[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/msfilter/msdffimp.cxx |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

New commits:
commit e9e66c61b7de921a7fefebb3bd07afefaec8e2de
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Nov 8 09:03:09 2017 +0000

    ofz#4104 Integer-overflow
    
    Change-Id: Ib5310ebd4f8c7f6a764c2d9e26f66eb2c67dbf07
    Reviewed-on: https://gerrit.libreoffice.org/44446
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index 9c006116d403..2969d000e754 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -4245,16 +4245,16 @@ SdrObject* SvxMSDffManager::ImportShape( const DffRecordHeader& rHd, SvStream& r
         Scale( r );
         Scale( u );
         aObjData.aChildAnchor = tools::Rectangle( l, o, r, u );
-        if ( !rGlobalChildRect.IsEmpty() && !rClientRect.IsEmpty() && rGlobalChildRect.GetWidth() && rGlobalChildRect.GetHeight() )
+        sal_Int32 nWidth, nHeight;
+        if (!rGlobalChildRect.IsEmpty() && !rClientRect.IsEmpty() && rGlobalChildRect.GetWidth() && rGlobalChildRect.GetHeight() &&
+            !o3tl::checked_sub(r, l, nWidth) && !o3tl::checked_sub(u, o, nHeight))
         {
-            double fWidth = r - l;
-            double fHeight= u - o;
             double fXScale = (double)rClientRect.GetWidth() / (double)rGlobalChildRect.GetWidth();
             double fYScale = (double)rClientRect.GetHeight() / (double)rGlobalChildRect.GetHeight();
             double fl = ( ( l - rGlobalChildRect.Left() ) * fXScale ) + rClientRect.Left();
             double fo = ( ( o - rGlobalChildRect.Top()  ) * fYScale ) + rClientRect.Top();
-            fWidth *= fXScale;
-            fHeight *= fYScale;
+            double fWidth = nWidth * fXScale;
+            double fHeight = nHeight * fYScale;
             aObjData.aChildAnchor = tools::Rectangle( Point( (sal_Int32)fl, (sal_Int32)fo ), Size( (sal_Int32)( fWidth + 1 ), (sal_Int32)( fHeight + 1 ) ) );
         }
     }