tdf#90694 check bounds in RPN tokens, related and others [Eike Rathke]
tdf#91228 fix Writer crash [Philippe Jung]