#60626 - ArrayIndexOutOfBoundsException in EvilUnclosedBRFixingInputStream

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1782095 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Andreas Beeker 2017-02-08 01:01:51 +00:00
parent acbd37db01
commit 7ed2c1e85a
7 changed files with 1014 additions and 273 deletions

View File

@ -511,3 +511,27 @@ SLF4J library (slf4j-api-*.jar)
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
inbot-utils (https://github.com/Inbot/inbot-utils)
The MIT License (MIT)
Copyright (c) 2015 Inbot
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

View File

@ -0,0 +1,204 @@
/* ====================================================================
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
==================================================================== */
package org.apache.poi.util;
import java.io.FilterInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.nio.charset.Charset;
import java.util.Arrays;
/**
* Simple FilterInputStream that can replace occurrences of bytes with something else.
*
* This has been taken from inbot-utils. (MIT licensed)
*
* @see <a href="https://github.com/Inbot/inbot-utils">inbot-utils</a>
*/
@Internal
public class ReplacingInputStream extends FilterInputStream {
// while matching, this is where the bytes go.
final int[] buf;
private int matchedIndex=0;
private int unbufferIndex=0;
private int replacedIndex=0;
private final byte[] pattern;
private final byte[] replacement;
private State state=State.NOT_MATCHED;
// simple state machine for keeping track of what we are doing
private enum State {
NOT_MATCHED,
MATCHING,
REPLACING,
UNBUFFER
}
private static final Charset UTF8 = Charset.forName("UTF-8");
/**
* Replace occurrences of pattern in the input. Note: input is assumed to be UTF-8 encoded. If not the case use byte[] based pattern and replacement.
* @param in input
* @param pattern pattern to replace.
* @param replacement the replacement or null
*/
public ReplacingInputStream(InputStream in, String pattern, String replacement) {
this(in, pattern.getBytes(UTF8), replacement==null ? null : replacement.getBytes(UTF8));
}
/**
* Replace occurrences of pattern in the input.<p>
*
* If you want to normalize line endings DOS/MAC (\n\r | \r) to UNIX (\n), you can call the following:<br/>
* {@code new ReplacingInputStream(new ReplacingInputStream(is, "\n\r", "\n"), "\r", "\n")}
*
* @param in input
* @param pattern pattern to replace
* @param replacement the replacement or null
*/
public ReplacingInputStream(InputStream in, byte[] pattern, byte[] replacement) {
super(in);
if (pattern == null || pattern.length == 0) {
throw new IllegalArgumentException("pattern length should be > 0");
}
this.pattern = pattern;
this.replacement = replacement;
// we will never match more than the pattern length
buf = new int[pattern.length];
}
@Override
public int read(byte[] b, int off, int len) throws IOException {
// copy of parent logic; we need to call our own read() instead of super.read(), which delegates instead of calling our read
if (b == null) {
throw new NullPointerException();
} else if (off < 0 || len < 0 || len > b.length - off) {
throw new IndexOutOfBoundsException();
} else if (len == 0) {
return 0;
}
int c = read();
if (c == -1) {
return -1;
}
b[off] = (byte)c;
int i = 1;
for (; i < len ; i++) {
c = read();
if (c == -1) {
break;
}
b[off + i] = (byte)c;
}
return i;
}
@Override
public int read(byte[] b) throws IOException {
// call our own read
return read(b, 0, b.length);
}
@Override
public int read() throws IOException {
// use a simple state machine to figure out what we are doing
int next;
switch (state) {
default:
case NOT_MATCHED:
// we are not currently matching, replacing, or unbuffering
next=super.read();
if (pattern[0] != next) {
return next;
}
// clear whatever was there
Arrays.fill(buf, 0);
// make sure we start at 0
matchedIndex=0;
buf[matchedIndex++]=next;
if (pattern.length == 1) {
// edge-case when the pattern length is 1 we go straight to replacing
state=State.REPLACING;
// reset replace counter
replacedIndex=0;
} else {
// pattern of length 1
state=State.MATCHING;
}
// recurse to continue matching
return read();
case MATCHING:
// the previous bytes matched part of the pattern
next=super.read();
if (pattern[matchedIndex]==next) {
buf[matchedIndex++]=next;
if (matchedIndex==pattern.length) {
// we've found a full match!
if (replacement==null || replacement.length==0) {
// the replacement is empty, go straight to NOT_MATCHED
state=State.NOT_MATCHED;
matchedIndex=0;
} else {
// start replacing
state=State.REPLACING;
replacedIndex=0;
}
}
} else {
// mismatch -> unbuffer
buf[matchedIndex++]=next;
state=State.UNBUFFER;
unbufferIndex=0;
}
return read();
case REPLACING:
// we've fully matched the pattern and are returning bytes from the replacement
next=replacement[replacedIndex++];
if (replacedIndex==replacement.length) {
state=State.NOT_MATCHED;
replacedIndex=0;
}
return next;
case UNBUFFER:
// we partially matched the pattern before encountering a non matching byte
// we need to serve up the buffered bytes before we go back to NOT_MATCHED
next=buf[unbufferIndex++];
if (unbufferIndex==matchedIndex) {
state=State.NOT_MATCHED;
matchedIndex=0;
}
return next;
}
}
@Override
public String toString() {
return state.name() + " " + matchedIndex + " " + replacedIndex + " " + unbufferIndex;
}
}

