abiword: add upstream patches to fix various bugs

Add upstream patches to address overflow bugs, fundamental rendering
problems, and miscellaneous crashers. (All of these commits have been
branched upstream, but no updated source release has been made in over
two years. Relevant upstream SVN commit IDs and bug IDs are noted in
each patch comment.) Bump PKGREVISION.

OK wiz@

20 files changed, 847 insertions, 3 deletions

diff --git a/editors/abiword/Makefile b/editors/abiword/Makefile
index 6c9d111f98b..6c024da8274 100644
--- a/editors/abiword/Makefile
+++ b/editors/abiword/Makefile
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.183 2018/12/13 19:51:34 adam Exp $
+# $NetBSD: Makefile,v 1.184 2018/12/28 22:24:52 gutteridge Exp $
 
 .include 	"Makefile.common"
 DISTNAME=	abiword-${ABIVERSION}
-PKGREVISION=	3
+PKGREVISION=	4
 CATEGORIES=	editors
 MASTER_SITES=	http://www.abiword.com/downloads/abiword/${PKGVERSION_NOREV}/source/
 
diff --git a/editors/abiword/distinfo b/editors/abiword/distinfo
index c7be80ed723..74f5db23d98 100644
--- a/editors/abiword/distinfo
+++ b/editors/abiword/distinfo
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.76 2018/12/02 21:51:06 bsiegert Exp $
+$NetBSD: distinfo,v 1.77 2018/12/28 22:24:52 gutteridge Exp $
 
 SHA1 (abiword-3.0.2.tar.gz) = 8226e0962e6667e0a461955a0ac680a629e0b55a
 RMD160 (abiword-3.0.2.tar.gz) = fde551492b0cffa7d522082906f374490bd47f5c
@@ -20,11 +20,29 @@ SHA1 (patch-plugins_wordperfect_xp_ie__imp__WordPerfect.h) = 6e1e264506edabf0e1c
 SHA1 (patch-plugins_wordperfect_xp_ie__impexp__WordPerfect.cpp) = c87bc227eebcfcc2ab11ee6b5237ef8fcc47c0bc
 SHA1 (patch-plugins_wordperfect_xp_ie__impexp__WordPerfect.h) = 0a75276dc0d1d99b97155f61d9f98de7126fb0a3
 SHA1 (patch-plugins_wpg_xp_ie__impGraphic__WPG.cpp) = 36d7ca7855ddc504701e392c28e3d8530f78b81e
+SHA1 (patch-src_af_gr_gtk_gr__UnixCairoGraphics.cpp) = 2fb170202d13c9ddf077cea545d8d8f79fdbf5c2
+SHA1 (patch-src_af_gr_gtk_gr__UnixImage.cpp) = 2546621961ce959a8d5078ff52efa4650362be54
+SHA1 (patch-src_af_gr_xp_gr__Caret.cpp) = 96b186c4fc762f6734226b4505e2d4c64fb2b03a
+SHA1 (patch-src_af_gr_xp_gr__Caret.h) = f7ee697a720205cd9026a85d7683092fc147a237
+SHA1 (patch-src_af_gr_xp_gr__Graphics.cpp) = 9cf398ea8e787e5820d41182c005fe2906c7ec06
+SHA1 (patch-src_af_gr_xp_gr__Graphics.h) = a3539f0e2e3a8f661a01428f7550f8a4bebb1ee5
+SHA1 (patch-src_af_util_unix_ut__unixTimer.cpp) = 543d8977c8da5c1db4e26581d82f72a4f936f190
 SHA1 (patch-src_af_util_xp_ut__endian.h) = e1dd4cc0df3b0eb66dbd673fb5c0d2e3b24b30a4
 SHA1 (patch-src_af_util_xp_ut__iconv.cpp) = 613f162d4db0ba9520e0481a98564e59ccd862d4
 SHA1 (patch-src_af_util_xp_ut__iconv.h) = bbcfa2098ea77d393feb50d69de9ae29fcce302f
 SHA1 (patch-src_af_util_xp_ut__mbtowc.cpp) = 01f6793651533e7e39f665e5c15e6c12e1c7b96d
 SHA1 (patch-src_af_util_xp_ut__misc.cpp) = f552ecbb87490355d8e74218dd59fd3961f1af5d
+SHA1 (patch-src_af_util_xp_ut__png.cpp) = 9f4ae043873fc6d66e063419d0736bb6104483b0
+SHA1 (patch-src_af_xap_gtk_xap__UnixFrameImpl.cpp) = 5b67bd234209beddc751e7c98b17cf1844b73b1a
+SHA1 (patch-src_af_xap_gtk_xap__UnixFrameImpl.h) = af256fec37a7b9cd4239802985ad1a46f8272ad8
 SHA1 (patch-src_af_xap_xp_enchant__checker.cpp) = 5ad3b8bb4e186e998d7e8930247534c9f058c534
+SHA1 (patch-src_af_xap_xp_xap__Frame.cpp) = d7f29f199b7109c8a09fa40f969be0db3a6b79ba
+SHA1 (patch-src_text_fmt_xp_fl__SectionLayout.cpp) = 3f1f9255bb979812c8062f542ed4b9faa488a368
 SHA1 (patch-src_text_fmt_xp_fv__FrameEdit.h) = 684310bf9aece4ce72d004dfae9a4b4b6ca69570
+SHA1 (patch-src_text_fmt_xp_fv__View.cpp) = 872f4d94a3797b0ae1c32500267e46afa5ebd3ac
+SHA1 (patch-src_text_fmt_xp_fv__ViewDoubleBuffering.cpp) = ef11cce5d6d07c33416666e30c1aed33abfa8e1c
+SHA1 (patch-src_text_fmt_xp_fv__View__protected.cpp) = c567a8962280aa6f5b20151b74616b14ff0c2aa7
 SHA1 (patch-src_text_ptbl_xp_pd__DocumentRDF.cpp) = 5673e9341372913156f2f722229569199d97af4c
+SHA1 (patch-src_wp_ap_gtk_ap__UnixFrameImpl.cpp) = 709abd20ccaffc96cf8b9e77ea506fe6732e6d62
+SHA1 (patch-src_wp_impexp_xp_ie__exp__DocRangeListener.cpp) = cab84cf239874409d8e349c58c3605d91712b3c4
+SHA1 (patch-src_wp_impexp_xp_ie__imp__RTF.cpp) = 89cddf0213c1aeb1c915f4722e5db3a68f553ae6
diff --git a/editors/abiword/patches/patch-src_af_gr_gtk_gr__UnixCairoGraphics.cpp b/editors/abiword/patches/patch-src_af_gr_gtk_gr__UnixCairoGraphics.cpp
new file mode 100644
index 00000000000..9aa30e1f40d
--- /dev/null
+++ b/editors/abiword/patches/patch-src_af_gr_gtk_gr__UnixCairoGraphics.cpp
@@ -0,0 +1,51 @@
+$NetBSD: patch-src_af_gr_gtk_gr__UnixCairoGraphics.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13791, SVN revision 35476: Fix flicker and caret problems.
