[Libreoffice-commits] core.git: sax/source

[Caolán McNamara]

 sax/source/tools/converter.cxx |   13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

New commits:
commit 89dd6ff111059cdfd254cc63087bb5353e9a416f
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Oct 24 15:41:23 2017 +0100

    ofz#3769 Integer-overflow
    
    Change-Id: Ia245c6042f8c662bab870cf166db94d1cf2db9d3
    Reviewed-on: https://gerrit.libreoffice.org/43781
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sax/source/tools/converter.cxx b/sax/source/tools/converter.cxx
index 0c560865a7b6..1cb8cf190f04 100644
--- a/sax/source/tools/converter.cxx
+++ b/sax/source/tools/converter.cxx
@@ -969,21 +969,15 @@ static Result
 readUnsignedNumber(const OUString & rString,
     sal_Int32 & io_rnPos, sal_Int32 & o_rNumber)
 {
-    bool bOverflow(false);
-    sal_Int64 nTemp(0);
     sal_Int32 nPos(io_rnPos);
 
+    OUStringBuffer aNumber;
     while (nPos < rString.getLength())
     {
         const sal_Unicode c = rString[nPos];
         if (('0' <= c) && (c <= '9'))
         {
-            nTemp *= 10;
-            nTemp += (c - u'0');
-            if (nTemp >= SAL_MAX_INT32)
-            {
-                bOverflow = true;
-            }
+            aNumber.append(c);
         }
         else
         {
@@ -998,6 +992,9 @@ readUnsignedNumber(const OUString & rString,
         return R_NOTHING;
     }
 
+    const sal_Int64 nTemp = aNumber.toString().toInt64();
+    const bool bOverflow = (nTemp >= SAL_MAX_INT32);
+
     io_rnPos = nPos;
     o_rNumber = nTemp;
     return (bOverflow) ? R_OVERFLOW : R_SUCCESS;