View File

@ -34,7 +34,7 @@ import javax.xml.namespace.QName;
import org.apache.poi.POIXMLDocumentPart;
import org.apache.poi.openxml4j.opc.PackagePart;
import org.apache.poi.util.DocumentHelper;
import org.apache.poi.xssf.util.EvilUnclosedBRFixingInputStream;
import org.apache.poi.util.ReplacingInputStream;
import org.apache.xmlbeans.XmlCursor;
import org.apache.xmlbeans.XmlException;
import org.apache.xmlbeans.XmlObject;
@ -124,7 +124,13 @@ public final class XSSFVMLDrawing extends POIXMLDocumentPart {
protected void read(InputStream is) throws IOException, XmlException {
Document doc;
try {
doc = DocumentHelper.readDocument(new EvilUnclosedBRFixingInputStream(is));
/*
* This is a seriously sick fix for the fact that some .xlsx files contain raw bits
* of HTML, without being escaped or properly turned into XML.
* The result is that they contain things like &gt;br&lt;, which breaks the XML parsing.
* This very sick InputStream wrapper attempts to spot these go past, and fix them.
*/
doc = DocumentHelper.readDocument(new ReplacingInputStream(is, "<br>", "<br/>"));
} catch (SAXException e) {
throw new XmlException(e.getMessage(), e);
}
@ -146,7 +152,9 @@ public final class XSSFVMLDrawing extends POIXMLDocumentPart {
String id = shape.getId();
if(id != null) {
Matcher m = ptrn_shapeId.matcher(id);
if(m.find()) _shapeId = Math.max(_shapeId, Integer.parseInt(m.group(1)));
if(m.find()) {
_shapeId = Math.max(_shapeId, Integer.parseInt(m.group(1)));
}
}
_items.add(shape);
} else {

View File

@ -16,9 +16,11 @@
==================================================================== */
package org.apache.poi.xssf.util;
import java.io.IOException;
import java.io.InputStream;
import java.util.ArrayList;
import org.apache.poi.util.Internal;
import org.apache.poi.util.Removal;
import org.apache.poi.util.ReplacingInputStream;
/**
* This is a seriously sick fix for the fact that some .xlsx
@ -31,179 +33,14 @@ import java.util.ArrayList;
* Only works for UTF-8 and US-ASCII based streams!
* It should only be used where experience shows the problem
* can occur...
*
* @deprecated 3.16-beta2 - use ReplacingInputStream(source, "&gt;br&lt;", "&gt;br/&lt;")
*/
public class EvilUnclosedBRFixingInputStream extends InputStream {
private InputStream source;
private byte[] spare;
private static byte[] detect = new byte[] {
(byte)'<', (byte)'b', (byte)'r', (byte)'>'
};
@Deprecated
@Removal(version="3.18")
@Internal
public class EvilUnclosedBRFixingInputStream extends ReplacingInputStream {
public EvilUnclosedBRFixingInputStream(InputStream source) {
this.source = source;
}
/**
* Warning - doesn't fix!
*/
@Override
public int read() throws IOException {
return source.read();
}
@Override
public int read(byte[] b, int off, int len) throws IOException {
// Grab any data left from last time
int readA = readFromSpare(b, off, len);
// Now read from the stream
int readB = source.read(b, off+readA, len-readA);
// Figure out how much we've done
int read;
if(readB == -1 || readB == 0) {
if (readA == 0) {
return readB;
}
read = readA;
} else {
read = readA + readB;
}
// Fix up our data
if(read > 0) {
read = fixUp(b, off, read);
}
// All done
return read;
}
@Override
public int read(byte[] b) throws IOException {
return this.read(b, 0, b.length);
}
/**
* Reads into the buffer from the spare bytes
*/
private int readFromSpare(byte[] b, int offset, int len) {
if(spare == null) return 0;
if(len == 0) throw new IllegalArgumentException("Asked to read 0 bytes");
if(spare.length <= len) {
// All fits, good
System.arraycopy(spare, 0, b, offset, spare.length);
int read = spare.length;
spare = null;
return read;
} else {
// We have more spare than they can copy with...
byte[] newspare = new byte[spare.length-len];
System.arraycopy(spare, 0, b, offset, len);
System.arraycopy(spare, len, newspare, 0, newspare.length);
spare = newspare;
return len;
}
}
private void addToSpare(byte[] b, int offset, int len, boolean atTheEnd) {
if(spare == null) {
spare = new byte[len];
System.arraycopy(b, offset, spare, 0, len);
} else {
byte[] newspare = new byte[spare.length+len];
if(atTheEnd) {
System.arraycopy(spare, 0, newspare, 0, spare.length);
System.arraycopy(b, offset, newspare, spare.length, len);
} else {
System.arraycopy(b, offset, newspare, 0, len);
System.arraycopy(spare, 0, newspare, len, spare.length);
}
spare = newspare;
}
}
private int fixUp(byte[] b, int offset, int read) {
// Do we have any potential overhanging ones?
for(int i=0; i<detect.length-1; i++) {
int base = offset+read-1-i;
if(base < 0) continue;
boolean going = true;
for(int j=0; j<=i && going; j++) {
if(b[base+j] == detect[j]) {
// Matches
} else {
going = false;
}
}
if(going) {
// There could be a <br> handing over the end, eg <br|
addToSpare(b, base, i+1, true);
read -= 1;
read -= i;
break;
}
}
// Find places to fix
ArrayList<Integer> fixAt = new ArrayList<Integer>();
for(int i=offset; i<=offset+read-detect.length; i++) {
boolean going = true;
for(int j=0; j<detect.length && going; j++) {
if(b[i+j] != detect[j]) {
going = false;
}
}
if(going) {
fixAt.add(i);
}
}
if(fixAt.size()==0) {
return read;
}
// If there isn't space in the buffer to contain
// all the fixes, then save the overshoot for next time
int needed = offset+read+fixAt.size();
int overshoot = needed - b.length;
if(overshoot > 0) {
// Make sure we don't loose part of a <br>!
int fixes = 0;
for(int at : fixAt) {
if(at > offset+read-detect.length-overshoot-fixes) {
overshoot = needed - at - 1 - fixes;
break;
}
fixes++;
}
addToSpare(b, offset+read-overshoot, overshoot, false);
read -= overshoot;
}
// Fix them, in reverse order so the
// positions are valid
for(int j=fixAt.size()-1; j>=0; j--) {
int i = fixAt.get(j);
if(i >= read+offset) {
// This one has moved into the overshoot
continue;
}
if(i > read-3) {
// This one has moved into the overshoot
continue;
}
byte[] tmp = new byte[read-i-3];
System.arraycopy(b, i+3, tmp, 0, tmp.length);
b[i+3] = (byte)'/';
System.arraycopy(tmp, 0, b, i+4, tmp.length);
// It got one longer
read++;
}
return read;
super(source, "<br>", "<br/>");
}
}

