[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/html/svxcss1.cxx |   16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

New commits:
commit 45e5b5da183e57c80287bf182433f529a0e64bd7
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sun Dec 31 14:09:44 2017 +0000

    ofz#4852 Integer-overflow
    
    Change-Id: Ifb6a56783ce02a12f5fa5dfae4c815e963dcfe3c

diff --git a/sw/source/filter/html/svxcss1.cxx b/sw/source/filter/html/svxcss1.cxx
index 2c6b9933d6ea..a1d6ee966d87 100644
--- a/sw/source/filter/html/svxcss1.cxx
+++ b/sw/source/filter/html/svxcss1.cxx
@@ -2868,12 +2868,16 @@ static void ParseCSS1_length( const CSS1Expression *pExpr,
     case CSS1_PIXLENGTH:
     case CSS1_NUMBER:       // because of Netscape and IE
         {
-            long nWidthL = (long)pExpr->GetNumber();
-            long nPWidth = bHori ? 0 : nWidthL;
-            long nPHeight = bHori ? nWidthL : 0;
-            SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight );
-            rLength = (bHori ? nPHeight : nPWidth);
-            rLengthType = SVX_CSS1_LTYPE_TWIP;
+            double fLength = pExpr->GetNumber();
+            if (fLength < SAL_MAX_INT32/2.0 && fLength > SAL_MIN_INT32/2.0)
+            {
+                long nWidthL = (long)fLength;
+                long nPWidth = bHori ? 0 : nWidthL;
+                long nPHeight = bHori ? nWidthL : 0;
+                SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight );
+                rLength = (bHori ? nPHeight : nPWidth);
+                rLengthType = SVX_CSS1_LTYPE_TWIP;
+            }
         }
         break;