+
+Abiword bug 13791, SVN revision 35482: Disable double buffering on GTK3.
+
+--- src/af/gr/gtk/gr_UnixCairoGraphics.cpp.orig	2016-10-21 00:39:16.000000000 +0000
++++ src/af/gr/gtk/gr_UnixCairoGraphics.cpp
+@@ -126,8 +126,12 @@ GR_Graphics *   GR_UnixCairoGraphics::gr
+ 
+ //	UT_return_val_if_fail(!info.isPrinterGraphics(), NULL);
+ 	GR_UnixCairoAllocInfo &AI = (GR_UnixCairoAllocInfo&)info;
+-
++#if GTK_CHECK_VERSION(3,0,0)
++	// We disable double buffering on Gtk3 because it doesn't work.
++	return new GR_UnixCairoGraphics(AI.m_win, false);
++#else
+ 	return new GR_UnixCairoGraphics(AI.m_win, AI.m_double_buffered);
++#endif
+ }
+ 
+ inline UT_RGBColor _convertGdkColor(const GdkColor &c)
+@@ -566,7 +570,10 @@ void GR_UnixCairoGraphics::_beginPaint()
+ void GR_UnixCairoGraphics::_endPaint()
+ {
+ 	if (m_CairoCreated)
++	{
++		cairo_surface_flush(cairo_get_target(m_cr));
+ 		cairo_destroy (m_cr);
++	}
+ 	m_cr = NULL;
+ 
+ 	m_Painting = false;
+@@ -577,9 +584,17 @@ void GR_UnixCairoGraphics::_endPaint()
+ 
+ void GR_UnixCairoGraphics::flush(void)
+ {
++
+ 	if (m_Widget) {
+ 		gtk_widget_queue_draw(m_Widget);
+ 	}
++	
++/*
++	if(m_cr)
++	{
++		cairo_surface_flush(cairo_get_target(m_cr));
++	}
++*/
+ }
+ 
+ bool GR_UnixCairoGraphics::queryProperties(GR_Graphics::Properties gp) const
diff --git a/editors/abiword/patches/patch-src_af_gr_gtk_gr__UnixImage.cpp b/editors/abiword/patches/patch-src_af_gr_gtk_gr__UnixImage.cpp
new file mode 100644
index 00000000000..a621215c2ac
--- /dev/null
+++ b/editors/abiword/patches/patch-src_af_gr_gtk_gr__UnixImage.cpp
@@ -0,0 +1,24 @@
+$NetBSD: patch-src_af_gr_gtk_gr__UnixImage.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13834, SVN revision 35393: Crash fixes.
+
+--- src/af/gr/gtk/gr_UnixImage.cpp.orig	2015-10-16 02:42:45.000000000 +0000
++++ src/af/gr/gtk/gr_UnixImage.cpp
+@@ -244,12 +244,13 @@ bool GR_UnixImage::saveToPNG(const char 
+         UT_return_val_if_fail(m_image,false);
+ 
+ 	GError * error = NULL;
+-	gboolean res = gdk_pixbuf_save (m_image, szFile, "png", &error,NULL);
+-	if(res != FALSE)
+-	{
++	gboolean res = gdk_pixbuf_save (m_image, szFile, "png", &error, NULL);
++	if (res != FALSE) {
++		if (error) {
++			g_error_free (error);
++		}
+ 		return true;
+ 	}
+-	delete error;
+ 	return false;
+ 
+ }
diff --git a/editors/abiword/patches/patch-src_af_gr_xp_gr__Caret.cpp b/editors/abiword/patches/patch-src_af_gr_xp_gr__Caret.cpp
new file mode 100644
index 00000000000..599f7aaf18b
--- /dev/null
+++ b/editors/abiword/patches/patch-src_af_gr_xp_gr__Caret.cpp
@@ -0,0 +1,305 @@
+$NetBSD: patch-src_af_gr_xp_gr__Caret.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13791, SVN revision 35476: Fix flicker and caret problems.
+
+--- src/af/gr/xp/gr_Caret.cpp.orig	2013-04-07 13:53:03.000000000 +0000
++++ src/af/gr/xp/gr_Caret.cpp
+@@ -30,6 +30,11 @@
+ #include "gr_Graphics.h"
+ #include "gr_Painter.h"
+ #include "ut_debugmsg.h"
++#include <inttypes.h>
++#include <math.h>
++#include <stdio.h>
++#include <time.h>
++
+ static const UT_uint32 CURSOR_DELAY_TIME = 10; // milliseconds
+ 
+ #ifdef TOOLKIT_GTK_ALL
+@@ -56,6 +61,11 @@ GR_Caret::GR_Caret(GR_Graphics * pG)
+ 		m_yPoint2(0),
+ 		m_pClr(NULL),
+ 		m_pG(pG),
++		m_iWindowWidth(0),
++		m_iWindowHeight(0),
++		m_worker(NULL),
++		m_enabler(NULL),
++		m_blinkTimeout(NULL),
+ 		m_nDisableCount(1),
+ 		m_bCursorBlink(true),
+ 		m_bCursorIsOn(false),
+@@ -70,7 +80,10 @@ GR_Caret::GR_Caret(GR_Graphics * pG)
+ 		m_bRemote(false),
+ 		m_clrRemote(0,0,0),
+ 		m_sID(""),
+-		m_iCaretNumber(0)
++		m_iCaretNumber(0),
++		m_iLastDrawTime(0),
++		m_iRetry(0),
++		m_bPendingBlink(false)
+ {
+ 	UT_WorkerFactory::ConstructMode outMode = UT_WorkerFactory::NONE;
+ 	m_worker = static_cast<UT_Timer *>(UT_WorkerFactory::static_constructor
+@@ -97,6 +110,11 @@ GR_Caret::GR_Caret(GR_Graphics * pG, con
+ 		m_yPoint2(0),
+ 		m_pClr(NULL),
+ 		m_pG(pG),
++		m_iWindowWidth(0),
++		m_iWindowHeight(0),
++		m_worker(NULL),
++		m_enabler(NULL),
++		m_blinkTimeout(NULL),
+ 		m_nDisableCount(1),