View File

@ -16,18 +16,28 @@
==================================================================== */
package org.apache.poi.xssf.usermodel;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertNull;
import static org.junit.Assert.assertSame;
import static org.junit.Assert.assertTrue;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.math.BigInteger;
import java.util.List;
import java.util.regex.Pattern;
import com.microsoft.schemas.office.excel.STTrueFalseBlank;
import org.apache.poi.POIDataSamples;
import org.apache.xmlbeans.XmlException;
import org.apache.xmlbeans.XmlObject;
import org.junit.Test;
import com.microsoft.schemas.office.excel.CTClientData;
import com.microsoft.schemas.office.excel.STObjectType;
import com.microsoft.schemas.office.excel.STTrueFalseBlank;
import com.microsoft.schemas.office.office.CTShapeLayout;
import com.microsoft.schemas.office.office.STConnectType;
import com.microsoft.schemas.office.office.STInsetMode;
@ -37,14 +47,10 @@ import com.microsoft.schemas.vml.CTShapetype;
import com.microsoft.schemas.vml.STExt;
import com.microsoft.schemas.vml.STTrueFalse;
import junit.framework.TestCase;
public class TestXSSFVMLDrawing {
/**
* @author Yegor Kozlov
*/
public class TestXSSFVMLDrawing extends TestCase {
public void testNew() throws Exception {
@Test
public void testNew() throws IOException, XmlException {
XSSFVMLDrawing vml = new XSSFVMLDrawing();
List<XmlObject> items = vml.getItems();
assertEquals(2, items.size());
@ -57,7 +63,7 @@ public class TestXSSFVMLDrawing extends TestCase {
assertTrue(items.get(1) instanceof CTShapetype);
CTShapetype type = (CTShapetype)items.get(1);
assertEquals("21600,21600", type.getCoordsize());
assertEquals(202.0f, type.getSpt());
assertEquals(202.0f, type.getSpt(), 0);
assertEquals("m,l,21600r21600,l21600,xe", type.getPath2());
assertEquals("_x0000_t202", type.getId());
assertEquals(STTrueFalse.T, type.getPathArray(0).getGradientshapeok());
@ -102,7 +108,8 @@ public class TestXSSFVMLDrawing extends TestCase {
assertTrue(items2.get(2) instanceof CTShape);
}
public void testFindCommentShape() throws Exception {
@Test
public void testFindCommentShape() throws IOException, XmlException {
XSSFVMLDrawing vml = new XSSFVMLDrawing();
InputStream stream = POIDataSamples.getSpreadSheetInstance().openResourceAsStream("vmlDrawing1.vml");
@ -140,7 +147,8 @@ public class TestXSSFVMLDrawing extends TestCase {
assertSame(sh_a1, newVml.findCommentShape(0, 1));
}
public void testRemoveCommentShape() throws Exception {
@Test
public void testRemoveCommentShape() throws IOException, XmlException {
XSSFVMLDrawing vml = new XSSFVMLDrawing();
InputStream stream = POIDataSamples.getSpreadSheetInstance().openResourceAsStream("vmlDrawing1.vml");
try {
@ -156,4 +164,22 @@ public class TestXSSFVMLDrawing extends TestCase {
assertNull(vml.findCommentShape(0, 0));
}
@Test
public void testEvilUnclosedBRFixing() throws IOException, XmlException {
XSSFVMLDrawing vml = new XSSFVMLDrawing();
InputStream stream = POIDataSamples.getOpenXML4JInstance().openResourceAsStream("bug-60626.vml");
try {
vml.read(stream);
} finally {
stream.close();
}
Pattern p = Pattern.compile("<br/>");
int count = 0;
for (XmlObject xo : vml.getItems()) {
String split[] = p.split(xo.toString());
count += split.length-1;
}
assertEquals(16, count);
}
}

