[Libreoffice-commits] core.git: filter/source

[Caolán McNamara]

 filter/source/graphicfilter/ios2met/ios2met.cxx |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

New commits:
commit 1f28de7e26cb9b12d74b743333dab72e08f53bec
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Wed Apr 4 17:34:04 2018 +0100

    ofz#7366 Integer overflow
    
    Change-Id: Ia81f6681dd846715b75c87dd9ddc8520a2e9ed5a
    Reviewed-on: https://gerrit.libreoffice.org/52403
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx
index 1c1a077355e5..9b0a772ee1c0 100644
--- a/filter/source/graphicfilter/ios2met/ios2met.cxx
+++ b/filter/source/graphicfilter/ios2met/ios2met.cxx
@@ -2037,10 +2037,16 @@ void OS2METReader::ReadOrder(sal_uInt16 nOrderID, sal_uInt16 nOrderLen)
             sal_uInt16 nLen=nOrderLen;
             auto nWidth = ReadCoord(bCoord32);
             auto nHeight = ReadCoord(bCoord32);
-            if (nWidth < 0 || nHeight < 0)
+            if (nWidth < 0 || nHeight < 0 ||
+                nWidth > std::numeric_limits<decltype(nWidth)>::max() ||
+                nHeight > std::numeric_limits<decltype(nHeight)>::max())
+            {
                 aAttr.aChrCellSize = aDefAttr.aChrCellSize;
+            }
             else
+            {
                 aAttr.aChrCellSize = Size(nWidth, nHeight);
+            }
             if (bCoord32) nLen-=8; else nLen-=4;
             if (nLen>=4) {
                 pOS2MET->SeekRel(4); nLen-=4;