+ 		m_bCursorBlink(true),
+ 		m_bCursorIsOn(false),
+@@ -111,7 +129,10 @@ GR_Caret::GR_Caret(GR_Graphics * pG, con
+ 		m_bRemote(true),
+ 		m_clrRemote(0,0,0),
+ 		m_sID(sId),
+-		m_iCaretNumber(0)
++		m_iCaretNumber(0),
++		m_iLastDrawTime(0),
++		m_iRetry(0),
++		m_bPendingBlink(false)
+ {
+ 	UT_WorkerFactory::ConstructMode outMode = UT_WorkerFactory::NONE;
+ 	m_worker = static_cast<UT_Timer *>(UT_WorkerFactory::static_constructor
+@@ -145,9 +166,16 @@ GR_Caret::~GR_Caret()
+ void GR_Caret::s_work(UT_Worker * _w)
+ {
+ 	GR_Caret * c = static_cast<GR_Caret *>(_w->getInstanceData());
+-
++	xxx_UT_DEBUGMSG((" Caret timer called Disable Count = %d \n",c->m_nDisableCount));
+ 	if (c->m_nDisableCount == 0)
++	{
++#ifdef TOOLKIT_GTK_ALL
++		c->setPendingBlink();
++		c->m_pG->flush(); // set redraw for wayland
++#else
+ 		c->_blink(false);
++#endif
++	}
+ }
+ 
+ /** One-time enabler. */
+@@ -170,9 +198,12 @@ void GR_Caret::s_enable(UT_Worker * _w)
+ 
+ void GR_Caret::s_blink_timeout(UT_Worker * _w)
+ {
++	return;
++	/*
+ 	GR_Caret * c = static_cast<GR_Caret *>(_w->getInstanceData());
+ 	if (c->isEnabled())
+ 		c->disable();
++	*/
+ }
+ 
+ UT_uint32 GR_Caret::_getCursorBlinkTime() const
+@@ -241,8 +272,6 @@ void GR_Caret::setCoords(UT_sint32 x, UT
+ 						 UT_sint32 x2, UT_sint32 y2, UT_uint32 h2,
+ 						 bool bPointDirection, const UT_RGBColor * pClr)
+ {
+-	// if visible, then hide while we change positions.
+-	_erase();
+ 
+ 	m_xPoint = x; m_yPoint = y; m_iPointHeight = h;
+ 	m_xPoint2 = x2; m_yPoint2 = y2; m_iPointHeight2 = h2;
+@@ -270,13 +299,17 @@ void GR_Caret::enable()
+ 
+ 	// If the caret is already enabled, just return
+ 	if (m_nDisableCount == 0)
++	{
++		xxx_UT_DEBUGMSG(("Don't emable disable Count is already zero \n"));
+ 		return;
+-
++	}
+ 	// Check to see if we still have pending disables.
+ 	--m_nDisableCount;
+-	if (m_nDisableCount)
++	if (m_nDisableCount != 0)
++	{
++		xxx_UT_DEBUGMSG(("Don't emable, disable Count has not reached zero \n"));
+ 		return;
+-
++	}
+ 	// stop pending enables; in 10 ms, really enable blinking.
+ 	m_enabler->stop();
+ 	m_enabler->start();
+@@ -326,19 +359,20 @@ void GR_Caret::JustErase(UT_sint32 xPoin
+ {
+        if(m_bRecursiveDraw)
+        {
+-	    xxx_UT_DEBUGMSG(("Doing recursive Erase! - abort \n"));
++	    xxx_UT_DEBUGMSG(("Doing recursive Just Erase! - abort \n"));
+ 	    return;
+        }
+        if (m_bCursorIsOn && (((xPoint -m_pG->tlu(2)-1) <= m_xPoint) && (xPoint >= (m_xPoint-m_pG->tlu(2))-1)) && ((yPoint - m_pG->tlu(1)) <= m_yPoint) && (yPoint >= (m_yPoint - m_pG->tlu(1))))
+        {
++	    xxx_UT_DEBUGMSG(("Doing Just Erase! now \n"));
+ 	    m_pG->restoreRectangle(m_iCaretNumber*3+0);
+ 	    if(m_bSplitCaret)
+ 	    {
+ 	          m_pG->restoreRectangle(m_iCaretNumber*3+1);
+-		  m_pG->restoreRectangle(m_iCaretNumber*3+2);
+-		  m_bSplitCaret = false;
++			  m_pG->restoreRectangle(m_iCaretNumber*3+2);
++			  m_bSplitCaret = false;
+ 	    }
+-	    m_bCursorIsOn = !m_bCursorIsOn;
++	    m_bCursorIsOn = false;
+ 	    m_nDisableCount = 1;
+        }
+ }
+@@ -358,18 +392,42 @@ void GR_Caret::_blink(bool bExplicit)
+ 	}
+         if (!m_bPositionSet)
+ 		return;
++	if(!m_bPendingBlink)
++		return;
++	struct timespec spec;
++
++    clock_gettime(CLOCK_REALTIME, &spec);
+ 
++    UT_sint32 s  = spec.tv_sec;
++    long ms = round(spec.tv_nsec / 1.0e6); // Convert nanoseconds to milliseconds
++	long this_time = 1000*s + ms;
++	long time_between = this_time - m_iLastDrawTime;
++	m_iLastDrawTime = this_time;
++    //
++	// If this number is high enough the caret will not blink at all
++	// This places the caret on the screen during rapid moves.
++	//
++	if(time_between < _getCursorBlinkTime()/2) 
++	{
++		m_iRetry++;
++		xxx_UT_DEBUGMSG(("Caret redraw after %d ms \n",time_between));
++	}
++	else
++	{
++		m_iRetry = 0;
++	}
+ 	m_bRecursiveDraw = true;
+ 	GR_Painter painter (m_pG, false);
+ 	m_bRecursiveDraw = false;
+ 
+ 	// After any autoblink, we want there to be BLINK_TIME 
+ 	// until next autoblink.
