online.git: engine/vcl

["Andras Timar (via cogerrit)"]

engine/vcl/inc/quartz/salgdi.h | 1 +
engine/vcl/ios/salios.cxx | 6 +++---
engine/vcl/quartz/salgdi.cxx | 7 +++++++
engine/vcl/quartz/salvd.cxx | 2 +-
4 files changed, 12 insertions(+), 4 deletions(-)

New commits:
commit e346b0e4d6364b65615779a5c53e353fd02f60a1
Author: Andras Timar <andras...@collabora.com>
AuthorDate: Tue May 5 14:36:02 2026 +0200
Commit: Andras Timar <andras...@collabora.com>
CommitDate: Tue May 5 18:53:08 2026 +0000

vcl: catch iOS port up to upstream VCL signature changes

The iOS build was failing because:
- SalVirtualDevice was not forward-declared on the iOS include path
(osx/saldata.hxx pulls it in for macOS, no equivalent on iOS).
- vcl/quartz/salgdi.cxx unconditionally required Skia and tried to
instantiate AquaSkiaSalGraphicsImpl, but Skia is not built for iOS.
- AquaSalVirtualDevice::SetSize and SalGraphicsImpl::getBitmap gained
new parameters (bAlphaMaskTransparent / bWithoutAlpha) that the iOS
call sites and override had not been updated for.

Forward-declare SalVirtualDevice, gate the Skia bits behind ifndef IOS
(falling back to AquaGraphicsBackend on iOS), and align the iOS-side
signatures. bAlphaMaskTransparent is accepted but unused on iOS for
now; macOS uses it to choose a transparent vs opaque alpha fill.

Signed-off-by: Andras Timar <andras...@collabora.com>
Change-Id: I1f6c7de2e133f17ecb795dbff756420c425ce39c
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2020

diff --git a/engine/vcl/inc/quartz/salgdi.h b/engine/vcl/inc/quartz/salgdi.h
index 8c5ef72fd736..6ae082fa79af 100644
--- a/engine/vcl/inc/quartz/salgdi.h
+++ b/engine/vcl/inc/quartz/salgdi.h
@@ -55,6 +55,7 @@
#include <quartz/CGHelpers.hxx>

class AquaSalFrame;
+class SalVirtualDevice;
class XorEmulation;
class CoreTextFont;

diff --git a/engine/vcl/ios/salios.cxx b/engine/vcl/ios/salios.cxx
index 558949955579..f42ff69c6650 100644
--- a/engine/vcl/ios/salios.cxx
+++ b/engine/vcl/ios/salios.cxx
@@ -181,9 +181,9 @@ void AquaGraphicsBackend::copyBits(const SalTwoRect& rPosAry, SalGraphics *pSrcG
{
std::shared_ptr<SalBitmap> pBitmap;
if (pSrcGraphics)
- pBitmap = pSrcGraphics->GetImpl()->getBitmap(rPosAry.mnSrcX, rPosAry.mnSrcY, rPosAry.mnSrcWidth, rPosAry.mnSrcHeight);
+ pBitmap = pSrcGraphics->GetImpl()->getBitmap(rPosAry.mnSrcX, rPosAry.mnSrcY, rPosAry.mnSrcWidth, rPosAry.mnSrcHeight, /*bWithoutAlpha*/ false);
else
- pBitmap = getBitmap(rPosAry.mnSrcX, rPosAry.mnSrcY, rPosAry.mnSrcWidth, rPosAry.mnSrcHeight);
+ pBitmap = getBitmap(rPosAry.mnSrcX, rPosAry.mnSrcY, rPosAry.mnSrcWidth, rPosAry.mnSrcHeight, /*bWithoutAlpha*/ false);

if (pBitmap)
{
@@ -507,7 +507,7 @@ void AquaSalVirtualDevice::Destroy()
}
}

-bool AquaSalVirtualDevice::SetSize( tools::Long nDX, tools::Long nDY )
+bool AquaSalVirtualDevice::SetSize( tools::Long nDX, tools::Long nDY, bool /*bAlphaMaskTransparent*/ )
{
SAL_INFO( "vcl.virdev", "AquaSalVirtualDevice::SetSize() this=" << this <<
" (" << nDX << "x" << nDY << ") mbForeignContext=" << (mbForeignContext ? "YES" : "NO"));
diff --git a/engine/vcl/quartz/salgdi.cxx b/engine/vcl/quartz/salgdi.cxx
index 91b0a1e17f11..7babc36e0f90 100644
--- a/engine/vcl/quartz/salgdi.cxx
+++ b/engine/vcl/quartz/salgdi.cxx
@@ -60,10 +60,12 @@

#include <config_features.h>
#include <vcl/skia/SkiaHelper.hxx>
+#ifndef IOS
#if !HAVE_FEATURE_SKIA
static_assert(false, "skia is required on macOS");
#endif
#include <skia/osx/gdiimpl.hxx>
+#endif

#include <quartz/SystemFontList.hxx>
#include <quartz/CoreTextFont.hxx>
@@ -146,8 +148,13 @@ AquaSalGraphics::AquaSalGraphics(bool bPrinter)
mpBackend.reset(new AquaGraphicsBackend(maShared));
else
{
+#ifdef IOS
+ // Skia is not built for iOS; use the plain Quartz backend.
+ mpBackend.reset(new AquaGraphicsBackend(maShared));
+#else
assert(SkiaHelper::isVCLSkiaEnabled() && "skia is required on macOS");
mpBackend.reset(new AquaSkiaSalGraphicsImpl(*this, maShared));
+#endif
}

for (int i = 0; i < MAX_FALLBACK; ++i)
diff --git a/engine/vcl/quartz/salvd.cxx b/engine/vcl/quartz/salvd.cxx
index 643c172ed198..721e6a9c6fc9 100644
--- a/engine/vcl/quartz/salvd.cxx
+++ b/engine/vcl/quartz/salvd.cxx
@@ -48,7 +48,7 @@ std::unique_ptr<SalVirtualDevice> AquaSalInstance::CreateVirtualDevice( SalGraph
#ifdef IOS
(void)rGraphics;
std::unique_ptr<SalVirtualDevice> pNew(new AquaSalVirtualDevice( nullptr, nDX, nDY, eFormat, bAlphaMaskTransparent ));
- pNew->SetSize( nDX, nDY );
+ pNew->SetSize( nDX, nDY, bAlphaMaskTransparent );
return pNew;
#else
return std::unique_ptr<SalVirtualDevice>(new AquaSalVirtualDevice( static_cast< AquaSalGraphics* >(&rGraphics),

["Caolán McNamara (via cogerrit)"]

engine/vcl/source/gdi/CommonSalLayout.cxx | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)

