tdf#90694 check bounds in RPN tokens, related and others [Eike Rathke] tdf#91228 fix Writer crash [Philippe Jung]