rhbz#960019 : RTF import: handle extra groups in listoverride entry

This crashed because for a single listoverride entry 2 SPRMs were sent
to the domain-mapper, and the second one was empty.

Change-Id: Ic41ffd8bd4edcff065f49ecef3464efedd909d63

sw/qa/extras/rtfimport/data/rhbz960019.rtf

@@ -0,0 +1,12 @@
+{\rtf1
+{\*\listtable
+{\list\listtemplateid-723955400\listsimple{\listlevel\leveljc\levelfollow0\levelspace0\levelindent0\levelstartat1{\leveltext\'03\'00. ;}{\levelnumbers\'01;}\f0 }{\listname ;}\listid-1155484576}
+}
+{\*\listoverridetable
+{\*\listoverride{\listid-1155484576\listoverridecount0\ls1}}
+}
+\pard\plain \pvpg\phpg\posx1143\posy4743\absw9615\absh-2922\dfrmtxtx72\dfrmtxty72\nowrap
+Hello\par
+\pard\plain\par
+}
+

sw/qa/extras/rtfimport/rtfimport.cxx

@@ -153,6 +153,7 @@ public:
     void testFdo39001();
     void testGroupshape();
     void testFdo66565();
+    void testRhbz960019();
 
     CPPUNIT_TEST_SUITE(Test);
 #if !defined(MACOSX) && !defined(WNT)
@@ -291,6 +292,7 @@ void Test::run()
         {"fdo39001.rtf", &Test::testFdo39001},
         {"groupshape.rtf", &Test::testGroupshape},
         {"fdo66565.rtf", &Test::testFdo66565},
+        {"rhbz960019.rtf", &Test::testRhbz960019},
     };
     header();
     for (unsigned int i = 0; i < SAL_N_ELEMENTS(aMethods); ++i)
@@ -1419,6 +1421,11 @@ void Test::testFdo66565()
     CPPUNIT_ASSERT_EQUAL(sal_Int16(304), getProperty< uno::Sequence<text::TableColumnSeparator> >(xTableRows->getByIndex(1), "TableColumnSeparators")[0].Position);
 }
 
+void Test::testRhbz960019()
+{
+    // used to crash due to extra group in listoverride entry
+}
+
 CPPUNIT_TEST_SUITE_REGISTRATION(Test);
 
 CPPUNIT_PLUGIN_IMPLEMENT();

writerfilter/source/rtftok/rtfdocumentimpl.cxx

@@ -4563,8 +4563,18 @@ int RTFDocumentImpl::popState()
             // list override table
         case DESTINATION_LISTOVERRIDEENTRY:
             {
-                RTFValue::Pointer_t pValue(new RTFValue(aState.aTableAttributes, aState.aTableSprms));
-                m_aListTableSprms.set(NS_ooxml::LN_CT_Numbering_num, pValue, false);
+                if (m_aStates.top().nDestinationState == DESTINATION_LISTOVERRIDEENTRY)
+                {   // copy properties upwards so upper popState inserts it
+                    m_aStates.top().aTableAttributes = aState.aTableAttributes;
+                    m_aStates.top().aTableSprms = aState.aTableSprms;
+                }
+                else
+                {
+                    RTFValue::Pointer_t pValue(new RTFValue(
+                                aState.aTableAttributes, aState.aTableSprms));
+                    m_aListTableSprms.set(NS_ooxml::LN_CT_Numbering_num,
+                            pValue, false);
+                }
             }
             break;
         case DESTINATION_LEVELTEXT: