[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ios2met/ios2met.cxx |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

New commits:
commit f3ae7fc962915d6d7b6a4ab16120dd844f9c92a4
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Nov 2 09:42:07 2017 +0000

    Integer-overflow
    
    Change-Id: Ic99219ff65cea0f316831696231ed6ba8dd10b60
    Reviewed-on: https://gerrit.libreoffice.org/44199
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx
index be64a2faa2d3..2311539f7ae9 100644
--- a/filter/source/graphicfilter/ios2met/ios2met.cxx
+++ b/filter/source/graphicfilter/ios2met/ios2met.cxx
@@ -833,8 +833,13 @@ Point OS2METReader::ReadPoint( const bool bAdjustBoundRect )
     x=x-aBoundingRect.Left();
     y=aBoundingRect.Bottom()-y;
 
-    if ( bAdjustBoundRect )
-        aCalcBndRect.Union(tools::Rectangle(x,y,x+1,y+1));
+    if (bAdjustBoundRect)
+    {
+        if (x == SAL_MAX_INT32 || y == SAL_MAX_INT32)
+            pOS2MET->SetError(SVSTREAM_FILEFORMAT_ERROR);
+        else
+            aCalcBndRect.Union(tools::Rectangle(x, y, x + 1, y + 1));
+    }
 
     return Point(x,y);
 }