++	/*
+ 	if (!bExplicit)
+ 	{ 
+ 		m_worker->stop(); m_worker->start();
+ 	}
+-
++	*/
+ 	// Blink if: (a) _blink explicitly called (not autoblink); or
+ 	//           (b) autoblink and caret blink enabled; or
+ 	//           (c) autoblink, caret blink disabled, caret is off
+@@ -380,6 +438,7 @@ void GR_Caret::_blink(bool bExplicit)
+ 
+ 		if (m_bCursorIsOn)
+ 		{
++			xxx_UT_DEBUGMSG(("Clear Caret reTry %d \n",m_iRetry));
+ 			m_pG->restoreRectangle(m_iCaretNumber*3+0);
+ 
+ 			if(m_bSplitCaret)
+@@ -388,6 +447,7 @@ void GR_Caret::_blink(bool bExplicit)
+ 				m_pG->restoreRectangle(m_iCaretNumber*3+2);
+ 				m_bSplitCaret = false;
+ 			}
++			m_bCursorIsOn = false;
+ 		}
+ 		else
+ 		{
+@@ -413,7 +473,9 @@ void GR_Caret::_blink(bool bExplicit)
+ 					   m_yPoint+m_pG->tlu(1),
+ 					   m_pG->tlu(5),
+ 					   m_iPointHeight+m_pG->tlu(2));
++			m_bRecursiveDraw = false;
+ 			m_pG->allCarets()->JustErase(m_xPoint,m_yPoint);
++			m_bRecursiveDraw = true;
+ 			m_pG->saveRectangle(r0,m_iCaretNumber*3+0);
+ 
+ 			if((m_xPoint != m_xPoint2) || (m_yPoint != m_yPoint2))
+@@ -446,7 +508,7 @@ void GR_Caret::_blink(bool bExplicit)
+ 			if(m_bCaret1OnScreen)
+ 			{
+ 				// draw the primary caret
+-				xxx_UT_DEBUGMSG(("blink cursor turned on \n")); 
++				xxx_UT_DEBUGMSG(("Draw Caret reTry %d \n",m_iRetry)); 
+ 
+ 				UT_sint32 x1 = m_xPoint + iDelta * m_pG->tlu(1);
+ 				UT_sint32 x2 = m_xPoint;
+@@ -463,6 +525,7 @@ void GR_Caret::_blink(bool bExplicit)
+ 								 m_yPoint + m_pG->tlu(1),
+ 								 x2, 
+ 								 m_yPoint + m_iPointHeight + m_pG->tlu(1));
++				m_bCursorIsOn = true;
+ 			}
+ 			
+ 			if(m_bSplitCaret)
+@@ -499,6 +562,7 @@ void GR_Caret::_blink(bool bExplicit)
+ 										 m_xPoint + m_pG->tlu(2),
+ 										 m_yPoint + m_pG->tlu(2));
+ 					}
++					m_bCursorIsOn = true;
+ 				}
+ 				
+ 				// Now we deal with the secondary caret needed on ltr-rtl boundary
+@@ -557,25 +621,54 @@ void GR_Caret::_blink(bool bExplicit)
+ 										 m_xPoint2 /*- m_pG->tlu(1)*/,
+ 										 m_yPoint2 + m_pG->tlu(2));
+ 					}
++					m_bCursorIsOn = true;
+ 				}
+ 				
+ 			}
+ 			
+ 		}
+ 
+-		m_bCursorIsOn = !m_bCursorIsOn;
+  		m_pG->setColor(oldColor);
+ 		m_bRecursiveDraw = false;
+ 	}
+-	m_pG->flush();
++	//
++	// Places the caret on the screen during rapid moves like pressing the arrow keys
++	//
++	if(m_iRetry == 0)
++		m_bPendingBlink = false;
+ }
+ 
++//
++// Tell the widget redraw know we only need to blink on this cycle
++//
++void GR_Caret::setPendingBlink()
++{
++	xxx_UT_DEBUGMSG(("Pending blink set in GR_CARET \n"));
++	m_bPendingBlink = true;
++}
++
++//
++// Returns true if we did a blink
++//
++bool GR_Caret::doBlinkIfNeeded()
++{
++	if(!m_bPendingBlink)
++	{
++		return false;
++	}
++	_blink(true);
++	m_bPendingBlink = false;
++	return true;
++}
+ /*!
+  * Only call this is you are absolutely certain you need it!
+  */
+ void GR_Caret::forceDraw(void)
+ {
+-	_blink(true);
++	if(m_nDisableCount < 2)
++	{
++		_blink(true);
++	}
+ }
+ 
+ void GR_Caret::resetBlinkTimeout(void)
diff --git a/editors/abiword/patches/patch-src_af_gr_xp_gr__Caret.h b/editors/abiword/patches/patch-src_af_gr_xp_gr__Caret.h
new file mode 100644
index 00000000000..df65fae0d1f
--- /dev/null
+++ b/editors/abiword/patches/patch-src_af_gr_xp_gr__Caret.h
@@ -0,0 +1,26 @@
+$NetBSD: patch-src_af_gr_xp_gr__Caret.h,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13791, SVN revision 35476: Fix flicker and caret problems.
+
+--- src/af/gr/xp/gr_Caret.h.orig	2013-04-07 13:53:03.000000000 +0000
++++ src/af/gr/xp/gr_Caret.h
+@@ -67,7 +67,8 @@ public:
+ 	void                            setRemoteColor(UT_RGBColor clrRemote);
+ 
+ 	void							resetBlinkTimeout(void);
+-
++	void                            setPendingBlink(void);
++	bool                            doBlinkIfNeeded(void);
+ private:
+ 	GR_Caret(); // no impl
+ 	GR_Caret(const GR_Caret& rhs);			// no impl.
+@@ -121,6 +122,9 @@ private:
+ 	UT_RGBColor						m_clrRemote;
+ 	std::string				        m_sID;
+ 	UT_sint32						m_iCaretNumber;
++	long                                                    m_iLastDrawTime;
++	UT_sint32                                               m_iRetry;
++	bool                                                    m_bPendingBlink;
+ };
+ 
+ class ABI_EXPORT GR_CaretDisabler
diff --git a/editors/abiword/patches/patch-src_af_gr_xp_gr__Graphics.cpp b/editors/abiword/patches/patch-src_af_gr_xp_gr__Graphics.cpp
new file mode 100644
index 00000000000..6ee8fc744d4
--- /dev/null
+++ b/editors/abiword/patches/patch-src_af_gr_xp_gr__Graphics.cpp
@@ -0,0 +1,40 @@
+$NetBSD: patch-src_af_gr_xp_gr__Graphics.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13791, SVN revision 35476: Fix flicker and caret problems.
