[Libreoffice-commits] core.git: svx/source

[Caolán McNamara]

 svx/source/table/tablelayouter.cxx |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

New commits:
commit 438e8b846f0f1d6fd2007c0871d26c005f254902
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Oct 25 17:16:29 2017 +0100

    ofz Integer-overflow
    
    Change-Id: If78466f091c55279b21aaa936a4b77e665530aa5
    Reviewed-on: https://gerrit.libreoffice.org/43849
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/svx/source/table/tablelayouter.cxx b/svx/source/table/tablelayouter.cxx
index 2c38af69da0d..c6fbe4009b85 100644
--- a/svx/source/table/tablelayouter.cxx
+++ b/svx/source/table/tablelayouter.cxx
@@ -25,6 +25,7 @@
 
 #include <cell.hxx>
 #include "cellrange.hxx"
+#include <o3tl/safeint.hxx>
 #include <tablemodel.hxx>
 #include "tablerow.hxx"
 #include "tablerows.hxx"
@@ -467,11 +468,12 @@ sal_Int32 TableLayouter::distribute( LayoutVector& rLayouts, sal_Int32 nDistribu
                 Layout& rLayout = rLayouts[nIndex];
                 if( (nDistribute > 0) || (rLayout.mnSize > rLayout.mnMinSize) )
                 {
-                    sal_Int32 n;
-                    if( nIndex == (nCount-1) )
-                        n = nDistributed; // for last entity use up rest
-                    else
-                        n  = (nDistribute * rLayout.mnSize) / nCurrentWidth;
+                    sal_Int32 n(nDistributed); // for last entity use up rest
+                    if (nIndex != (nCount-1))
+                    {
+                        bConstrainsBroken |= o3tl::checked_multiply(nDistribute, rLayout.mnSize, n);
+                        n  /= nCurrentWidth;
+                    }
 
                     nDistributed -= n;
                     rLayout.mnSize += n;