View File

@ -17,94 +17,78 @@
package org.apache.poi.xssf.util;
import static org.junit.Assert.assertArrayEquals;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.nio.charset.Charset;
import junit.framework.TestCase;
import org.apache.poi.util.IOUtils;
import org.apache.poi.util.ReplacingInputStream;
import org.junit.Test;
public final class TestEvilUnclosedBRFixingInputStream extends TestCase {
public void testOK() throws Exception {
byte[] ok = "<p><div>Hello There!</div> <div>Tags!</div></p>".getBytes("UTF-8");
public final class TestEvilUnclosedBRFixingInputStream {
EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(
new ByteArrayInputStream(ok)
);
static class EvilUnclosedBRFixingInputStream extends ReplacingInputStream {
public EvilUnclosedBRFixingInputStream(byte[] source) {
super(new ByteArrayInputStream(source), "<br>", "<br/>");
}
}
ByteArrayOutputStream bout = new ByteArrayOutputStream();
boolean going = true;
while(going) {
byte[] b = new byte[1024];
int r = inp.read(b);
if(r > 0) {
bout.write(b, 0, r);
} else {
going = false;
}
}
@Test
public void testOK() throws IOException {
byte[] ok = getBytes("<p><div>Hello There!</div> <div>Tags!</div></p>");
byte[] result = bout.toByteArray();
assertEquals(ok, result);
}
EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(ok);
public void testProblem() throws Exception {
byte[] orig = "<p><div>Hello<br>There!</div> <div>Tags!</div></p>".getBytes("UTF-8");
byte[] fixed = "<p><div>Hello<br/>There!</div> <div>Tags!</div></p>".getBytes("UTF-8");
assertArrayEquals(ok, IOUtils.toByteArray(inp));
inp.close();
}
EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(
new ByteArrayInputStream(orig)
);
@Test
public void testProblem() throws IOException {
byte[] orig = getBytes("<p><div>Hello<br>There!</div> <div>Tags!</div></p>");
byte[] fixed = getBytes("<p><div>Hello<br/>There!</div> <div>Tags!</div></p>");
ByteArrayOutputStream bout = new ByteArrayOutputStream();
boolean going = true;
while(going) {
byte[] b = new byte[1024];
int r = inp.read(b);
if(r > 0) {
bout.write(b, 0, r);
} else {
going = false;
}
}
EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(orig);
byte[] result = bout.toByteArray();
assertEquals(fixed, result);
}
assertArrayEquals(fixed, IOUtils.toByteArray(inp));
inp.close();
}
/**
* Checks that we can copy with br tags around the buffer boundaries
*/
public void testBufferSize() throws Exception {
byte[] orig = "<p><div>Hello<br> <br>There!</div> <div>Tags!<br><br></div></p>".getBytes("UTF-8");
byte[] fixed = "<p><div>Hello<br/> <br/>There!</div> <div>Tags!<br/><br/></div></p>".getBytes("UTF-8");
/**
* Checks that we can copy with br tags around the buffer boundaries
*/
@Test
public void testBufferSize() throws IOException {
byte[] orig = getBytes("<p><div>Hello<br> <br>There!</div> <div>Tags!<br><br></div></p>");
byte[] fixed = getBytes("<p><div>Hello<br/> <br/>There!</div> <div>Tags!<br/><br/></div></p>");
// Vary the buffer size, so that we can end up with the br in the
// overflow or only part in the buffer
for(int i=5; i<orig.length; i++) {
EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(
new ByteArrayInputStream(orig)
);
// Vary the buffer size, so that we can end up with the br in the
// overflow or only part in the buffer
for(int i=5; i<orig.length; i++) {
EvilUnclosedBRFixingInputStream inp = new EvilUnclosedBRFixingInputStream(orig);
ByteArrayOutputStream bout = new ByteArrayOutputStream();
boolean going = true;
while(going) {
byte[] b = new byte[i];
int r = inp.read(b);
if(r > 0) {
bout.write(b, 0, r);
} else {
going = false;
ByteArrayOutputStream bout = new ByteArrayOutputStream();
boolean going = true;
while(going) {
byte[] b = new byte[i];
int r = inp.read(b);
if(r > 0) {
bout.write(b, 0, r);
} else {
going = false;
}
}
}
byte[] result = bout.toByteArray();
assertEquals(fixed, result);
}
}
byte[] result = bout.toByteArray();
assertArrayEquals(fixed, result);
inp.close();
}
}
protected void assertEquals(byte[] a, byte[] b) {
assertEquals(a.length, b.length);
for(int i=0; i<a.length; i++) {
assertEquals("Wrong byte at index " + i, a[i], b[i]);
}
}
private static byte[] getBytes(String str) {
return str.getBytes(Charset.forName("UTF-8"));
}
}

View File

@ -0,0 +1,658 @@
<xml xmlns:v="urn:schemas-microsoft-com:vml"
xmlns:o="urn:schemas-microsoft-com:office:office"
xmlns:x="urn:schemas-microsoft-com:office:excel">
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="46,98,145,186,227"/>
</o:shapelayout><v:shapetype id="_x0000_t201" coordsize="21600,21600" o:spt="201"
path="m,l,21600r21600,l21600,xe">
<v:stroke joinstyle="miter"/>
<v:path shadowok="f" o:extrusionok="f" strokeok="f" fillok="f" o:connecttype="rect"/>
<o:lock v:ext="edit" shapetype="t"/>
</v:shapetype><v:shape id="_x0000_s47105" type="#_x0000_t201" style='position:absolute;
margin-left:15pt;margin-top:323.25pt;width:147.75pt;height:13.5pt;z-index:1;
mso-wrap-style:tight' stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<o:lock v:ext="edit" rotation="t" text="t"/>
<x:ClientData ObjectType="Drop">
<x:SizeWithCells/>
<x:Anchor>
1, 2, 23, 2, 1, 199, 24, 0</x:Anchor>
<x:PrintObject>False</x:PrintObject>
<x:AutoLine>False</x:AutoLine>
<x:FmlaLink>Risikodaten!$AF$48</x:FmlaLink>
<x:Val>0</x:Val>
<x:Min>0</x:Min>
<x:Max>3</x:Max>
<x:Inc>1</x:Inc>
<x:Page>1</x:Page>
<x:Dx>16</x:Dx>
<x:FmlaRange>Risikodaten!$AG$44:$AG$47</x:FmlaRange>
<x:Sel>4</x:Sel>
<x:NoThreeD2/>
<x:SelType>Single</x:SelType>
<x:LCT>Normal</x:LCT>
<x:DropStyle>Combo</x:DropStyle>
<x:DropLines>8</x:DropLines>
</x:ClientData>
</v:shape><v:shape id="_x0000_s47106" type="#_x0000_t201" style='position:absolute;
margin-left:971.25pt;margin-top:203.25pt;width:21pt;height:17.25pt;z-index:2;
mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
20, 14, 15, 2, 21, 1, 16, 5</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:FmlaLink>$U$16</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s47123" type="#_x0000_t201" style='position:absolute;
margin-left:971.25pt;margin-top:147.75pt;width:17.25pt;height:16.5pt;
z-index:3;mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
20, 14, 11, 0, 20, 37, 12, 4</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:Checked>1</x:Checked>
<x:FmlaLink>Risikodaten!E16</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s47124" type="#_x0000_t201" style='position:absolute;
margin-left:15pt;margin-top:336.75pt;width:147.75pt;height:14.25pt;z-index:4;
mso-wrap-style:tight' stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<v:fill o:detectmouseclick="t"/>
<o:lock v:ext="edit" rotation="t" text="t"/>
<x:ClientData ObjectType="Drop">
<x:SizeWithCells/>
<x:Anchor>
1, 2, 24, 0, 1, 199, 24, 19</x:Anchor>
<x:PrintObject>False</x:PrintObject>
<x:AutoLine>False</x:AutoLine>
<x:FmlaLink>Antrag!$Y$65</x:FmlaLink>
<x:Val>0</x:Val>
<x:Min>0</x:Min>
<x:Max>1</x:Max>
<x:Inc>1</x:Inc>
<x:Page>1</x:Page>
<x:Dx>16</x:Dx>
<x:FmlaRange>Antrag!$Z$63:$Z$64</x:FmlaRange>
<x:Sel>2</x:Sel>
<x:NoThreeD2/>
<x:SelType>Single</x:SelType>
<x:LCT>Normal</x:LCT>
<x:DropStyle>Combo</x:DropStyle>
<x:DropLines>8</x:DropLines>
</x:ClientData>
</v:shape><v:shape id="_x0000_s100534" type="#_x0000_t201" style='position:absolute;
margin-left:994.5pt;margin-top:102pt;width:121.5pt;height:15.75pt;z-index:5'
stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<o:lock v:ext="edit" rotation="t" text="t"/>
<x:ClientData ObjectType="Drop">
<x:SizeWithCells/>
<x:Anchor>
21, 4, 7, 11, 23, 28, 8, 14</x:Anchor>
<x:AutoLine>False</x:AutoLine>
<x:FmlaLink>Risikodaten!$AF$22</x:FmlaLink>
<x:Val>0</x:Val>
<x:Min>0</x:Min>
<x:Max>0</x:Max>
<x:Inc>1</x:Inc>
<x:Page>3</x:Page>
<x:Dx>16</x:Dx>
<x:FmlaRange>Risikodaten!$AG$19:$AG$21</x:FmlaRange>
<x:Sel>2</x:Sel>
<x:NoThreeD2/>
<x:SelType>Single</x:SelType>
<x:LCT>Normal</x:LCT>
<x:DropStyle>Combo</x:DropStyle>
<x:DropLines>8</x:DropLines>
</x:ClientData>
</v:shape><v:shape id="_x0000_s100535" type="#_x0000_t201" style='position:absolute;
margin-left:971.25pt;margin-top:177pt;width:15pt;height:11.25pt;z-index:6;
mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
20, 14, 13, 3, 20, 34, 14, 0</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:Checked>1</x:Checked>
<x:FmlaLink>Risikodaten!$J$13</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s100536" type="#_x0000_t201" style='position:absolute;
margin-left:971.25pt;margin-top:190.5pt;width:15pt;height:11.25pt;z-index:7;
mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
20, 14, 14, 3, 20, 34, 15, 0</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:FmlaLink>Risikodaten!$J$14</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s100537" type="#_x0000_t201" style='position:absolute;
margin-left:971.25pt;margin-top:163.5pt;width:15pt;height:11.25pt;z-index:8;
mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
20, 14, 12, 3, 20, 34, 13, 0</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:Checked>1</x:Checked>
<x:FmlaLink>Risikodaten!$J$12</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s100539" type="#_x0000_t201" style='position:absolute;
