[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/html/swhtml.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit db592f3ba822ccec17103c935de5d0702aee87a5
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Dec 25 21:07:37 2017 +0000

    ofz#4783: Integer-overflow
    
    Change-Id: I44f5c71db2a2da00da510673ee6a596582c8e3b9

diff --git a/sw/source/filter/html/swhtml.cxx b/sw/source/filter/html/swhtml.cxx
index 898d9f58ef8c..53dc9e5e32ef 100644
--- a/sw/source/filter/html/swhtml.cxx
+++ b/sw/source/filter/html/swhtml.cxx
@@ -24,6 +24,7 @@
 #include <com/sun/star/document/XDocumentProperties.hpp>
 #include <com/sun/star/i18n/ScriptType.hpp>
 #include <comphelper/string.hxx>
+#include <o3tl/safeint.hxx>
 #include <rtl/ustrbuf.hxx>
 #include <svx/svxids.hrc>
 #if OSL_DEBUG_LEVEL > 0
@@ -3639,7 +3640,7 @@ void SwHTMLParser::NewFontAttr( HtmlTokenId nToken )
                 sal_Int32 nSSize;
                 if( '+' == rOption.GetString()[0] ||
                     '-' == rOption.GetString()[0] )
-                    nSSize = nBaseSize + rOption.GetSNumber();
+                    nSSize = o3tl::saturating_add<sal_Int32>(nBaseSize, rOption.GetSNumber());
                 else
                     nSSize = (sal_Int32)rOption.GetNumber();