[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ieps/ieps.cxx |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

New commits:
commit d271ec87b8ec3264095a5265a7b0f1c073bc211b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Oct 25 12:19:51 2017 +0100

    ofz#3796 Integer-overflow
    
    Change-Id: I9603106dfccf8acbe7f37c549bab66a6aab94fe5
    Reviewed-on: https://gerrit.libreoffice.org/43826
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/ieps/ieps.cxx b/filter/source/graphicfilter/ieps/ieps.cxx
index e0cfb913d631..27ccf4bac5db 100644
--- a/filter/source/graphicfilter/ieps/ieps.cxx
+++ b/filter/source/graphicfilter/ieps/ieps.cxx
@@ -760,13 +760,16 @@ ipsGraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* )
                 {
                     nNumb[ i ] = ImplGetNumber(pDest, nSecurityCount);
                 }
-                if ( nSecurityCount)
+                bool bFail = nSecurityCount == 0;
+                long nWidth(0), nHeight(0);
+                if (!bFail)
+                    bFail = o3tl::checked_sub(nNumb[2], nNumb[0], nWidth) || o3tl::checked_add(nWidth, 1L, nWidth);
+                if (!bFail)
+                    bFail = o3tl::checked_sub(nNumb[3], nNumb[1], nHeight) || o3tl::checked_add(nWidth, 1L, nHeight);
+                if (!bFail)
                 {
                     GDIMetaFile aMtf;
 
-                    long nWidth =  nNumb[2] - nNumb[0] + 1;
-                    long nHeight = nNumb[3] - nNumb[1] + 1;
-
                     // if there is no preview -> try with gs to make one
                     if (!bHasPreview && !utl::ConfigManager::IsAvoidConfig())
                     {