margin-left:971.25pt;margin-top:122.25pt;width:15pt;height:11.25pt;z-index:9;
mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
20, 14, 9, 2, 20, 34, 9, 17</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:FmlaLink>Risikodaten!$J$9</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s100760" type="#_x0000_t201" style='position:absolute;
margin-left:1255.5pt;margin-top:336.75pt;width:15.75pt;height:11.25pt;
z-index:10;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
25, 70, 24, 0, 26, 19, 24, 15</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:FmlaLink>Risikodaten!$AD$8</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="ComboBox1" o:spid="_x0000_s149031" type="#_x0000_t201"
style='position:absolute;margin-left:1190.25pt;margin-top:6.75pt;width:173.25pt;
height:28.5pt;z-index:11;mso-wrap-style:tight' stroked="f" strokecolor="windowText [64]"
o:insetmode="auto">
<v:imagedata o:relid="rId1" o:title=""/>
<x:ClientData ObjectType="Pict">
<x:SizeWithCells/>
<x:Anchor>
24, 55, 0, 9, 27, 70, 2, 13</x:Anchor>
<x:AutoLine>False</x:AutoLine>
<x:FmlaLink>Vermittler!$B$2</x:FmlaLink>
<x:FmlaRange>Vermittler!$M$6:$N$206</x:FmlaRange>
<x:CF>Pict</x:CF>
<x:AutoPict/>
<x:MapOCX/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s149207" type="#_x0000_t201" style='position:absolute;
margin-left:439.5pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:12;
visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
strokecolor="windowText [64]" o:insetmode="auto">
<v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:center'><font face="Calibri" size="200"
color="#800000"><b>Ausblenden<br>
</b></font><font face="Calibri" size="200" color="#800000"><b><br>
</b></font></div>
</v:textbox>
<x:ClientData ObjectType="Button">
<x:Anchor>
9, 12, 25, 9, 9, 88, 25, 25</x:Anchor>
<x:PrintObject>False</x:PrintObject>
<x:AutoFill>False</x:AutoFill>
<x:FmlaMacro>[0]!Ausblenden_Allianz</x:FmlaMacro>
<x:TextHAlign>Center</x:TextHAlign>
<x:TextVAlign>Center</x:TextVAlign>
</x:ClientData>
</v:shape><v:shape id="_x0000_s149208" type="#_x0000_t201" style='position:absolute;
margin-left:354pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:13;
visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
strokecolor="windowText [64]" o:insetmode="auto">
<v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:center'><font face="Calibri" size="200"
color="#800000"><b>Ausblenden<br>
</b></font><font face="Calibri" size="200" color="#800000"><b><br>
</b></font></div>
</v:textbox>
<x:ClientData ObjectType="Button">
<x:Anchor>
7, 12, 25, 9, 7, 88, 25, 25</x:Anchor>
<x:PrintObject>False</x:PrintObject>
<x:AutoFill>False</x:AutoFill>
<x:FmlaMacro>[0]!Ausblenden_Generali</x:FmlaMacro>
<x:TextHAlign>Center</x:TextHAlign>
<x:TextVAlign>Center</x:TextVAlign>
</x:ClientData>
</v:shape><v:shape id="_x0000_s149209" type="#_x0000_t201" style='position:absolute;
margin-left:269.25pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:14;
visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
strokecolor="windowText [64]" o:insetmode="auto">
<v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:center'><font face="Calibri" size="200"
color="#800000"><b>Ausblenden<br>
</b></font><font face="Calibri" size="200" color="#800000"><b><br>
</b></font></div>
</v:textbox>
<x:ClientData ObjectType="Button">
<x:Anchor>
5, 13, 25, 9, 5, 89, 25, 25</x:Anchor>
<x:PrintObject>False</x:PrintObject>
<x:AutoFill>False</x:AutoFill>
<x:FmlaMacro>[0]!Ausblenden_Donau</x:FmlaMacro>
<x:TextHAlign>Center</x:TextHAlign>
<x:TextVAlign>Center</x:TextVAlign>
</x:ClientData>
</v:shape><v:shape id="_x0000_s149210" type="#_x0000_t201" style='position:absolute;
margin-left:524.25pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:15;
visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
strokecolor="windowText [64]" o:insetmode="auto">
<v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:center'><font face="Calibri" size="200"
color="#800000"><b>Ausblenden<br>
</b></font><font face="Calibri" size="200" color="#800000"><b><br>
</b></font></div>
</v:textbox>
<x:ClientData ObjectType="Button">
<x:Anchor>
11, 11, 25, 9, 11, 87, 25, 25</x:Anchor>
<x:PrintObject>False</x:PrintObject>
<x:AutoFill>False</x:AutoFill>
<x:FmlaMacro>[0]!Ausblenden_AragSE</x:FmlaMacro>
<x:TextHAlign>Center</x:TextHAlign>
<x:TextVAlign>Center</x:TextVAlign>
</x:ClientData>
</v:shape><v:shape id="_x0000_s149211" type="#_x0000_t201" style='position:absolute;
margin-left:610.5pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:16;
visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
strokecolor="windowText [64]" o:insetmode="auto">
<v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:center'><font face="Calibri" size="200"
color="#800000"><b>Ausblenden<br>