+
+--- src/af/gr/xp/gr_Graphics.cpp.orig	2013-04-07 13:53:03.000000000 +0000
++++ src/af/gr/xp/gr_Graphics.cpp
+@@ -185,6 +185,20 @@ void		AllCarets::setBlink(bool bBlink)
+ 	}
+ }
+ 
++bool AllCarets::doBlinkIfNeeded(void)
++{
++	bool bBlinked = false;
++	if((*m_pLocalCaret))
++	{
++		bBlinked = (*m_pLocalCaret)->doBlinkIfNeeded();
++		for(UT_sint32 i =0; i< m_vecCarets->getItemCount();i++)
++		{
++			m_vecCarets->getNthItem(i)->forceDraw();
++		}
++	}
++	return bBlinked;
++}
++
+ void        AllCarets::setWindowSize(UT_uint32 width, UT_uint32 height)
+ {
+ 	if((*m_pLocalCaret))
+@@ -195,6 +209,12 @@ void        AllCarets::setWindowSize(UT_
+ 	}
+ }
+ 
++void        AllCarets::setPendingBlink(void)
++{
++	if((*m_pLocalCaret))
++		(*m_pLocalCaret)->setPendingBlink();
++}
++
+ void		AllCarets::setCoords(UT_sint32 x, UT_sint32 y, UT_uint32 h,
+ 						  UT_sint32 x2, UT_sint32 y2, UT_uint32 h2, 
+ 						  bool bPointDirection, 
diff --git a/editors/abiword/patches/patch-src_af_gr_xp_gr__Graphics.h b/editors/abiword/patches/patch-src_af_gr_xp_gr__Graphics.h
new file mode 100644
index 00000000000..a77cdda7b8d
--- /dev/null
+++ b/editors/abiword/patches/patch-src_af_gr_xp_gr__Graphics.h
@@ -0,0 +1,17 @@
+$NetBSD: patch-src_af_gr_xp_gr__Graphics.h,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13791, SVN revision 35476: Fix flicker and caret problems.
+
+--- src/af/gr/xp/gr_Graphics.h.orig	2015-04-02 03:09:13.000000000 +0000
++++ src/af/gr/xp/gr_Graphics.h
+@@ -364,7 +364,9 @@ class ABI_EXPORT AllCarets
+ 						  const UT_RGBColor * pClr = NULL);
+ 	void		setInsertMode (bool mode);
+ 	void		forceDraw(void);
+-
++	bool        doBlinkIfNeeded(void);
++	void        setPendingBlink(void);
++	
+  private:
+ 	GR_Graphics * m_pG;
+ 	GR_Caret **    m_pLocalCaret;
diff --git a/editors/abiword/patches/patch-src_af_util_unix_ut__unixTimer.cpp b/editors/abiword/patches/patch-src_af_util_unix_ut__unixTimer.cpp
new file mode 100644
index 00000000000..f7d1148bcf9
--- /dev/null
+++ b/editors/abiword/patches/patch-src_af_util_unix_ut__unixTimer.cpp
@@ -0,0 +1,22 @@
+$NetBSD: patch-src_af_util_unix_ut__unixTimer.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13791, SVN revision 35476: Fix flicker and caret problems.
+
+--- src/af/util/unix/ut_unixTimer.cpp.orig	2013-04-07 13:53:03.000000000 +0000
++++ src/af/util/unix/ut_unixTimer.cpp
+@@ -66,10 +66,11 @@ static int _Timer_Proc(void *p)
+ 	UT_ASSERT(pTimer);
+ 
+ 	xxx_UT_DEBUGMSG(("ut_unixTimer.cpp:  timer fired\n"));
+-	
+-	pTimer->fire();
+-
+-	return true;
++	if (pTimer) {
++		pTimer->fire();
++		return TRUE;
++	}
++	return 0;
+ }
+ 
+ UT_sint32 UT_UNIXTimer::set(UT_uint32 iMilliseconds)
diff --git a/editors/abiword/patches/patch-src_af_util_xp_ut__png.cpp b/editors/abiword/patches/patch-src_af_util_xp_ut__png.cpp
new file mode 100644
index 00000000000..7d036c90b51
--- /dev/null
+++ b/editors/abiword/patches/patch-src_af_util_xp_ut__png.cpp
@@ -0,0 +1,34 @@
+$NetBSD: patch-src_af_util_xp_ut__png.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13827, SVN revision 35369: Fix overflow read in PNG.
+
+--- src/af/util/xp/ut_png.cpp.orig	2013-04-07 13:53:03.000000000 +0000
++++ src/af/util/xp/ut_png.cpp
+@@ -28,6 +28,7 @@
+ 
+ #include "ut_assert.h"
+ #include "ut_bytebuf.h"
++#include "ut_debugmsg.h"
+ 
+ struct _bb
+ {
+@@ -40,6 +41,19 @@ static void _png_read(png_structp png_pt
+ 	struct _bb* p = static_cast<struct _bb*>(png_get_io_ptr(png_ptr));
+ 	const UT_Byte* pBytes = p->pBB->getPointer(0);
+ 
++	// make sure that we don't read outside of pBytes
++	if (p->iCurPos >= p->pBB->getLength() - length) {
++		UT_WARNINGMSG(("PNG: Reading past buffer bounds. cur = %u, buflen = %u, length = %lu\n",
++					   p->iCurPos, p->pBB->getLength(), length));
++		length = p->pBB->getLength() - p->iCurPos;
++		if (length == 0) {
++			UT_WARNINGMSG(("PNG: Truncating to ZERO length.\n"));
++			png_error(png_ptr, "Premature end of buffer");
++			return;
++		} else {
++			UT_WARNINGMSG(("PNG: Truncating to %lu.\n", length));
++		}
++	}
+ 	memcpy(data, pBytes + p->iCurPos, length);
+ 	p->iCurPos += length;
+ }
diff --git a/editors/abiword/patches/patch-src_af_xap_gtk_xap__UnixFrameImpl.cpp b/editors/abiword/patches/patch-src_af_xap_gtk_xap__UnixFrameImpl.cpp
new file mode 100644
index 00000000000..2e550a538df
--- /dev/null
+++ b/editors/abiword/patches/patch-src_af_xap_gtk_xap__UnixFrameImpl.cpp
@@ -0,0 +1,62 @@
+$NetBSD: patch-src_af_xap_gtk_xap__UnixFrameImpl.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13815, SVN revision 35394: Draw event should return TRUE.
+
+Abiword bug 13791, SVN revision 35480: Fix flicker and caret problems.