New commits:
commit 22c19be8fae977a90f83a82d8acccd0b46c7cf20
Author: Caolán McNamara <caolan....@collabora.com>
AuthorDate: Wed May 6 15:37:30 2026 +0100
Commit: Caolán McNamara <caolan....@collabora.com>
CommitDate: Fri May 8 07:37:00 2026 +0000

check for hb_shape_full failure

Signed-off-by: Caolán McNamara <caolan....@collabora.com>
Change-Id: I5fafcb7d592fb4c9091cb2bab64cb6ac47462d71
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2102
Reviewed-by: Miklos Vajna <vmi...@collabora.com>

diff --git a/engine/vcl/source/gdi/CommonSalLayout.cxx b/engine/vcl/source/gdi/CommonSalLayout.cxx
index 4b26916a5ef6..37fbe06400fb 100644
--- a/engine/vcl/source/gdi/CommonSalLayout.cxx
+++ b/engine/vcl/source/gdi/CommonSalLayout.cxx
@@ -203,10 +203,11 @@ public:
// The shapers that we want HarfBuzz to use, in the order of
// preference.
const char* const pHbShapers[] = { "graphite2", "ot", "fallback", nullptr };
- bool ok
- = hb_shape_full(pHbFont, m_pHbBuffer, maFeatures.data(), maFeatures.size(), pHbShapers);
- assert(ok);
- (void)ok;
+ if (!hb_shape_full(pHbFont, m_pHbBuffer, maFeatures.data(), maFeatures.size(), pHbShapers))
+ {
+ SAL_WARN("vcl.harfbuzz", "hb_shape_full failed");
+ hb_buffer_set_length(m_pHbBuffer, 0);
+ }

int nRunGlyphCount = hb_buffer_get_length(m_pHbBuffer);
hb_glyph_info_t* pHbGlyphInfos = hb_buffer_get_glyph_infos(m_pHbBuffer, nullptr);
@@ -603,9 +604,11 @@ bool GenericSalLayout::LayoutText(vcl::text::ImplLayoutArgs& rArgs, const SalLay
// The shapers that we want HarfBuzz to use, in the order of
// preference.
const char*const pHbShapers[] = { "graphite2", "ot", "fallback", nullptr };
- bool ok = hb_shape_full(pHbFont, pHbBuffer, maFeatures.data(), maFeatures.size(), pHbShapers);
- assert(ok);
- (void) ok;
+ if (!hb_shape_full(pHbFont, pHbBuffer, maFeatures.data(), maFeatures.size(), pHbShapers))
+ {
+ SAL_WARN("vcl.harfbuzz", "hb_shape_full failed");
+ hb_buffer_set_length(pHbBuffer, 0);
+ }

// Populate glyph cluster remapping data
stClusterMapper.ShapeSubRun(pStr, nLength, aSubRun, pHbFont, maFeatures, oHbLanguage);

["Shardul Vikram Singh (via cogerrit)"]

engine/vcl/jsdialog/enabled.cxx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 892b972be4c6b89ddacc6bca765aa82a39ab4829
Author: Shardul Vikram Singh <shardu...@collabora.com>
AuthorDate: Wed May 6 15:34:22 2026 +0530
Commit: Szymon Kłos <szymo...@collabora.com>
CommitDate: Mon May 11 09:24:59 2026 +0000

rename querysetinsmodedialog.ui to querydialog.ui in enabled.cxx

Follow-up to commit 35487636dad4 which renamed the .ui file

Signed-off-by: Shardul Vikram Singh <shardu...@collabora.com>
Change-Id: Ia6a5b39a347091954ccd0197fc3a1278f526bb22
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2083
Tested-by: Jenkins CPCI <rel...@collaboraoffice.com>
Reviewed-by: Pedro Silva <pedro...@collabora.com>

diff --git a/engine/vcl/jsdialog/enabled.cxx b/engine/vcl/jsdialog/enabled.cxx
index 4618e61098c9..ac0a48d12e7b 100644
--- a/engine/vcl/jsdialog/enabled.cxx
+++ b/engine/vcl/jsdialog/enabled.cxx
@@ -117,7 +117,7 @@ constexpr auto CuiDialogList
{ u"cui/ui/slantcornertabpage.ui" },
{ u"cui/ui/spinbox.ui" },
{ u"cui/ui/queryduplicatedialog.ui" },
- { u"cui/ui/querysetinsmodedialog.ui" },
+ { u"cui/ui/querydialog.ui" },
{ u"cui/ui/searchattrdialog.ui" },
{ u"cui/ui/searchformatdialog.ui" },
{ u"cui/ui/similaritysearchdialog.ui" },

["Skyler Grey (via cogerrit)"]

engine/vcl/source/filter/png/PngImageWriter.cxx | 8 ++++++++
1 file changed, 8 insertions(+)

New commits:
commit 479f3dd962af3f5a3eb16d2ac38bf73bafef5b44
Author: Skyler Grey <skyle...@collabora.com>
AuthorDate: Thu May 7 12:52:15 2026 +0000
Commit: Tomaž Vajngerl <tomaz.v...@collabora.com>
CommitDate: Tue May 12 06:46:13 2026 +0000

fix(iOS): prevent png crash

It seems like this scanline format is used, and when it's missing we hit
a failing assert. It seems to already be handleable by other code, so
the only piece missing is to add it as an option to this switch/case
here

Change-Id: I7eb67e1a1353eb8d7025f024b4b6819f6a6a6964
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2192
Tested-by: Jenkins CPCI <rel...@collaboraoffice.com>
Reviewed-by: Tomaž Vajngerl <tomaz.v...@collabora.com>

diff --git a/engine/vcl/source/filter/png/PngImageWriter.cxx b/engine/vcl/source/filter/png/PngImageWriter.cxx
index 1b9dd097a5af..fe996162f319 100644
--- a/engine/vcl/source/filter/png/PngImageWriter.cxx
+++ b/engine/vcl/source/filter/png/PngImageWriter.cxx
@@ -237,6 +237,14 @@ static bool pngWrite(SvStream& rStream, const Graphic& rGraphic, int nCompressio
bCombineChannels = true;
break;
}
+ case ScanlineFormat::N32BitTcArgb:
+ {
+ assert(aBitmap.HasAlpha());
+ colorType = PNG_COLOR_TYPE_RGB_ALPHA;
+ bitDepth = 8;
+ bCombineChannels = true;
+ break;
+ }
default:
{
assert(false);

["Noel Grandin (via cogerrit)"]

engine/vcl/inc/animate/AnimationRenderer.hxx | 2
engine/vcl/qa/cppunit/BitmapFilterTest.cxx | 60 ++++++++++-----------------
engine/vcl/qa/cppunit/animationrenderer.cxx | 25 ++++-------
3 files changed, 36 insertions(+), 51 deletions(-)