</b></font><font face="Calibri" size="200" color="#800000"><b><br>
</b></font></div>
</v:textbox>
<x:ClientData ObjectType="Button">
<x:Anchor>
13, 12, 25, 9, 13, 88, 25, 25</x:Anchor>
<x:PrintObject>False</x:PrintObject>
<x:AutoFill>False</x:AutoFill>
<x:FmlaMacro>[0]!Ausblenden_HDI</x:FmlaMacro>
<x:TextHAlign>Center</x:TextHAlign>
<x:TextVAlign>Center</x:TextVAlign>
</x:ClientData>
</v:shape><v:shape id="_x0000_s149212" type="#_x0000_t201" style='position:absolute;
margin-left:696pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:17;
visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
strokecolor="windowText [64]" o:insetmode="auto">
<v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:center'><font face="Calibri" size="200"
color="#800000"><b>Ausblenden<br>
</b></font><font face="Calibri" size="200" color="#800000"><b><br>
</b></font></div>
</v:textbox>
<x:ClientData ObjectType="Button">
<x:Anchor>
15, 12, 25, 9, 15, 88, 25, 25</x:Anchor>
<x:PrintObject>False</x:PrintObject>
<x:AutoFill>False</x:AutoFill>
<x:FmlaMacro>[0]!Ausblenden_Zürich</x:FmlaMacro>
<x:TextHAlign>Center</x:TextHAlign>
<x:TextVAlign>Center</x:TextVAlign>
</x:ClientData>
</v:shape><v:shape id="_x0000_s149213" type="#_x0000_t201" style='position:absolute;
margin-left:781.5pt;margin-top:358.5pt;width:57pt;height:12pt;z-index:18;
visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
strokecolor="windowText [64]" o:insetmode="auto">
<v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:center'><font face="Calibri" size="200"
color="#800000"><b>Ausblenden<br>
</b></font><font face="Calibri" size="200" color="#800000"><b><br>
</b></font></div>
</v:textbox>
<x:ClientData ObjectType="Button">
<x:Anchor>
17, 12, 25, 9, 17, 88, 25, 25</x:Anchor>
<x:PrintObject>False</x:PrintObject>
<x:AutoFill>False</x:AutoFill>
<x:FmlaMacro>[0]!Ausblenden_Uniqa</x:FmlaMacro>
<x:TextHAlign>Center</x:TextHAlign>
<x:TextVAlign>Center</x:TextVAlign>
</x:ClientData>
</v:shape><v:shape id="_x0000_s149258" type="#_x0000_t201" style='position:absolute;
margin-left:182.25pt;margin-top:354.75pt;width:55.5pt;height:11.25pt;
z-index:19;visibility:visible;mso-wrap-style:tight' o:button="t" fillcolor="buttonFace [67]"
strokecolor="windowText [64]" o:insetmode="auto">
<v:fill color2="buttonFace [67]" o:detectmouseclick="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:center'><font face="Calibri" size="200"
color="#800000"><b>Ausblenden<br>
</b></font><font face="Calibri" size="200" color="#800000"><b><br>
</b></font></div>
</v:textbox>
<x:ClientData ObjectType="Button">
<x:Anchor>
3, 11, 25, 4, 3, 85, 25, 19</x:Anchor>
<x:PrintObject>False</x:PrintObject>
<x:AutoFill>False</x:AutoFill>
<x:FmlaMacro>[0]!Ausblenden_VU_bisher</x:FmlaMacro>
<x:TextHAlign>Center</x:TextHAlign>
<x:TextVAlign>Center</x:TextVAlign>
</x:ClientData>
</v:shape><v:shape id="_x0000_s191175" type="#_x0000_t201" style='position:absolute;
margin-left:993pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;z-index:20;
mso-wrap-style:tight' filled="f" fillcolor="window [65]" stroked="f"
strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
21, 2, 19, 14, 22, 2, 20, 11</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:Checked>1</x:Checked>
<x:FmlaLink>Risikodaten!Y20</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s191176" type="#_x0000_t201" style='position:absolute;
margin-left:1042.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;
z-index:21;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
22, 2, 19, 14, 22, 68, 20, 11</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:Checked>1</x:Checked>
<x:FmlaLink>Risikodaten!Z20</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s191177" type="#_x0000_t201" style='position:absolute;
margin-left:1096.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;
z-index:22;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
23, 2, 19, 14, 23, 68, 20, 11</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:Checked>1</x:Checked>
<x:FmlaLink>Risikodaten!AA20</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s191178" type="#_x0000_t201" style='position:absolute;
margin-left:1150.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;
z-index:23;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
24, 2, 19, 14, 24, 68, 20, 11</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:Checked>1</x:Checked>
<x:FmlaLink>Risikodaten!AB20</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s191179" type="#_x0000_t201" style='position:absolute;
margin-left:1204.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;
z-index:24;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
25, 2, 19, 14, 25, 68, 20, 11</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:Checked>1</x:Checked>
<x:FmlaLink>Risikodaten!AC20</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s191180" type="#_x0000_t201" style='position:absolute;
margin-left:1258.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;
z-index:25;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
26, 2, 19, 14, 26, 68, 20, 11</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:Checked>1</x:Checked>
<x:FmlaLink>Risikodaten!AD20</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s191181" type="#_x0000_t201" style='position:absolute;
margin-left:1312.5pt;margin-top:272.25pt;width:49.5pt;height:12.75pt;
z-index:26;mso-wrap-style:tight' filled="f" fillcolor="window [65]"
stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'><font face="Tahoma" size="160" color="#000000">erh.NL</font></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
27, 2, 19, 14, 27, 68, 20, 11</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:TextVAlign>Center</x:TextVAlign>
<x:Checked>1</x:Checked>
<x:FmlaLink>Risikodaten!AE20</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s191430" type="#_x0000_t201" style='position:absolute;
margin-left:970.5pt;margin-top:13.5pt;width:15pt;height:10.5pt;z-index:27;
mso-wrap-style:tight' o:button="t" filled="f" fillcolor="window [65]"
stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<v:fill o:detectmouseclick="t"/>
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
20, 13, 1, 1, 20, 33, 1, 15</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:FmlaMacro>[0]!Anzeige_Deckung</x:FmlaMacro>
<x:TextVAlign>Center</x:TextVAlign>
<x:Checked>1</x:Checked>
<x:FmlaLink>Risikodaten!$I$8</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s191431" type="#_x0000_t201" style='position:absolute;
margin-left:970.5pt;margin-top:26.25pt;width:15pt;height:11.25pt;z-index:28;
mso-wrap-style:tight' o:button="t" filled="f" fillcolor="window [65]"
stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<v:fill o:detectmouseclick="t"/>
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
20, 13, 2, 1, 20, 33, 2, 16</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:FmlaMacro>[0]!Anzeige_Deckung</x:FmlaMacro>
<x:TextVAlign>Center</x:TextVAlign>
<x:Checked>1</x:Checked>
<x:FmlaLink>Risikodaten!$I22</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shape id="_x0000_s191432" type="#_x0000_t201" style='position:absolute;
margin-left:970.5pt;margin-top:39pt;width:15pt;height:11.25pt;z-index:29;
mso-wrap-style:tight' o:button="t" filled="f" fillcolor="window [65]"
stroked="f" strokecolor="windowText [64]" o:insetmode="auto">
<v:fill o:detectmouseclick="t"/>
<v:path shadowok="t" strokeok="t" fillok="t"/>
<o:lock v:ext="edit" rotation="t"/>
<v:textbox style='mso-direction-alt:auto' o:singleclick="f">
<div style='text-align:left'></div>
</v:textbox>
<x:ClientData ObjectType="Checkbox">
<x:SizeWithCells/>
<x:Anchor>
20, 13, 3, 1, 20, 33, 3, 16</x:Anchor>
<x:AutoFill>False</x:AutoFill>
<x:AutoLine>False</x:AutoLine>
<x:FmlaMacro>[0]!Anzeige_Deckung</x:FmlaMacro>
<x:TextVAlign>Center</x:TextVAlign>
<x:FmlaLink>Risikodaten!$I$29</x:FmlaLink>
<x:NoThreeD/>
</x:ClientData>
</v:shape><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75"
o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
<v:stroke joinstyle="miter"/>
<v:formulas>
<v:f eqn="if lineDrawn pixelLineWidth 0"/>
<v:f eqn="sum @0 1 0"/>
<v:f eqn="sum 0 0 @1"/>
<v:f eqn="prod @2 1 2"/>
<v:f eqn="prod @3 21600 pixelWidth"/>
<v:f eqn="prod @3 21600 pixelHeight"/>
<v:f eqn="sum @0 0 1"/>
<v:f eqn="prod @6 1 2"/>
<v:f eqn="prod @7 21600 pixelWidth"/>
<v:f eqn="sum @8 21600 0"/>
<v:f eqn="prod @7 21600 pixelHeight"/>
<v:f eqn="sum @10 21600 0"/>
</v:formulas>
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"/>
<o:lock v:ext="edit" aspectratio="t"/>
</v:shapetype><v:shape id="Grafik_x0020_5" o:spid="_x0000_s232729" type="#_x0000_t75"
style='position:absolute;margin-left:14.25pt;margin-top:73.5pt;width:604.5pt;
height:102.75pt;z-index:30;visibility:visible;mso-wrap-style:square'
filled="t" fillcolor="white [9]" stroked="t" strokecolor="windowText [64]">
<v:imagedata o:relid="rId2" o:title=""/>
<x:ClientData ObjectType="Pict">
<x:SizeWithCells/>
<x:Anchor>
1, 1, 5, 9, 13, 23, 13, 2</x:Anchor>
<x:FmlaPict>Antrag!$B$7:$K$13</x:FmlaPict>
<x:CF>Pict</x:CF>
<x:Camera/>
</x:ClientData>
</v:shape><v:shape id="Grafik_x0020_24" o:spid="_x0000_s232730" type="#_x0000_t75"
style='position:absolute;margin-left:15pt;margin-top:.75pt;width:603.75pt;
height:45pt;z-index:31;visibility:visible;mso-wrap-style:square'
o:preferrelative="f" filled="t" fillcolor="white [9]" stroked="t"
strokecolor="windowText [64]">
<v:imagedata o:relid="rId3" o:title=""/>
<o:lock v:ext="edit" aspectratio="f"/>
<x:ClientData ObjectType="Pict">
<x:SizeWithCells/>
<x:Anchor>
1, 2, 0, 1, 13, 23, 3, 10</x:Anchor>
<x:FmlaPict>$DO$1:$DZ$3</x:FmlaPict>
<x:CF>Pict</x:CF>
<x:Camera/>
</x:ClientData>
</v:shape></xml>