[Libreoffice-commits] core.git: starmath/source

[Caolán McNamara]

 starmath/source/mathmlattr.cxx |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

New commits:
commit cd5a4971bb84bb588a990a252a84ed799fe1ebeb
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Dec 10 11:50:09 2017 +0000

    ofz#4578 Integer-overflow
    
    Change-Id: I2fcd530b3217c72385301b8f3456557c8c8cec13
    Reviewed-on: https://gerrit.libreoffice.org/46183
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/starmath/source/mathmlattr.cxx b/starmath/source/mathmlattr.cxx
index f68bc003e4ff..2b0c70335430 100644
--- a/starmath/source/mathmlattr.cxx
+++ b/starmath/source/mathmlattr.cxx
@@ -62,8 +62,12 @@ sal_Int32 ParseMathMLUnsignedNumber(const OUString &rStr, Fraction *pUN)
     assert(nDecimalPoint < nIdx);
     *pUN = Fraction(rStr.copy(0, nDecimalPoint).toInt32(), 1);
     if (++nDecimalPoint < nIdx)
-        *pUN += Fraction(rStr.copy(nDecimalPoint, nIdx-nDecimalPoint).toInt32(),
-                         lcl_GetPowerOf10(nIdx-nDecimalPoint));
+    {
+        const sal_Int32 nDigits = nIdx - nDecimalPoint;
+        if (nDigits > 9)
+            return -1;
+        *pUN += Fraction(rStr.copy(nDecimalPoint, nDigits).toInt32(), lcl_GetPowerOf10(nDigits));
+    }
     return nIdx;
 }