+
+--- src/af/xap/gtk/xap_UnixFrameImpl.cpp.orig	2014-12-14 14:56:47.000000000 +0000
++++ src/af/xap/gtk/xap_UnixFrameImpl.cpp
+@@ -1208,15 +1208,23 @@ gint XAP_UnixFrameImpl::_fe::delete_even
+ }
+ 
+ #if GTK_CHECK_VERSION(3,0,0)
+-gint XAP_UnixFrameImpl::_fe::draw(GtkWidget * w, cairo_t * cr)
++gboolean XAP_UnixFrameImpl::_fe::draw(GtkWidget * w, cairo_t * cr)
+ #else
+-gint XAP_UnixFrameImpl::_fe::expose(GtkWidget * w, GdkEventExpose* pExposeEvent)
++gboolean XAP_UnixFrameImpl::_fe::expose(GtkWidget * w, GdkEventExpose* pExposeEvent)
+ #endif
+ {
+ 	XAP_UnixFrameImpl * pUnixFrameImpl = static_cast<XAP_UnixFrameImpl *>(g_object_get_data(G_OBJECT(w), "user_data"));
+ 	FV_View * pView = static_cast<FV_View *>(pUnixFrameImpl->getFrame()->getCurrentView());
++	double x, y, width, height;
+ #if GTK_CHECK_VERSION(3,0,0)
+-	GdkEventExpose *pExposeEvent = reinterpret_cast<GdkEventExpose *>(gtk_get_current_event());
++	cairo_clip_extents (cr, &x, &y, &width, &height);
++	width -= x;
++	height -= y;
++#else
++	x = pExposeEvent->area.x;
++	y = pExposeEvent->area.y;
++	width = pExposeEvent->area.width;
++	height = pExposeEvent->area.height;
+ #endif
+ /* Jean: commenting out next lines since the zoom update code does draw only
+  * part of what needs to be updated. */
+@@ -1231,19 +1239,21 @@ gint XAP_UnixFrameImpl::_fe::expose(GtkW
+ 		if (pGr->getPaintCount () > 0)
+ 			return TRUE;
+ 		xxx_UT_DEBUGMSG(("Expose area: x %d y %d width %d  height %d \n",pExposeEvent->area.x,pExposeEvent->area.y,pExposeEvent->area.width,pExposeEvent->area.height));
+-		rClip.left = pGr->tlu(pExposeEvent->area.x);
+-		rClip.top = pGr->tlu(pExposeEvent->area.y);
+-		rClip.width = pGr->tlu(pExposeEvent->area.width)+1;
+-		rClip.height = pGr->tlu(pExposeEvent->area.height)+1;
++		rClip.left = pGr->tlu(x);
++		rClip.top = pGr->tlu(y);
+ #if GTK_CHECK_VERSION(3,0,0)
++		rClip.width = pGr->tlu(width);
++		rClip.height = pGr->tlu(height);
+ 		static_cast<GR_CairoGraphics *>(pGr)->setCairo(cr);
+ 		pView->draw(&rClip);
+ 		static_cast<GR_CairoGraphics *>(pGr)->setCairo(NULL);
+ #else
++		rClip.width = pGr->tlu(width)+1;
++		rClip.height = pGr->tlu(height)+1;
+ 		pView->draw(&rClip);
+ #endif
+ 	}
+-	return FALSE;
++	return TRUE;
+ }
+ 
+ static bool bScrollWait = false;
diff --git a/editors/abiword/patches/patch-src_af_xap_gtk_xap__UnixFrameImpl.h b/editors/abiword/patches/patch-src_af_xap_gtk_xap__UnixFrameImpl.h
new file mode 100644
index 00000000000..e5eb34abeb1
--- /dev/null
+++ b/editors/abiword/patches/patch-src_af_xap_gtk_xap__UnixFrameImpl.h
@@ -0,0 +1,18 @@
+$NetBSD: patch-src_af_xap_gtk_xap__UnixFrameImpl.h,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13815, SVN revision 35394: Draw event should return TRUE.
+
+--- src/af/xap/gtk/xap_UnixFrameImpl.h.orig	2013-04-07 13:53:03.000000000 +0000
++++ src/af/xap/gtk/xap_UnixFrameImpl.h
+@@ -152,9 +152,9 @@ protected:
+ 			static gint key_release_event(GtkWidget* w, GdkEventKey* e);
+ 			static gint delete_event(GtkWidget * w, GdkEvent * /*event*/, gpointer /*data*/);
+ #if GTK_CHECK_VERSION(3,0,0)
+-			static gint draw(GtkWidget * w, cairo_t * cr);
++			static gboolean draw(GtkWidget * w, cairo_t * cr);
+ #else
+-			static gint expose(GtkWidget * w, GdkEventExpose* pExposeEvent);
++			static gboolean expose(GtkWidget * w, GdkEventExpose* pExposeEvent);
+ #endif
+ 			static gint do_ZoomUpdate( gpointer /* xap_UnixFrame * */ p);
+ 			static void vScrollChanged(GtkAdjustment * w, gpointer /*data*/);
diff --git a/editors/abiword/patches/patch-src_af_xap_xp_xap__Frame.cpp b/editors/abiword/patches/patch-src_af_xap_xp_xap__Frame.cpp
new file mode 100644
index 00000000000..fa9262ef757
--- /dev/null
+++ b/editors/abiword/patches/patch-src_af_xap_xp_xap__Frame.cpp
@@ -0,0 +1,31 @@
+$NetBSD: patch-src_af_xap_xp_xap__Frame.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13791, SVN revision 35476: Fix flicker and caret problems.
+
+--- src/af/xap/xp/xap_Frame.cpp.orig	2013-04-07 13:53:03.000000000 +0000
++++ src/af/xap/xp/xap_Frame.cpp
+@@ -505,7 +505,7 @@ void /* static*/ XAP_FrameImpl::viewAuto
+ 		pFrameImpl->m_ViewAutoUpdaterID = 0;
+ 		DELETEP(pFrameImpl->m_ViewAutoUpdater);
+ 		pView->draw();
+-
++		pG->flush();
+ 		return;
+ 	}
+ 	if(!pView->isLayoutFilling() && !pFrameImpl->m_pFrame->m_bFirstDraw)
+@@ -514,6 +514,7 @@ void /* static*/ XAP_FrameImpl::viewAuto
+ 		pG->setCursor(GR_Graphics::GR_CURSOR_WAIT);
+ 		pFrameImpl->_setCursor(GR_Graphics::GR_CURSOR_WAIT);
+ 		pFrameImpl->m_pFrame->setStatusMessage ( static_cast<const gchar *>(msg.c_str()) );
++		pG->flush();
+ 		return;
+ 	}
+ 	GR_Graphics * pG = pView->getGraphics();
+@@ -534,6 +535,7 @@ void /* static*/ XAP_FrameImpl::viewAuto
+ 			pView->updateScreen();
+ 		}
+ 	}
++	pG->flush();
+ }
+ 
+ UT_RGBColor XAP_Frame::getColorSelBackground () const
diff --git a/editors/abiword/patches/patch-src_text_fmt_xp_fl__SectionLayout.cpp b/editors/abiword/patches/patch-src_text_fmt_xp_fl__SectionLayout.cpp
new file mode 100644
index 00000000000..7fca6b9ef9b
--- /dev/null
+++ b/editors/abiword/patches/patch-src_text_fmt_xp_fl__SectionLayout.cpp
@@ -0,0 +1,16 @@
+$NetBSD: patch-src_text_fmt_xp_fl__SectionLayout.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13791, SVN revision 35476: Fix flicker and caret problems.