New commits:
commit fe4442d9c08014d67b9089efe1075a836ca1ce79
Author: Noel Grandin <noel.g...@collabora.co.uk>
AuthorDate: Thu May 7 13:15:33 2026 +0200
Commit: Michael Stahl <michae...@collabora.com>
CommitDate: Tue May 12 10:51:51 2026 +0000

fix some trivial leaks in vcl test code

found by running under ASAN with detect_leaks=1

Change-Id: I2c3be259af870de43f56ad7371b6fa7245847312
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2186
Tested-by: Jenkins CPCI <rel...@collaboraoffice.com>
Reviewed-by: Michael Stahl <michae...@collabora.com>

diff --git a/engine/vcl/inc/animate/AnimationRenderer.hxx b/engine/vcl/inc/animate/AnimationRenderer.hxx
index a8d876704fd1..074042333048 100644
--- a/engine/vcl/inc/animate/AnimationRenderer.hxx
+++ b/engine/vcl/inc/animate/AnimationRenderer.hxx
@@ -69,7 +69,7 @@ public:
const Point& rPt, const Size& rSz, sal_uLong nRendererId,
OutputDevice* pFirstFrameOutDev = nullptr );
AnimationRenderer(AnimationRenderer&&) = delete;
- SAL_DLLPRIVATE ~AnimationRenderer();
+ ~AnimationRenderer();

bool matches(const OutputDevice* pOut, tools::Long nRendererId) const;
void drawToIndex( sal_uLong nIndex );
diff --git a/engine/vcl/qa/cppunit/BitmapFilterTest.cxx b/engine/vcl/qa/cppunit/BitmapFilterTest.cxx
index f0191d876d2b..d3f9bb177020 100644
--- a/engine/vcl/qa/cppunit/BitmapFilterTest.cxx
+++ b/engine/vcl/qa/cppunit/BitmapFilterTest.cxx
@@ -333,26 +333,23 @@ void BitmapFilterTest::testMultiplyBlendFilter()

// same color
{
- BitmapMultiplyBlendFilter* pArithmeticFilter
- = new BitmapMultiplyBlendFilter(aRedBitmap, aRedBitmap);
- Bitmap aResBitmap = pArithmeticFilter->execute();
+ BitmapMultiplyBlendFilter aArithmeticFilter(aRedBitmap, aRedBitmap);
+ Bitmap aResBitmap = aArithmeticFilter.execute();
CPPUNIT_ASSERT_EQUAL(COL_LIGHTRED, aResBitmap.GetPixelColor(2, 2));
}

// different color
{
- BitmapMultiplyBlendFilter* pArithmeticFilter
- = new BitmapMultiplyBlendFilter(aRedBitmap, aGreenBitmap);
- Bitmap aResBitmap = pArithmeticFilter->execute();
+ BitmapMultiplyBlendFilter aArithmeticFilter(aRedBitmap, aGreenBitmap);
+ Bitmap aResBitmap = aArithmeticFilter.execute();
CPPUNIT_ASSERT_EQUAL(Color(ColorAlpha, 0xFF, 0x00, 0x00, 0x00),
aResBitmap.GetPixelColor(2, 2));
}

// transparent
{
- BitmapMultiplyBlendFilter* pArithmeticFilter
- = new BitmapMultiplyBlendFilter(aRedBitmap, aTransparentBitmap);
- Bitmap aResBitmap = pArithmeticFilter->execute();
+ BitmapMultiplyBlendFilter aArithmeticFilter(aRedBitmap, aTransparentBitmap);
+ Bitmap aResBitmap = aArithmeticFilter.execute();
CPPUNIT_ASSERT_EQUAL(Color(ColorAlpha, 0xFF, 0xFF, 0x00, 0x00),
aResBitmap.GetPixelColor(2, 2));
}
@@ -383,26 +380,23 @@ void BitmapFilterTest::testNormalBlendFilter()

// same color
{
- BitmapNormalBlendFilter* pArithmeticFilter
- = new BitmapNormalBlendFilter(aRedBitmap, aRedBitmap);
- Bitmap aResBitmap = pArithmeticFilter->execute();
+ BitmapNormalBlendFilter aArithmeticFilter(aRedBitmap, aRedBitmap);
+ Bitmap aResBitmap = aArithmeticFilter.execute();
CPPUNIT_ASSERT_EQUAL(COL_LIGHTRED, aResBitmap.GetPixelColor(2, 2));
}

// different color
{
- BitmapNormalBlendFilter* pArithmeticFilter
- = new BitmapNormalBlendFilter(aRedBitmap, aGreenBitmap);
- Bitmap aResBitmap = pArithmeticFilter->execute();
+ BitmapNormalBlendFilter aArithmeticFilter(aRedBitmap, aGreenBitmap);
+ Bitmap aResBitmap = aArithmeticFilter.execute();
CPPUNIT_ASSERT_EQUAL(Color(ColorAlpha, 0xFF, 0xFF, 0x00, 0x00),
aResBitmap.GetPixelColor(2, 2));
}

// transparent
{
- BitmapNormalBlendFilter* pArithmeticFilter
- = new BitmapNormalBlendFilter(aRedBitmap, aTransparentBitmap);
- Bitmap aResBitmap = pArithmeticFilter->execute();
+ BitmapNormalBlendFilter aArithmeticFilter(aRedBitmap, aTransparentBitmap);
+ Bitmap aResBitmap = aArithmeticFilter.execute();
CPPUNIT_ASSERT_EQUAL(Color(ColorAlpha, 0xFF, 0xFF, 0x00, 0x00),
aResBitmap.GetPixelColor(2, 2));
}
@@ -480,26 +474,23 @@ void BitmapFilterTest::testLightenBlendFilter()

// same color
{
- BitmapLightenBlendFilter* pArithmeticFilter
- = new BitmapLightenBlendFilter(aRedBitmap, aRedBitmap);
- Bitmap aResBitmap = pArithmeticFilter->execute();
+ BitmapLightenBlendFilter aArithmeticFilter(aRedBitmap, aRedBitmap);
+ Bitmap aResBitmap = aArithmeticFilter.execute();
CPPUNIT_ASSERT_EQUAL(COL_LIGHTRED, aResBitmap.GetPixelColor(2, 2));
}

// different color
{
- BitmapLightenBlendFilter* pArithmeticFilter
- = new BitmapLightenBlendFilter(aRedBitmap, aGreenBitmap);
- Bitmap aResBitmap = pArithmeticFilter->execute();
+ BitmapLightenBlendFilter aArithmeticFilter(aRedBitmap, aGreenBitmap);
+ Bitmap aResBitmap = aArithmeticFilter.execute();
CPPUNIT_ASSERT_EQUAL(Color(ColorAlpha, 0xFF, 0xFF, 0x80, 0x00),
aResBitmap.GetPixelColor(2, 2));
}

