[Libreoffice-commits] core.git: svx/source

[Caolán McNamara]

 svx/source/table/tablelayouter.cxx |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

New commits:
commit 26211f0456227ba7ec23143f8fa6de5c405a8229
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Sat Nov 4 16:34:46 2017 +0000

    ofz#4034 Integer-overflow
    
    Change-Id: I99a4e24e2038387f749051bc268bc74ce808bd96
    Reviewed-on: https://gerrit.libreoffice.org/44306
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/svx/source/table/tablelayouter.cxx b/svx/source/table/tablelayouter.cxx
index fb01fec34282..4eedf944b1bd 100644
--- a/svx/source/table/tablelayouter.cxx
+++ b/svx/source/table/tablelayouter.cxx
@@ -127,12 +127,18 @@ bool TableLayouter::getCellArea( const CellRef& xCell, const CellPos& rPos, base
                 {
                     ///For RTL Table Calculate the Right End of cell instead of Left
                     const sal_Int32 x = maColumns[rPos.mnCol].mnPos + maColumns[rPos.mnCol].mnSize;
-                    rArea = basegfx::B2IRectangle( x-aCellSize.getX(), y, x, y + aCellSize.getY()  );
+                    sal_Int32 startx, endy;
+                    if (o3tl::checked_sub(x, aCellSize.getX(), startx) || o3tl::checked_add(y, aCellSize.getY(), endy))
+                        return false;
+                    rArea = basegfx::B2IRectangle(startx, y, x, endy);
                 }
                 else
                 {
                     const sal_Int32 x = maColumns[rPos.mnCol].mnPos;
-                    rArea = basegfx::B2IRectangle( x, y, x + aCellSize.getX(), y + aCellSize.getY()  );
+                    sal_Int32 endx, endy;
+                    if (o3tl::checked_add(x, aCellSize.getX(), endx) || o3tl::checked_add(y, aCellSize.getY(), endy))
+                        return false;
+                    rArea = basegfx::B2IRectangle(x, y, endx, endy);
                 }
                 return true;
             }