+
+--- src/text/fmt/xp/fl_SectionLayout.cpp.orig	2013-04-07 13:53:03.000000000 +0000
++++ src/text/fmt/xp/fl_SectionLayout.cpp
+@@ -1921,6 +1921,9 @@ void fl_DocSectionLayout::updateLayout(b
+ 		checkAndRemovePages();
+ 		addValidPages();
+ 	}
++	xxx_UT_DEBUGMSG(("Doing fl_DocSectionLayout::updateLayout here %p view %p \n",this, m_pLayout->getView()));
++	m_pLayout->getView()->getGraphics()->allCarets()->setPendingBlink(); // place caret after entry
++	m_pLayout->getView()->getGraphics()->flush(); // schedule redraw for Wayland
+ }
+ 
+ void fl_DocSectionLayout::setNeedsSectionBreak(bool bSet, fp_Page * pPage)
diff --git a/editors/abiword/patches/patch-src_text_fmt_xp_fv__View.cpp b/editors/abiword/patches/patch-src_text_fmt_xp_fv__View.cpp
new file mode 100644
index 00000000000..37337ee13fc
--- /dev/null
+++ b/editors/abiword/patches/patch-src_text_fmt_xp_fv__View.cpp
@@ -0,0 +1,43 @@
+$NetBSD: patch-src_text_fmt_xp_fv__View.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13791, SVN revision 35476: Fix flicker and caret problems.
+
+--- src/text/fmt/xp/fv_View.cpp.orig	2016-01-23 21:00:21.000000000 +0000
++++ src/text/fmt/xp/fv_View.cpp
+@@ -3105,11 +3105,15 @@ bool FV_View::isSelectionEmpty(void) con
+ {
+ 	if(m_FrameEdit.isActive() && m_FrameEdit.isImageWrapper() )
+ 	{
+-	        return false;
++		if (m_pG)
++			m_pG->allCarets()->disable(true);
++		return false;
+ 	}
+ 	if(m_FrameEdit.isActive() && (m_FrameEdit. getFrameEditMode() >= FV_FrameEdit_RESIZE_INSERT))
+ 	{
+-	        return false;
++		if (m_pG)
++			m_pG->allCarets()->disable(true);
++		return false;
+ 	}
+ 	if (!m_Selection.isSelected())
+ 	{
+@@ -3124,6 +3128,8 @@ bool FV_View::isSelectionEmpty(void) con
+ 		{
+ 			return true;
+ 		}
++		if (m_pG)
++			m_pG->allCarets()->disable(true);
+ 		return false;
+ 	}
+ 	PT_DocPosition curPos = getPoint();
+@@ -3131,7 +3137,8 @@ bool FV_View::isSelectionEmpty(void) con
+ 	{
+ 		return true;
+ 	}
+-
++	if (m_pG)
++		m_pG->allCarets()->disable(true);
+ 	return false;
+ }
+ 
diff --git a/editors/abiword/patches/patch-src_text_fmt_xp_fv__ViewDoubleBuffering.cpp b/editors/abiword/patches/patch-src_text_fmt_xp_fv__ViewDoubleBuffering.cpp
new file mode 100644
index 00000000000..cfcc0812b3d
--- /dev/null
+++ b/editors/abiword/patches/patch-src_text_fmt_xp_fv__ViewDoubleBuffering.cpp
@@ -0,0 +1,15 @@
+$NetBSD: patch-src_text_fmt_xp_fv__ViewDoubleBuffering.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13791, SVN revision 35476: Fix flicker and caret problems.
+
+--- src/text/fmt/xp/fv_ViewDoubleBuffering.cpp.orig	2013-04-07 13:53:03.000000000 +0000
++++ src/text/fmt/xp/fv_ViewDoubleBuffering.cpp
+@@ -27,7 +27,7 @@
+ #include "ut_misc.h"
+ #include "ut_debugmsg.h"
+ 
+-//#define DEACTIVATE_FV_VIEW_DOUBLE_BUFFERING
++//#define DEACTIVATE_FV_VIEW_DOUBLE_BUFFERING 1
+ 
+ FV_ViewDoubleBuffering::FV_ViewDoubleBuffering(FV_View *pView, bool suspendDirectDrawing, bool callDrawOnlyAtTheEnd)
+ 	: m_pView(pView),
diff --git a/editors/abiword/patches/patch-src_text_fmt_xp_fv__View__protected.cpp b/editors/abiword/patches/patch-src_text_fmt_xp_fv__View__protected.cpp
new file mode 100644
index 00000000000..3d814937a11
--- /dev/null
+++ b/editors/abiword/patches/patch-src_text_fmt_xp_fv__View__protected.cpp
@@ -0,0 +1,51 @@
+$NetBSD: patch-src_text_fmt_xp_fv__View__protected.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13791, SVN revision 35476: Fix flicker and caret problems.
+
+--- src/text/fmt/xp/fv_View_protected.cpp.orig	2016-10-21 00:39:16.000000000 +0000
++++ src/text/fmt/xp/fv_View_protected.cpp
+@@ -4478,7 +4478,6 @@ void FV_View::_draw(UT_sint32 x, UT_sint
+ 					 "\t\twith [yScrollOffset %d][windowHeight %d][bDirtyRunsOnly %d]\n",
+ 					 x,y,width,height,bClip,
+ 					 m_yScrollOffset,getWindowHeight(),bDirtyRunsOnly));
+-
+ 	if(m_pViewDoubleBufferingObject != NULL && m_pViewDoubleBufferingObject->getCallDrawOnlyAtTheEnd())
+ 	{
+ 		// record this call's arguments and return
+@@ -4727,12 +4726,19 @@ void FV_View::_draw(UT_sint32 x, UT_sint
+ 		// advance to the next page
+ 		pPage = pPage -> getNext();
+ 	}
+-
+ 	if (bClip)
+ 	{
+ 		m_pG->setClipRect(NULL);
+ 	}
+-
++	//
++	// Look if we have to blink the caret
++	//
++	xxx_UT_DEBUGMSG(("Doing _draw bDirtyRunsOnly %d \n",bDirtyRunsOnly));
++	
++	if(m_pG->allCarets()->doBlinkIfNeeded())
++	{
++		xxx_UT_DEBUGMSG(("Pending blink drawn has bDirtyRunsOnly %d \n",bDirtyRunsOnly));
++	}
+ 	xxx_UT_DEBUGMSG(("End _draw\n"));
+ }
+ 
+@@ -4816,6 +4822,14 @@ void FV_View::_setPoint(PT_DocPosition p
+ 		  m_countDisable++;
+ 		}
+ 	}
++	
++	if(m_pG)
++	{
++		xxx_UT_DEBUGMSG(("Schedule redraw in _setPoint \n"));
++		m_pG->allCarets()->setPendingBlink();
++		m_pG->flush(); // scedule a redraw for Wayland
++	}
++
+ }
+ 
+ 
diff --git a/editors/abiword/patches/patch-src_wp_ap_gtk_ap__UnixFrameImpl.cpp b/editors/abiword/patches/patch-src_wp_ap_gtk_ap__UnixFrameImpl.cpp
new file mode 100644
index 00000000000..d1c2d3e0815
--- /dev/null
+++ b/editors/abiword/patches/patch-src_wp_ap_gtk_ap__UnixFrameImpl.cpp
@@ -0,0 +1,20 @@
+$NetBSD: patch-src_wp_ap_gtk_ap__UnixFrameImpl.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13791, SVN revision 35482: Disable double buffering on GTK3.
