[Libreoffice-commits] core.git: emfio/source

[Caolán McNamara]

 emfio/source/reader/emfreader.cxx |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

New commits:
commit aab1018339fba9e6c618a17dfb2a01464555c4dc
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Tue Oct 31 09:02:24 2017 +0000

    ofz#3939 Integer-overflow
    
    Change-Id: Ic35cf6dd77d536ba3ab486b1c752d81037fe7cae
    Reviewed-on: https://gerrit.libreoffice.org/44103
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/emfio/source/reader/emfreader.cxx b/emfio/source/reader/emfreader.cxx
index cfcb6e3feea5..bcd8b7a83855 100644
--- a/emfio/source/reader/emfreader.cxx
+++ b/emfio/source/reader/emfreader.cxx
@@ -1413,14 +1413,17 @@ namespace emfio
                                 ReadDIB(aBitmap, aTmp, true);
 
                                 // test if it is sensible to crop
-                                if ( ( cxSrc > 0 ) && ( cySrc > 0 ) &&
-                                    ( xSrc >= 0 ) && ( ySrc >= 0 ) &&
-                                        ( xSrc + cxSrc <= aBitmap.GetSizePixel().Width() ) &&
-                                            ( ySrc + cySrc <= aBitmap.GetSizePixel().Height() ) )
+                                if ( (cxSrc > 0) && (cySrc > 0) &&
+                                     (xSrc >= 0) && (ySrc >= 0) &&
+                                     (aBitmap.GetSizePixel().Width() >= cxSrc) &&
+                                     (xSrc <= aBitmap.GetSizePixel().Width() - cxSrc) &&
+                                     (aBitmap.GetSizePixel().Height() >= cySrc) &&
+                                     (ySrc <= aBitmap.GetSizePixel().Height() - cySrc) )
                                 {
                                     tools::Rectangle aCropRect( Point( xSrc, ySrc ), Size( cxSrc, cySrc ) );
                                     aBitmap.Crop( aCropRect );
                                 }
+
                                 maBmpSaveList.emplace_back(new BSaveStruct(aBitmap, aRect, dwRop));
                             }
                         }