[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/msfilter/svdfppt.cxx |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

New commits:
commit 9c057c48318804c99f1f19071ff856db252cc476
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Dec 24 11:42:43 2017 +0000

    ofz#4738 Integer-overflow
    
    Change-Id: Id15409ecde9e001d3be7ee60b34d43cbcc654a2e
    Reviewed-on: https://gerrit.libreoffice.org/47045
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index cf0527555ea8..da92297ebd5b 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -7328,11 +7328,15 @@ void CreateTableRows( const Reference< XTableRows >& xTableRows, const std::set<
         sal_Int32 nHeight;
         if ( ++aIter != rRows.end() )
         {
-            nHeight = *aIter - nLastPosition;
+            if (o3tl::checked_sub<sal_Int32>(*aIter, nLastPosition, nHeight))
+                throw lang::IllegalArgumentException();
             nLastPosition = *aIter;
         }
         else
-            nHeight = nTableBottom - nLastPosition;
+        {
+            if (o3tl::checked_sub<sal_Int32>(nTableBottom, nLastPosition, nHeight))
+                throw lang::IllegalArgumentException();
+        }
 
         Reference< XPropertySet > xPropSet( xTableRows->getByIndex( n ), UNO_QUERY_THROW );
         xPropSet->setPropertyValue( "Height", Any( nHeight ) );
@@ -7351,11 +7355,15 @@ void CreateTableColumns( const Reference< XTableColumns >& xTableColumns, const
         sal_Int32 nWidth;
         if ( ++aIter != rColumns.end() )
         {
-            nWidth = *aIter - nLastPosition;
+            if (o3tl::checked_sub<sal_Int32>(*aIter, nLastPosition, nWidth))
+                throw lang::IllegalArgumentException();
             nLastPosition = *aIter;
         }
         else
-            nWidth = nTableRight - nLastPosition;
+        {
+            if (o3tl::checked_sub<sal_Int32>(nTableRight, nLastPosition, nWidth))
+                throw lang::IllegalArgumentException();
+        }
 
         Reference< XPropertySet > xPropSet( xTableColumns->getByIndex( n ), UNO_QUERY_THROW );
         xPropSet->setPropertyValue( "Width", Any( nWidth ) );