[Libreoffice-commits] core.git: libreofficekit/source

[Miklos Vajna]

 libreofficekit/source/gtk/lokdocview.cxx |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

New commits:
commit 28447258fb6d9b8246f2a96d1a86945ef255d110
Author: Miklos Vajna <vmiklos at collabora.co.uk>
Date:   Tue Sep 20 17:04:50 2016 +0200

    lokdocview: guard against int overflow
    
    If a too large rectangle is parsed, the width or the height may be
    larger than std::numeric_limits<int>::max(), in that case just set
    width/height to that max value, instead of allowing an overflow.
    
    Change-Id: Ic01319b01a3f9286501c346ea765868be57466a1

diff --git a/libreofficekit/source/gtk/lokdocview.cxx b/libreofficekit/source/gtk/lokdocview.cxx
index 195335c..d8f2074 100644
--- a/libreofficekit/source/gtk/lokdocview.cxx
+++ b/libreofficekit/source/gtk/lokdocview.cxx
@@ -1035,13 +1035,21 @@ payloadToRectangle (LOKDocView* pDocView, const char* pPayload)
     ++ppCoordinate;
     if (!*ppCoordinate)
         return aRet;
-    aRet.width = atoi(*ppCoordinate);
+    long l = atol(*ppCoordinate);
+    if (l > std::numeric_limits<int>::max())
+        aRet.width = std::numeric_limits<int>::max();
+    else
+        aRet.width = l;
     if (aRet.x + aRet.width > priv->m_nDocumentWidthTwips)
         aRet.width = priv->m_nDocumentWidthTwips - aRet.x;
     ++ppCoordinate;
     if (!*ppCoordinate)
         return aRet;
-    aRet.height = atoi(*ppCoordinate);
+    l = atol(*ppCoordinate);
+    if (l > std::numeric_limits<int>::max())
+        aRet.height = std::numeric_limits<int>::max();
+    else
+        aRet.height = l;
     if (aRet.y + aRet.height > priv->m_nDocumentHeightTwips)
         aRet.height = priv->m_nDocumentHeightTwips - aRet.y;
     g_strfreev(ppCoordinates);