// transparent
{
- BitmapLightenBlendFilter* pArithmeticFilter
- = new BitmapLightenBlendFilter(aRedBitmap, aTransparentBitmap);
- Bitmap aResBitmap = pArithmeticFilter->execute();
+ BitmapLightenBlendFilter aArithmeticFilter(aRedBitmap, aTransparentBitmap);
+ Bitmap aResBitmap = aArithmeticFilter.execute();
CPPUNIT_ASSERT_EQUAL(Color(ColorAlpha, 0xFF, 0xFF, 0xFF, 0xFF),
aResBitmap.GetPixelColor(2, 2));
}
@@ -530,26 +521,23 @@ void BitmapFilterTest::testScreenBlendFilter()

// same color
{
- BitmapScreenBlendFilter* pArithmeticFilter
- = new BitmapScreenBlendFilter(aRedBitmap, aRedBitmap);
- Bitmap aResBitmap = pArithmeticFilter->execute();
+ BitmapScreenBlendFilter aArithmeticFilter(aRedBitmap, aRedBitmap);
+ Bitmap aResBitmap = aArithmeticFilter.execute();
CPPUNIT_ASSERT_EQUAL(COL_LIGHTRED, aResBitmap.GetPixelColor(2, 2));
}

// different color
{
- BitmapScreenBlendFilter* pArithmeticFilter
- = new BitmapScreenBlendFilter(aRedBitmap, aGreenBitmap);
- Bitmap aResBitmap = pArithmeticFilter->execute();
+ BitmapScreenBlendFilter aArithmeticFilter(aRedBitmap, aGreenBitmap);
+ Bitmap aResBitmap = aArithmeticFilter.execute();
CPPUNIT_ASSERT_EQUAL(Color(ColorAlpha, 0xFF, 0xFF, 0x80, 0x00),
aResBitmap.GetPixelColor(2, 2));
}

// transparent
{
- BitmapScreenBlendFilter* pArithmeticFilter
- = new BitmapScreenBlendFilter(aRedBitmap, aTransparentBitmap);
- Bitmap aResBitmap = pArithmeticFilter->execute();
+ BitmapScreenBlendFilter aArithmeticFilter(aRedBitmap, aTransparentBitmap);
+ Bitmap aResBitmap = aArithmeticFilter.execute();
CPPUNIT_ASSERT_EQUAL(Color(ColorAlpha, 0xFF, 0xFF, 0xFF, 0xFF),
aResBitmap.GetPixelColor(2, 2));
}
diff --git a/engine/vcl/qa/cppunit/animationrenderer.cxx b/engine/vcl/qa/cppunit/animationrenderer.cxx
index f1564e011b90..86a93b609169 100644
--- a/engine/vcl/qa/cppunit/animationrenderer.cxx
+++ b/engine/vcl/qa/cppunit/animationrenderer.cxx
@@ -61,13 +61,12 @@ CPPUNIT_TEST_FIXTURE(VclAnimationRendererTest, testMatching)
Animation aTestAnim = createAnimation();
ScopedVclPtrInstance<TestRenderingContext> pTestRC;

- AnimationRenderer* pAnimationRenderer
- = new AnimationRenderer(&aTestAnim, pTestRC, Point(0, 0), Size(10, 10), 5);
- CPPUNIT_ASSERT(pAnimationRenderer->matches(pTestRC, 5));
- CPPUNIT_ASSERT(!pAnimationRenderer->matches(pTestRC, 10));
+ AnimationRenderer aAnimationRenderer(&aTestAnim, pTestRC, Point(0, 0), Size(10, 10), 5);
+ CPPUNIT_ASSERT(aAnimationRenderer.matches(pTestRC, 5));
+ CPPUNIT_ASSERT(!aAnimationRenderer.matches(pTestRC, 10));

// caller ID of 0 only matches the OutputDevice
- CPPUNIT_ASSERT(pAnimationRenderer->matches(pTestRC, 0));
+ CPPUNIT_ASSERT(aAnimationRenderer.matches(pTestRC, 0));
}

CPPUNIT_TEST_FIXTURE(VclAnimationRendererTest, testDrawToPos)
@@ -75,12 +74,11 @@ CPPUNIT_TEST_FIXTURE(VclAnimationRendererTest, testDrawToPos)
Animation aTestAnim = createAnimation();
ScopedVclPtrInstance<VirtualDevice> pTestRC;

- AnimationRenderer* pAnimationRenderer
- = new AnimationRenderer(&aTestAnim, pTestRC.get(), Point(0, 0), Size(10, 10), 5);
- pAnimationRenderer->drawToIndex(0);
- pAnimationRenderer->drawToIndex(1);
- pAnimationRenderer->drawToIndex(2);
- pAnimationRenderer->drawToIndex(10);
+ AnimationRenderer aAnimationRenderer(&aTestAnim, pTestRC.get(), Point(0, 0), Size(10, 10), 5);
+ aAnimationRenderer.drawToIndex(0);
+ aAnimationRenderer.drawToIndex(1);
+ aAnimationRenderer.drawToIndex(2);
+ aAnimationRenderer.drawToIndex(10);

CPPUNIT_ASSERT_EQUAL(Size(1, 1), pTestRC->GetOutputSizePixel());
}
@@ -90,14 +88,13 @@ CPPUNIT_TEST_FIXTURE(VclAnimationRendererTest, testGetPosSizeWindow)
Animation aTestAnim = createAnimation();
ScopedVclPtrInstance<TestRenderingContext> pTestRC;

- AnimationRenderer* pAnimationRenderer
- = new AnimationRenderer(&aTestAnim, pTestRC, Point(0, 0), Size(10, 10), 5);
+ AnimationRenderer aAnimationRenderer(&aTestAnim, pTestRC, Point(0, 0), Size(10, 10), 5);
AnimationFrame aAnimBmp(Bitmap(Size(3, 4), vcl::PixelFormat::N24_BPP), Point(0, 0),
Size(10, 10));
Point aPos;
Size aSize;

- pAnimationRenderer->getPosSize(aAnimBmp, aPos, aSize);
+ aAnimationRenderer.getPosSize(aAnimBmp, aPos, aSize);

CPPUNIT_ASSERT_EQUAL(Point(0, 0), aPos);
CPPUNIT_ASSERT_EQUAL(Size(10, 10), aSize);

["Mike Kaganski (via cogerrit)"]

engine/vcl/win/app/salinst.cxx | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

New commits:

commit 91ec5634d0d00b52b018ee487005e6cac22275fe
Author: Mike Kaganski <mike.k...@collabora.com>
AuthorDate: Mon Dec 29 11:35:35 2025 +0100
Commit: Noel Grandin <noel.g...@collabora.com>
CommitDate: Wed May 13 07:56:25 2026 +0000

Use a named constant instead of a magic number

Helps e.g. matching it to what is in the documentation.

