loadXmlObjectConnectionShape() always crashes when reader is named "off"

[Tyler799]

In the following function:

void DrawingAnchor::loadXmlObjectConnectionShape(QXmlStreamReader &reader)

The following code is called:

else if (reader.name() == QLatin1String("off")) {
                posTA     = loadXmlPos(reader);
                hasoffext = true;

That is wrong. It will try to call the following method:

QPoint DrawingAnchor::loadXmlPos(QXmlStreamReader &reader)
{
    Q_ASSERT(reader.name() == QLatin1String("pos"));

    QPoint pos;
    QXmlStreamAttributes attrs = reader.attributes();
    pos.setX(attrs.value(QLatin1String("x")).toInt());
    pos.setY(attrs.value(QLatin1String("y")).toInt());
    return pos;
}

But since the reader's name is "off" and not "pos", the assert will fail and the program will crash.

I cannot send the spreadsheet I noticed causing this issue, so this is the best I can give you.