+
+--- src/wp/ap/gtk/ap_UnixFrameImpl.cpp.orig	2016-06-25 22:26:31.000000000 +0000
++++ src/wp/ap/gtk/ap_UnixFrameImpl.cpp
+@@ -219,11 +219,12 @@ GtkWidget * AP_UnixFrameImpl::_createDoc
+ 						    GDK_FOCUS_CHANGE_MASK |
+ 						    GDK_LEAVE_NOTIFY_MASK |
+ 						    GDK_SCROLL_MASK));
+-	gtk_widget_set_double_buffered(GTK_WIDGET(m_dArea), FALSE);
+ #if GTK_CHECK_VERSION(3,0,0)
+ 	g_signal_connect(G_OBJECT(m_dArea), "draw",
+ 					   G_CALLBACK(XAP_UnixFrameImpl::_fe::draw), NULL);
+ #else
++        // We disable double buffering on Gtk3 because it doesn't work.
++	gtk_widget_set_double_buffered(GTK_WIDGET(m_dArea), FALSE);
+ 	g_signal_connect(G_OBJECT(m_dArea), "expose_event",
+ 					   G_CALLBACK(XAP_UnixFrameImpl::_fe::expose), NULL);
+ #endif
diff --git a/editors/abiword/patches/patch-src_wp_impexp_xp_ie__exp__DocRangeListener.cpp b/editors/abiword/patches/patch-src_wp_impexp_xp_ie__exp__DocRangeListener.cpp
new file mode 100644
index 00000000000..68b777de638
--- /dev/null
+++ b/editors/abiword/patches/patch-src_wp_impexp_xp_ie__exp__DocRangeListener.cpp
@@ -0,0 +1,15 @@
+$NetBSD: patch-src_wp_impexp_xp_ie__exp__DocRangeListener.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13834, SVN revision 35392: Crash fixes.
+
+--- src/wp/impexp/xp/ie_exp_DocRangeListener.cpp.orig	2013-04-07 13:53:03.000000000 +0000
++++ src/wp/impexp/xp/ie_exp_DocRangeListener.cpp
+@@ -166,7 +166,7 @@ void  IE_Exp_DocRangeListener::freeAtts(
+   UT_sint32 i=0;
+   while(sAtts[i])
+   {
+-      delete [] (sAtts[i]);
++      g_free(const_cast<char*>(sAtts[i]));
+       i++;
+   }
+   delete [] sAtts;
diff --git a/editors/abiword/patches/patch-src_wp_impexp_xp_ie__imp__RTF.cpp b/editors/abiword/patches/patch-src_wp_impexp_xp_ie__imp__RTF.cpp
new file mode 100644
index 00000000000..5bc90284b54
--- /dev/null
+++ b/editors/abiword/patches/patch-src_wp_impexp_xp_ie__imp__RTF.cpp
@@ -0,0 +1,36 @@
+$NetBSD: patch-src_wp_impexp_xp_ie__imp__RTF.cpp,v 1.1 2018/12/28 22:24:53 gutteridge Exp $
+
+Abiword bug 13826, SVN revisions 35377 & 35378: Fix RTF out-of-bounds accesses.
+
+--- src/wp/impexp/xp/ie_imp_RTF.cpp.orig	2014-07-14 04:07:47.000000000 +0000
++++ src/wp/impexp/xp/ie_imp_RTF.cpp
+@@ -12068,7 +12068,13 @@ bool IE_Imp_RTF::HandleStyleDefinition(v
+ 					// must not mix static and dynamically allocated strings in the same
+ 					// array, otherwise there is no way we can g_free it !!!
+ 					//attribs[attribsCount++] = g_strdup(static_cast<const char *>(m_styleTable[istyle]));
+-					attribs[attribsCount++] = m_styleTable[istyle].c_str();
++					if (istyle >= 0 && static_cast<UT_uint32>(istyle) < m_styleTable.size()) {
++						attribs[attribsCount++] = m_styleTable[istyle].c_str();
++					} else {
++						UT_WARNINGMSG(("RTF: basedon by style index out of bounds: %d. max %lu.\n",
++									   istyle, m_styleTable.size()));
++						attribs[attribsCount++] = NULL;
++					}
+ 					UT_return_val_if_fail( attribsCount < PT_MAX_ATTRIBUTES * 2,false );
+ 				}
+ 				else
+@@ -12086,7 +12092,13 @@ bool IE_Imp_RTF::HandleStyleDefinition(v
+ 					// must not mix static and dynamically allocated strings in the same
+ 					// array, otherwise there is no way we can g_free it !!!
+ 					// attribs[attribsCount++] = g_strdup(static_cast<const char *>(m_styleTable[istyle]));
+-					attribs[attribsCount++] = m_styleTable[istyle].c_str();
++					if (istyle >= 0 && static_cast<UT_uint32>(istyle) < m_styleTable.size()) {
++						attribs[attribsCount++] = m_styleTable[istyle].c_str();
++					} else {
++						UT_WARNINGMSG(("RTF: followed by style index out of bounds: %d. max %lu.\n",
++									   istyle, m_styleTable.size()));
++						attribs[attribsCount++] = NULL;
++					}
+ 					UT_return_val_if_fail( attribsCount < PT_MAX_ATTRIBUTES * 2,false );
+ 				}
+ 				else