[Libreoffice-commits] core.git: emfio/source

[Caolán McNamara]

 emfio/source/reader/mtftools.cxx |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

New commits:
commit ffb5ad4681f7f68b3b50dc4d94ea7ea8127da5e0
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Nov 4 15:18:22 2017 +0000

    ofz#4055 Integer-overflow
    
    Change-Id: I15f0a48c1e0c4c03f99a74d4d9b58e064d108c72
    Reviewed-on: https://gerrit.libreoffice.org/44304
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/emfio/source/reader/mtftools.cxx b/emfio/source/reader/mtftools.cxx
index 07b2a5b5b3f8..6e104c91fe94 100644
--- a/emfio/source/reader/mtftools.cxx
+++ b/emfio/source/reader/mtftools.cxx
@@ -2004,9 +2004,10 @@ namespace emfio
         {
             if ( mnMapMode == MM_ISOTROPIC ) //TODO: WHAT ABOUT ANISOTROPIC???
             {
-                Size aSize( (mnWinExtX + mnWinOrgX) >> MS_FIXPOINT_BITCOUNT_28_4,
-                          -((mnWinExtY - mnWinOrgY) >> MS_FIXPOINT_BITCOUNT_28_4));
-
+                sal_Int32 nX, nY;
+                if (o3tl::checked_add(mnWinExtX, mnWinOrgX, nX) || o3tl::checked_sub(mnWinExtY, mnWinOrgY, nY))
+                    return;
+                Size aSize(nX >> MS_FIXPOINT_BITCOUNT_28_4, -(nY >> MS_FIXPOINT_BITCOUNT_28_4));
                 SetDevExt(aSize, false);
             }
         }