{\pard \ql \pvpg\phpg\posx1605\posy5877\absw4860 \absh-253 {\f1\fs18 \cf2  Opis prometa\par}}
+{\do\dobxpage\dobypage\dprect
+\dpx6465\dpy5877\dpxsize4800\dpysize253
+\dpfillfgcr255\dpfillfgcg255\dpfillfgcb255
+\dpfillbgcr235\dpfillbgcg235\dpfillbgcb235\dpfillpat1
+\dplinew0 \dplinehollow 
+}
+{\pard \qr \pvpg\phpg\posx6465\posy5877\absw4800 \absh-253 {\f1\fs18 \cf2 Iznos prometa        Novo stanje \par}}
+{\do\dobxpage\dobypage\dprect
+\dpx360\dpy5877\dpxsize10965\dpysize255
+\dplinew0 \dplinesolid\dplinecor92\dplinecog92\dplinecob92
+}
+{\pard \ql \pvpg\phpg\posx441\posy5026\absw5769 \absh-262 {\f1\fs20 \cf3 Prethodno stanje na dan 01.09.2015 iznosi \par}}
+{\do \dobxpage\dobypage \dppolygon \dppolycount6 \dplinew0 \dplinehollow\dplinecor92\dplincog92\dplinecob92\dpfillpat1
+
+\dpfillfgcr255\dpfillfgcg255\dpfillfgcb255\dpfillpat1
+\dpfillbgcr223\dpfillbgcg223\dpfillbgcb223
+\dpptx469 \dppty910 \dpptx469 \dppty1232 \dpptx419 \dppty1282 \dpptx419 \dppty860 \dpptx8230 \dppty860 \dpptx8180 \dppty910 
+\dpx0 \dpy0 \dpxsize7811 \dpysize422
+}
+{\do \dobxpage\dobypage \dppolygon \dppolycount6 \dplinew0 \dplinehollow\dplinecor92\dplincog92\dplinecob92\dpfillpat1
+
+\dpfillfgcr255\dpfillfgcg255\dpfillfgcb255\dpfillpat1
+\dpfillbgcr0\dpfillbgcg0\dpfillbgcb0
+\dpptx8180 \dppty1232 \dpptx469 \dppty1232 \dpptx419 \dppty1282 \dpptx8230 \dppty1282 \dpptx8230 \dppty860 \dpptx8180 \dppty910 
+\dpx0 \dpy0 \dpxsize7811 \dpysize422
+}
+
+{\pard \qr \pvpg\phpg\posx10003\posy960\absw590 \absh-205 {\f1\fs16 \cf3 1\par}}
+{\pard \ql \pvpg\phpg\posx10718\posy960\absw605 \absh-205 {\f1\fs16 \cf3 1\par}}
+{\do \dobxpage\dobypage \dpline \dplinew0 \dplinecor92\dplincog92\dplinecob92\dpfillpat1
+\dpptx0 \dppty0 \dpptx45 \dppty195 \dpx10635 \dpy975 \dpxsize45 \dpysize195
+}
+}}

sw/qa/extras/rtfimport/rtfimport.cxx

@@ -1577,7 +1577,13 @@ DECLARE_RTFIMPORT_TEST(testCp1000018, "cp1000018.rtf")
 }
 
 #endif
-
+DECLARE_RTFIMPORT_TEST(testFdo94835, "fdo94835.rtf")
+{
+    uno::Reference<drawing::XDrawPageSupplier> xDrawPageSupplier(mxComponent, uno::UNO_QUERY);
+    uno::Reference<container::XIndexAccess> xDraws(xDrawPageSupplier->getDrawPage(), uno::UNO_QUERY);
+    // The picture was imported twice.
+    CPPUNIT_ASSERT_EQUAL(sal_Int32(19), xDraws->getCount());
+}
 DECLARE_RTFIMPORT_TEST(testNestedTable, "rhbz1065629.rtf")
 {
     // nested table in second cell was missing

writerfilter/source/rtftok/rtfdocumentimpl.cxx

@@ -3369,6 +3369,7 @@ RTFError RTFDocumentImpl::dispatchFlag(RTFKeyword nKeyword)
     case RTF_DPELLIPSE:
     case RTF_DPTXBX:
     case RTF_DPPOLYLINE:
+    case RTF_DPPOLYGON:
     {
         sal_Int32 nType = 0;
         switch (nKeyword)
@@ -3380,6 +3381,9 @@ RTFError RTFDocumentImpl::dispatchFlag(RTFKeyword nKeyword)
             // The reason this is not a simple CustomShape is that in the old syntax we have no ViewBox info.
             m_aStates.top().aDrawingObject.xShape.set(getModelFactory()->createInstance("com.sun.star.drawing.PolyLineShape"), uno::UNO_QUERY);
             break;
+        case RTF_DPPOLYGON:
+            m_aStates.top().aDrawingObject.xShape.set(getModelFactory()->createInstance("com.sun.star.drawing.PolyPolygonShape"), uno::UNO_QUERY);
+            break;
         case RTF_DPRECT:
             m_aStates.top().aDrawingObject.xShape.set(getModelFactory()->createInstance("com.sun.star.drawing.RectangleShape"), uno::UNO_QUERY);
             break;