[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ios2met/ios2met.cxx |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

New commits:
commit 08deeace490acc5b84b97b92e5960f6b6a920e53
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Oct 24 11:47:27 2017 +0100

    ofz#3755 Integer-overflow
    
    Change-Id: If21e45ce711d483cdd27e96877ee7f3ca35c2f14
    Reviewed-on: https://gerrit.libreoffice.org/43753
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx
index 369de5eca38a..ee0d2d7a885f 100644
--- a/filter/source/graphicfilter/ios2met/ios2met.cxx
+++ b/filter/source/graphicfilter/ios2met/ios2met.cxx
@@ -2048,8 +2048,12 @@ void OS2METReader::ReadOrder(sal_uInt16 nOrderID, sal_uInt16 nOrderLen)
         case GOrdSChCel: {
             sal_uInt8 nbyte;
             sal_uInt16 nLen=nOrderLen;
-            aAttr.aChrCellSize.Width()=ReadCoord(bCoord32);
-            aAttr.aChrCellSize.Height()=ReadCoord(bCoord32);
+            auto nWidth = ReadCoord(bCoord32);
+            auto nHeight = ReadCoord(bCoord32);
+            if (nWidth < 0 || nHeight < 0)
+                aAttr.aChrCellSize = aDefAttr.aChrCellSize;
+            else
+                aAttr.aChrCellSize = Size(nWidth, nHeight);
             if (bCoord32) nLen-=8; else nLen-=4;
             if (nLen>=4) {
                 pOS2MET->SeekRel(4); nLen-=4;
@@ -2057,7 +2061,7 @@ void OS2METReader::ReadOrder(sal_uInt16 nOrderID, sal_uInt16 nOrderLen)
             if (nLen>=2) {
                 pOS2MET->ReadUChar( nbyte );
                 if ((nbyte&0x80)==0 && aAttr.aChrCellSize==Size(0,0))
-                    aAttr.aChrCellSize=aDefAttr.aChrCellSize;
+                    aAttr.aChrCellSize = aDefAttr.aChrCellSize;
             }
             break;
         }