Reviewed-on: https://gerrit.libreoffice.org/c/core/+/196293
Tested-by: Jenkins
Reviewed-by: Mike Kaganski <mike.k...@collabora.com>
Signed-off-by: Mike Kaganski <mike.k...@collabora.com>
Change-Id: I34324e908f6ff2efb7938c021cd5d72f6ecb2d97
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/1494
Tested-by: Jenkins CPCI <rel...@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.g...@collabora.com>

diff --git a/engine/vcl/win/app/salinst.cxx b/engine/vcl/win/app/salinst.cxx
index 9ac8a206e46f..c5281432e3b0 100644
--- a/engine/vcl/win/app/salinst.cxx
+++ b/engine/vcl/win/app/salinst.cxx
@@ -582,7 +582,7 @@ LRESULT CALLBACK SalComWndProc( HWND, UINT nMsg, WPARAM wParam, LPARAM lParam, b
break;
case SAL_MSG_GETCACHEDDC:
nRet = reinterpret_cast<LRESULT>(
- GetDCEx(reinterpret_cast<HWND>(wParam), nullptr, 0x00000002L));
+ GetDCEx(reinterpret_cast<HWND>(wParam), nullptr, DCX_CACHE));
break;
case SAL_MSG_RELEASEDC:
ReleaseDC(reinterpret_cast<HWND>(wParam), reinterpret_cast<HDC>(lParam));

["Caolán McNamara (via cogerrit)"]

engine/vcl/source/outdev/map.cxx | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

New commits:
commit b1dd07307b7a00e73996975616efa113940fdf37
Author: Caolán McNamara <caolan....@collabora.com>
AuthorDate: Sat May 2 20:18:38 2026 +0100
Commit: Noel Grandin <noel.g...@collabora.com>
CommitDate: Wed May 13 11:08:41 2026 +0000

ofz#506472785 Integer-overflow

vcl/source/outdev/ImplMapRes.cxx:115:70: runtime error: signed integer overflow: -9223372036854775808 + -57089 cannot be represented in type 'long long'
#0 0x592c9880de2d in operator() vcl/source/outdev/ImplMapRes.cxx:115:70
#1 0x592c9880de2d in ImplMapRes::CalcMapResolution(MapMode const&, long, long) vcl/source/outdev/ImplMapRes.cxx:119:9
#2 0x592c9819827c in OutputDevice::SetMapMode(MapMode const&) vcl/source/outdev/map.cxx:519:18
#3 0x592c9830750e in GDIMetaFile::Play(OutputDevice&, unsigned long) vcl/source/gdi/gdimtf.cxx:365:26
#4 0x592c978beda6 in TestImportSVM vcl/source/filter/svm/SvmConverter.cxx:1281:22

This seems to have appeared since:

commit 64c6a8c44b7730d1f703f260e7359642e8af9288
Date: Sun Mar 22 15:09:35 2026 +0200

Fraction->double in MapMode

Clamp the divided value to sal_Int32 range to explicitly restore the
limits that BigInt path incidentally.

Signed-off-by: Caolán McNamara <caolan....@collabora.com>
Change-Id: I3c8061a72e447e4bdcad07ace3075076d09285be
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/1891

Tested-by: Jenkins CPCI <rel...@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.g...@collabora.com>

diff --git a/engine/vcl/source/outdev/map.cxx b/engine/vcl/source/outdev/map.cxx
index 8875d3d65877..279e82e35efa 100644
--- a/engine/vcl/source/outdev/map.cxx
+++ b/engine/vcl/source/outdev/map.cxx
@@ -122,7 +122,12 @@ static void lcl_calcMapResolution( const MapMode& rMapMode,
auto funcCalcOffset = [](double fScale, tools::Long& rnMapOffset, tools::Long nOrigin)
{
assert(fScale != 0);
- rnMapOffset = std::llround(double( rnMapOffset ) / fScale) + nOrigin;
+ // clamp so + nOrigin can't overflow tools::Long
+ constexpr double fLimit
+ = static_cast<double>(std::numeric_limits<sal_Int32>::max());
+ const double fOffset
+ = std::clamp(double(rnMapOffset) / fScale, -fLimit, fLimit);
+ rnMapOffset = std::llround(fOffset) + nOrigin;
};

funcCalcOffset(fScaleX, rMapRes.mnMapOfsX, aOrigin.X());

["Caolán McNamara (via cogerrit)"]

engine/vcl/source/fontsubset/cff.cxx | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)

New commits:
commit ac65c3fae20b6c207ef8ebb12ab66b5e035c6a03
Author: Caolán McNamara <caolan....@collabora.com>
AuthorDate: Fri May 15 08:38:40 2026 +0100
Commit: Caolán McNamara <caolan....@collabora.com>
CommitDate: Fri May 15 13:35:34 2026 +0000

ofz#513301090 UNKNOWN READ

Signed-off-by: Caolán McNamara <caolan....@collabora.com>
Change-Id: I8d9dde7634b770cb7642bed42c85b36527921f4b
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2653
Reviewed-by: Noel Grandin <noel.g...@collabora.com>
Tested-by: Jenkins CPCI <rel...@collaboraoffice.com>

diff --git a/engine/vcl/source/fontsubset/cff.cxx b/engine/vcl/source/fontsubset/cff.cxx
index 80b086825fed..1f81438905ae 100644
--- a/engine/vcl/source/fontsubset/cff.cxx
+++ b/engine/vcl/source/fontsubset/cff.cxx
@@ -1813,7 +1813,7 @@ bool CffContext::seekIndexEnd( int nIndexBase)
const int nDataCount = (mpReadPtr[0]<<8) + mpReadPtr[1];
const int nDataOfsSz = mpReadPtr[2];
mpReadPtr += 3 + nDataOfsSz * nDataCount;
- if ( mpReadPtr > mpBaseEnd)
+ if (mpReadPtr + nDataOfsSz > mpBaseEnd)
return false;
int nEndOfs = 0;
switch( nDataOfsSz) {
@@ -1823,12 +1823,12 @@ bool CffContext::seekIndexEnd( int nIndexBase)
case 3: nEndOfs = (mpReadPtr[0]<<16) + (mpReadPtr[1]<<8) + mpReadPtr[2];break;
case 4: nEndOfs = (mpReadPtr[0]<<24) + (mpReadPtr[1]<<16) + (mpReadPtr[2]<<8) + mpReadPtr[3]; break;
}
+ if (nEndOfs < 0)
+ return false;
mpReadPtr += nDataOfsSz;
mpReadPtr += nEndOfs - 1;
mpReadEnd = mpBaseEnd;
- if ( nEndOfs < 0)
- return false;
- if ( mpReadEnd > mpBaseEnd)
+ if (mpReadPtr > mpBaseEnd)
return false;
return true;
}

["Caolán McNamara (via cogerrit)"]

engine/vcl/source/fontsubset/cff.cxx | 17 +++++++++++++++++
1 file changed, 17 insertions(+)

