[Libreoffice-commits] core.git: sd/source

[Caolán McNamara]

 sd/source/ui/unoidl/unomodel.cxx |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

New commits:
commit bbb104d70dd8130d99e3612e75fb90103c80de7e
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Oct 27 09:11:22 2017 +0100

    ofz#3830 Integer-overflow
    
    Change-Id: Ia58552034aba32e9ecf00745d0cadc1e323c3c41
    Reviewed-on: https://gerrit.libreoffice.org/43933
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sd/source/ui/unoidl/unomodel.cxx b/sd/source/ui/unoidl/unomodel.cxx
index 3bcc1c0f3db9..63964904173b 100644
--- a/sd/source/ui/unoidl/unomodel.cxx
+++ b/sd/source/ui/unoidl/unomodel.cxx
@@ -52,6 +52,7 @@
 #include <editeng/UnoForbiddenCharsTable.hxx>
 #include <svx/svdoutl.hxx>
 #include <editeng/forbiddencharacterstable.hxx>
+#include <o3tl/safeint.hxx>
 #include <svx/UnoNamespaceMap.hxx>
 #include <svx/svdlayer.hxx>
 #include <svx/svdsob.hxx>
@@ -1246,7 +1247,11 @@ void SAL_CALL SdXImpressDocument::setPropertyValue( const OUString& aPropertyNam
                 if( !(aValue >>= aVisArea) || (aVisArea.Width < 0) || (aVisArea.Height < 0) )
                     throw lang::IllegalArgumentException();
 
-                pEmbeddedObj->SetVisArea( ::tools::Rectangle( aVisArea.X, aVisArea.Y, aVisArea.X + aVisArea.Width, aVisArea.Y + aVisArea.Height ) );
+                sal_Int32 nRight, nTop;
+                if (o3tl::checked_add(aVisArea.X, aVisArea.Width, nRight) || o3tl::checked_add(aVisArea.Y, aVisArea.Height, nTop))
+                    throw lang::IllegalArgumentException();
+
+                pEmbeddedObj->SetVisArea(::tools::Rectangle(aVisArea.X, aVisArea.Y, nRight, nTop));
             }
             break;
         case WID_MODEL_CONTFOCUS: