Bug 60063

[Reproducible] with "LibO  4.0.0.2 rc   -  GERMAN UI / German Locale  [Build ID: 5991f37846fc3763493029c4958b57282c2597e)]"  {tinderbox: @6, pull time 2013-01-24  07:20(?)} on German WIN7 Home Premium (64bit) with User Profile automatically created form renamed /3 User profile used by 3.6.5.2.

Sample document seems to be sane, opens fine with MS WORD Viewer.

Already [Reproducible] with "LibO  4.0.0.2 rc   -  GERMAN UI / German Locale  [Build ID: 5991f37846fc3763493029c4958b57282c2597e)]"  {tinderbox: @6, pull time 2013-01-24  07:20(?)} on German WIN7 Home Premium (64bit) with User Profile automatically created form renamed /3 User profile used by 3.6.5.2:
"General Error. General input/output error"

Crashes with LibO 3.3.3 3.5.2,

Created attachment 74388 [details]
bt + console logs on master

On pc Debian x86-64 with master sources updated today, I reproduced the crash.

Attached console logs + bt

Here are 2 possible patches:

1)
diff --git a/oox/source/docprop/docprophandler.cxx b/oox/source/docprop/docprophandler.cxx
index 1067315..6c01d4c 100644
--- a/oox/source/docprop/docprophandler.cxx
+++ b/oox/source/docprop/docprophandler.cxx
@@ -174,9 +174,9 @@ uno::Sequence< ::rtl::OUString > OOXMLDocPropHandler::GetKeywordsSet( const ::rt
                     // unfortunately I did not find any specification for the possible delimiters
                     if ( !aResult[nCounter].isEmpty() )
                     {
-                        if ( nCounter >= aResult.getLength() )
-                            aResult.realloc( nCounter + 10 );
                         nCounter++;
+                        if ( nCounter >= aResult.getLength())
+                            aResult.realloc( nCounter + 10 );

2)
diff --git a/oox/source/docprop/docprophandler.cxx b/oox/source/docprop/docprophandler.cxx
index 1067315..b96ed6b 100644
--- a/oox/source/docprop/docprophandler.cxx
+++ b/oox/source/docprop/docprophandler.cxx
@@ -174,7 +174,7 @@ uno::Sequence< ::rtl::OUString > OOXMLDocPropHandler::GetKeywordsSet( const ::rt
                     // unfortunately I did not find any specification for the possible delimiters
                     if ( !aResult[nCounter].isEmpty() )
                     {
-                        if ( nCounter >= aResult.getLength() )
+                        if ( nCounter >= (aResult.getLength() - 1) )
                             aResult.realloc( nCounter + 10 );
                         nCounter++;
                     }

Both work but I'm not sure if one is wrong or if they're equivalent.

Michael/Cédric: one for you?
If one of them is ok, tell me, I can push the patch on master.

(In reply to comment #3)

Just saw this bug on the crashlog of automatic crash testing.
What about posting the patch to gerrit for review?

Opens fine with 4.1.1.2 under Win7x64. WORKSFORME.