New commits:
commit 6eb214dbe24ac7c1cde3fe8a6ce242f2d7e24151
Author: Caolán McNamara <caolan....@collabora.com>
AuthorDate: Fri May 15 09:16:02 2026 +0100
Commit: Michael Stahl <michae...@collabora.com>
CommitDate: Fri May 15 15:39:47 2026 +0000

ofz#513277199 Integer-overflow

Signed-off-by: Caolán McNamara <caolan....@collabora.com>
Change-Id: I8a07f47f382502ab24670a270e8cd23a888f1ba4
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2656
Reviewed-by: Michael Stahl <michae...@collabora.com>

Tested-by: Jenkins CPCI <rel...@collaboraoffice.com>

diff --git a/engine/vcl/source/fontsubset/cff.cxx b/engine/vcl/source/fontsubset/cff.cxx

index 1f81438905ae..11b7d19a43cc 100644
--- a/engine/vcl/source/fontsubset/cff.cxx
+++ b/engine/vcl/source/fontsubset/cff.cxx
@@ -738,6 +738,11 @@ private:
bool callType2Subr( bool bGlobal, int nSubrNumber);
sal_Int32 getReadOfs() const { return static_cast<sal_Int32>(mpReadPtr - mpBasePtr);}

+ // Abandon the current dict-data parse on malformed input. Advancing
+ // mpReadPtr past mpReadEnd exits the parse loop, and trips the mpReadPtr
+ // != mpReadEnd post-check so flags as a parse failure.
+ void abandonDictParse() { mpReadPtr = mpReadEnd + 1; }
+
const U8* mpBasePtr;
const U8* mpBaseEnd;

@@ -1704,11 +1709,18 @@ RealType CffContext::readRealVal()
int nExpSign = 0;
S64 nNumber = 0;
RealType fReal = +1.0;
+ // nNumber * 10 + 9 must fit in S64; anything beyond is a malformed
+ constexpr S64 nDigitCap = (SAL_MAX_INT64 - 9) / 10;
for(;;){
const U8 c = *(mpReadPtr++); // read nibbles
// parse high nibble
const U8 nH = c >> 4U;
if( nH <= 9) {
+ if (nNumber > nDigitCap) {
+ SAL_WARN("vcl.fonts.cff", "CFF real number overflow");
+ abandonDictParse();
+ return 0.0;
+ }
nNumber = nNumber * 10 + nH;
--nExpVal;
} else if( nH == 10) { // comma
@@ -1731,6 +1743,11 @@ RealType CffContext::readRealVal()
// parse low nibble
const U8 nL = c & 0x0F;
if( nL <= 9) {
+ if (nNumber > nDigitCap) {
+ SAL_WARN("vcl.fonts.cff", "CFF real number overflow");
+ abandonDictParse();
+ return 0.0;
+ }
nNumber = nNumber * 10 + nL;
--nExpVal;
} else if( nL == 10) { // comma

["Caolán McNamara (via cogerrit)"]

engine/vcl/source/fontsubset/sft.cxx | 24 ++++++------------------
1 file changed, 6 insertions(+), 18 deletions(-)

New commits:
commit b61521376fbeb49bb3405feb3eeeb3a74ee93443
Author: Caolán McNamara <caolan....@collabora.com>
AuthorDate: Fri May 15 11:09:15 2026 +0000
Commit: Caolán McNamara <caolan....@collabora.com>
CommitDate: Sat May 16 08:38:10 2026 +0000

align sftfuzzer harness with what oss-fuzz runs

Signed-off-by: Caolán McNamara <caolan....@collabora.com>
Change-Id: I198858a95ff1991ac5af48f23aba76fbd37290e8
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2680
Tested-by: Jenkins CPCI <rel...@collaboraoffice.com>

diff --git a/engine/vcl/source/fontsubset/sft.cxx b/engine/vcl/source/fontsubset/sft.cxx
index d41033494ffd..a0ae2e78ae8a 100644
--- a/engine/vcl/source/fontsubset/sft.cxx
+++ b/engine/vcl/source/fontsubset/sft.cxx
@@ -1077,26 +1077,14 @@ FontWeight AnalyzeTTFWeight(const TrueTypeFont* ttf)

int TestFontParsing(const void* data, sal_uInt32 size)
{
- // Exercise TrueType/OpenType parsing
- vcl::TrueTypeFont* pTTF = nullptr;
- if (vcl::OpenTTFontBuffer(data, size, 0, &pTTF) == vcl::SFErrCodes::Ok)
+ if (data && size > 0)
{
- vcl::TTGlobalFontInfo aInfo;
- vcl::GetTTGlobalFontInfo(pTTF, &aInfo);
-
- // If the font has a CFF table, exercise the CFF parser with it
- sal_uInt32 nCFFSize = 0;
- const sal_uInt8* pCFF = pTTF->table(vcl::O_CFF, nCFFSize);
- if (pCFF && nCFFSize > 0)
- {
- std::vector<sal_uInt8> aOutBuffer;
- FontSubsetInfo aCFFInfo;
- vcl::ConvertCFFfontToType1(pCFF, nCFFSize, aOutBuffer, aCFFInfo);
- }
-
- vcl::CloseTTFont(pTTF);
+ FontSubsetInfo aInfo;
+ aInfo.m_nFontType = FontType::TYPE1_PFB;
+ std::vector<sal_uInt8> aOutBuffer;
+ vcl::ConvertCFFfontToType1(static_cast<const unsigned char*>(data),
+ size, aOutBuffer, aInfo);
}
-
return 0;
}

["Caolán McNamara (via cogerrit)"]

engine/vcl/source/fontsubset/cff.cxx | 4 ++++
1 file changed, 4 insertions(+)

New commits:
commit 7c237925e474326f3c8dea179264b60d835145d7
Author: Caolán McNamara <caolan....@collabora.com>
AuthorDate: Fri May 15 11:23:59 2026 +0000
Commit: Caolán McNamara <caolan....@collabora.com>
CommitDate: Sun May 17 11:22:43 2026 +0000

ofz: check buffer bounds before reading offsets in CFF seekIndexData

Same pattern as:

commit 304208502164c07df8eb5a3677cb445ab0965f0e

Date: Fri May 15 08:38:40 2026 +0100

ofz#513301090 UNKNOWN READ

Signed-off-by: Caolán McNamara <caolan....@collabora.com>
Change-Id: I841619bc2f6eb2cb1a599f8eee2be9a75c68d2ca
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2695
Tested-by: Jenkins CPCI <rel...@collaboraoffice.com>

diff --git a/engine/vcl/source/fontsubset/cff.cxx b/engine/vcl/source/fontsubset/cff.cxx
index 11b7d19a43cc..a5294c56cb82 100644
--- a/engine/vcl/source/fontsubset/cff.cxx
+++ b/engine/vcl/source/fontsubset/cff.cxx
@@ -1796,6 +1796,8 @@ int CffContext::seekIndexData( int nIndexBase, int nDataIndex)
return -1;

const int nDataOfsSz = mpReadPtr[2];

mpReadPtr += 3 + (nDataOfsSz * nDataIndex);

+ if (mpReadPtr + nDataOfsSz > mpBaseEnd)

+ return -1;
int nOfs1 = 0;
switch( nDataOfsSz) {
default: SAL_WARN("vcl.fonts.cff", "\tINVALID nDataOfsSz=" << nDataOfsSz); return -1;
@@ -1805,6 +1807,8 @@ int CffContext::seekIndexData( int nIndexBase, int nDataIndex)
case 4: nOfs1 = (mpReadPtr[0]<<24) + (mpReadPtr[1]<<16) + (mpReadPtr[2]<<8) + mpReadPtr[3]; break;
}
mpReadPtr += nDataOfsSz;

+ if (mpReadPtr + nDataOfsSz > mpBaseEnd)

+ return -1;

int nOfs2 = 0;
switch( nDataOfsSz) {

["Sahil Gautam (via cogerrit)"]

engine/vcl/inc/qt5/QtInstance.hxx | 2 +-
engine/vcl/qt5/QtInstance.cxx | 12 ++++++------
2 files changed, 7 insertions(+), 7 deletions(-)

New commits:
commit 48e5b45fc181a19d5d0d12d3a7a6d1a104f6ecfc
Author: Sahil Gautam <sahil....@collabora.com>
AuthorDate: Mon May 18 13:09:00 2026 +0530
Commit: Noel Grandin <noel.g...@collabora.com>
CommitDate: Tue May 19 11:08:43 2026 +0000

match QtInstance::CreateMessageDialog signature with the interface

SalInstance::CreateMessageDialog returns a unique_ptr to
weld::MessageDialog but QtInstance::CreateMessageDialog returned
weld::MessageDialog* which wasn't an exact match, but it worked.

It no longer works with `gcc version 16.1.1 20260430 (GCC)` and throws
a "signature mismatch error".

Signed-off-by: Sahil Gautam <sahil....@collabora.com>
Change-Id: I7a5997d08be35e07b4828767f2e5969edd3bf1b2
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2776
Reviewed-by: Noel Grandin <noel.g...@collabora.com>
Reviewed-by: Michael Stahl <michae...@collabora.com>
Tested-by: Noel Grandin <noel.g...@collabora.com>

diff --git a/engine/vcl/inc/qt5/QtInstance.hxx b/engine/vcl/inc/qt5/QtInstance.hxx
index 9adfbb46dd8c..5b88b37179c5 100644
--- a/engine/vcl/inc/qt5/QtInstance.hxx
+++ b/engine/vcl/inc/qt5/QtInstance.hxx
@@ -190,7 +190,7 @@ public:

std::unique_ptr<weld::Builder> CreateBuilder(weld::Widget* pParent, const OUString& rUIRoot,
const OUString& rUIFile) override;
- virtual weld::MessageDialog* CreateMessageDialog(weld::Widget* pParent,
+ virtual std::unique_ptr<weld::MessageDialog> CreateMessageDialog(weld::Widget* pParent,
VclMessageType eMessageType,
VclButtonsType eButtonType,
const OUString& rPrimaryMessage) override;
diff --git a/engine/vcl/qt5/QtInstance.cxx b/engine/vcl/qt5/QtInstance.cxx
index 7b04aa8c179b..51e208d30011 100644
--- a/engine/vcl/qt5/QtInstance.cxx
+++ b/engine/vcl/qt5/QtInstance.cxx
@@ -939,15 +939,15 @@ QtInstance::CreateBuilder(weld::Widget* pParent, const OUString& rUIRoot, const
}
}

-weld::MessageDialog* QtInstance::CreateMessageDialog(weld::Widget* pParent,
- VclMessageType eMessageType,
- VclButtonsType eButtonsType,
- const OUString& rPrimaryMessage)
+std::unique_ptr<weld::MessageDialog> QtInstance::CreateMessageDialog(weld::Widget* pParent,
+ VclMessageType eMessageType,
+ VclButtonsType eButtonsType,
+ const OUString& rPrimaryMessage)
{
SolarMutexGuard g;
if (!IsMainThread())
{
- weld::MessageDialog* pDialog;
+ std::unique_ptr<weld::MessageDialog> pDialog;
RunInMainThread([&] {
pDialog = CreateMessageDialog(pParent, eMessageType, eButtonsType, rPrimaryMessage);
});
@@ -966,7 +966,7 @@ weld::MessageDialog* QtInstance::CreateMessageDialog(weld::Widget* pParent,
pMessageBox->setText(toQString(rPrimaryMessage));
pMessageBox->setIcon(vclMessageTypeToQtIcon(eMessageType));
pMessageBox->setWindowTitle(vclMessageTypeToQtTitle(eMessageType));
- QtInstanceMessageDialog* pDialog = new QtInstanceMessageDialog(pMessageBox);
+ std::unique_ptr<QtInstanceMessageDialog> pDialog = std::make_unique<QtInstanceMessageDialog>(pMessageBox);
pDialog->addStandardButtons(eButtonsType);
return pDialog;
}

["Noel Grandin (via cogerrit)"]

engine/vcl/unx/gtk3/gtkinst.cxx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 102195221e4e3687bdc79f5f096b78492c4e1c5a
Author: Noel Grandin <noel.g...@collabora.co.uk>
AuthorDate: Tue May 19 11:30:59 2026 +0200
Commit: Noel Grandin <noel.g...@collabora.com>
CommitDate: Wed May 20 08:38:56 2026 +0000

loplugin:redundantstatic in gtkinst

vcl/unx/gtk3/gtkinst.cxx:23657:1: error: redundant 'static' keyword in unnamed namespace [loplugin:redundantstatic]

after
commit d5e894dec11f5fbc8c1e42625c01d3d3c2c250c2

Author: Shardul Vikram Singh <shardu...@collabora.com>

Date: Mon May 4 16:27:22 2026 +0530
vcl: add VclCustomWidget for client-rendered widgets

Change-Id: I602909932966014734a27c9963880fb66b32d32d
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2906
Reviewed-by: Noel Grandin <noel.g...@collabora.com>
Tested-by: Noel Grandin <noel.g...@collabora.com>

diff --git a/engine/vcl/unx/gtk3/gtkinst.cxx b/engine/vcl/unx/gtk3/gtkinst.cxx
index dc7071767307..1c0af8b8d6e8 100644
--- a/engine/vcl/unx/gtk3/gtkinst.cxx
+++ b/engine/vcl/unx/gtk3/gtkinst.cxx
@@ -23654,7 +23654,7 @@ void silence_gwarning(const gchar* /*log_domain*/,
// VclCustomWidget is used by the jsdialog (online) for client-rendered
// widgets; on the desktop GTK path it has no rendering, so register an empty
// GtkLabel-derived GType under that name as a placeholder for gtk_builder.
-static GType vcl_custom_widget_get_type()
+GType vcl_custom_widget_get_type()
{
static GType type = 0;
if (!type)

["Caolán McNamara (via cogerrit)"]

engine/vcl/source/fontsubset/cff.cxx | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

New commits:
commit 15d96dba8b96f1248840da1bafa3b564b2ad2a95
Author: Caolán McNamara <caolan....@collabora.com>
AuthorDate: Thu May 21 16:55:18 2026 +0100
Commit: Noel Grandin <noel.g...@collabora.com>
CommitDate: Fri May 22 07:58:34 2026 +0000

ofz: initialCffRead fails during smoketest

Signed-off-by: Caolán McNamara <caolan....@collabora.com>
Change-Id: I9f8d71788cfd9e42a668670d08efd3c774b8455a
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/3085
Tested-by: Noel Grandin <noel.g...@collabora.com>
Reviewed-by: Noel Grandin <noel.g...@collabora.com>

diff --git a/engine/vcl/source/fontsubset/cff.cxx b/engine/vcl/source/fontsubset/cff.cxx
index c252721f79bc..7f8ce89461db 100644
--- a/engine/vcl/source/fontsubset/cff.cxx
+++ b/engine/vcl/source/fontsubset/cff.cxx
@@ -1914,7 +1914,9 @@ CffGlobal::CffGlobal()

bool CffContext::initialCffRead()
{
- // get the CFFHeader
+ // Adobe Technical Note #5176 section 6 "Header": major, minor, hdrSize, offSize
+ if (mpBaseEnd - mpBasePtr < 4)
+ return false;
mpReadPtr = mpBasePtr;
const U8 nVerMajor = *(mpReadPtr++);
const U8 nVerMinor = *(mpReadPtr++);

["Caolán McNamara (via cogerrit)"]

engine/vcl/source/gdi/metaact.cxx | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit cf5088b90c421d3d3853507720f4e74026ede967
Author: Caolán McNamara <caolan....@collabora.com>
AuthorDate: Sun May 24 19:31:39 2026 +0000
Commit: Caolán McNamara <caolan....@collabora.com>
CommitDate: Sun May 24 23:21:08 2026 +0000

ofz#516227797 Integer-overflow

cairo_fixed_t allows +-(1 << 23) per coordinate, but cairo's _lerp_half
does (b - a) >> 1 on the underlying int32. Two coordinates each within
that range can have a difference that does not fit. Tighten the limit.

Limit set since:

commit 5b7b26fcb0fc53602a71b98b32095962b9ca1d46
Date: Sat Dec 6 19:38:24 2025 +0000

ofz#466583689 cairo doesn't really handle outside +- 1 << 23

Signed-off-by: Caolán McNamara <caolan....@collabora.com>
Change-Id: I036abe0d5fe65b28de35472a2464ec8887499eaf
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/3171
Reviewed-by: Noel Grandin <noel.g...@collabora.com>
Tested-by: Jenkins CPCI <rel...@collaboraoffice.com>

diff --git a/engine/vcl/source/gdi/metaact.cxx b/engine/vcl/source/gdi/metaact.cxx
index 28c7f4b51d5f..55ca39cb8523 100644
--- a/engine/vcl/source/gdi/metaact.cxx
+++ b/engine/vcl/source/gdi/metaact.cxx
@@ -226,7 +226,7 @@ static bool AllowDim(tools::Long nDim)
static bool bFuzzing = comphelper::IsFuzzing();
if (bFuzzing)
{
- constexpr auto numCairoMax(1 << 23);
+ constexpr auto numCairoMax(1 << 22);
if (nDim > numCairoMax || nDim < -numCairoMax)
{
SAL_WARN("vcl", "skipping huge dimension: " << nDim);

["Parth Raiyani (via cogerrit)"]

engine/vcl/inc/jsdialog/jsdialogbuilder.hxx | 1 +
engine/vcl/jsdialog/jsdialogbuilder.cxx | 6 ++++++
2 files changed, 7 insertions(+)

New commits:
commit a85a71e6f80625cfc36499aaab83aaf14a0838ee
Author: Parth Raiyani <parth....@collabora.com>
AuthorDate: Wed May 20 11:55:03 2026 +0000
Commit: Szymon Kłos <szymo...@collabora.com>
CommitDate: Mon May 25 12:19:36 2026 +0000

jsdialog: send a button update when its icon name changes

JSButton inherited set_from_icon_name from SalInstanceButton, which updates the underlying VCL widget but never notifies the JS side, so the image was only transmitted on the initial dump and any later set_from_icon_name call left the rendered button blank. This showed up on the Function Wizard favorites toggle, which is hidden during construction and only gets its star icon when a function is selected. Override set_from_icon_name to call the parent then sendUpdate, matching set_label.

Signed-off-by: Parth Raiyani <parth....@collabora.com>
Change-Id: Ie71115c64ce11720a1840b67e68b55e74c8844b8
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/2993
Tested-by: Jenkins CPCI <rel...@collaboraoffice.com>
Reviewed-by: Szymon Kłos <szymo...@collabora.com>

diff --git a/engine/vcl/inc/jsdialog/jsdialogbuilder.hxx b/engine/vcl/inc/jsdialog/jsdialogbuilder.hxx
index 9edf4309a19b..674c54efe770 100644
--- a/engine/vcl/inc/jsdialog/jsdialogbuilder.hxx
+++ b/engine/vcl/inc/jsdialog/jsdialogbuilder.hxx
@@ -534,6 +534,7 @@ public:
JSButton(JSDialogSender* pSender, ::Button* pButton, SalInstanceBuilder* pBuilder,
bool bTakeOwnership);
virtual void set_label(const OUString& rText) override;
+ virtual void set_from_icon_name(const OUString& rIconName) override;
};

class JSLinkButton final : public JSWidget<SalInstanceLinkButton, ::FixedHyperlink>
diff --git a/engine/vcl/jsdialog/jsdialogbuilder.cxx b/engine/vcl/jsdialog/jsdialogbuilder.cxx
index 8325a2fe72d5..92955c601b4f 100644
--- a/engine/vcl/jsdialog/jsdialogbuilder.cxx
+++ b/engine/vcl/jsdialog/jsdialogbuilder.cxx
@@ -1234,6 +1234,12 @@ void JSButton::set_label(const OUString& rText)
sendUpdate();
}

+void JSButton::set_from_icon_name(const OUString& rIconName)
+{
+ SalInstanceButton::set_from_icon_name(rIconName);
+ sendUpdate();
+}
+
JSLinkButton::JSLinkButton(JSDialogSender* pSender, ::FixedHyperlink* pButton,
SalInstanceBuilder* pBuilder, bool bTakeOwnership)
: JSWidget<SalInstanceLinkButton, ::FixedHyperlink>(pSender, pButton, pBuilder, bTakeOwnership)