[Libreoffice-commits] core.git: 2 commits - filter/source sw/source

[Caolán McNamara]

 filter/source/msfilter/msdffimp.cxx |    2 +-
 sw/source/filter/ww8/ww8scan.cxx    |    7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

New commits:
commit a315bfee11b99b41ed6c2fc855e2ff9e10ce9a2b
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Feb 15 09:06:43 2018 +0000

    ofz#6364 Integer-overflow
    
    Change-Id: Ib7df07042bd78e7f3ca81818c97396a545566e3a
    Reviewed-on: https://gerrit.libreoffice.org/49796
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index ef25e6353e46..b88e56badd9d 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -3899,7 +3899,12 @@ void WW8PLCFx_SubDoc::GetSprms(WW8PLCFxDesc* p)
         return;
     }
 
-    p->nEndPos = p->nStartPos + 1;
+    if (o3tl::checked_add<WW8_CP>(p->nStartPos, 1, p->nEndPos))
+    {
+        SAL_WARN("sw.ww8", "broken offset, ignoring");
+        p->nEndPos = p->nStartPos = WW8_CP_MAX;
+        return;
+    }
 
     if (!pText)
         return;
commit a12ad856148f2e2da55dcaa6e6c295bea6dc38c7
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Feb 15 09:09:27 2018 +0000

    ofz#6365 Integer-overflow
    
    Change-Id: I415038642ef4936d403fad8022422697a189abc8
    Reviewed-on: https://gerrit.libreoffice.org/49797
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index 59b042359b6c..4d0403a1163e 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -2822,7 +2822,7 @@ void DffPropertyReader::ImportGradientColor( SfxItemSet& aSet,MSO_FillType eMSO_
         nChgColors ^= 1;
     else if ( nFocus < 0 )//If it is a negative focus, the color will be swapped
     {
-        nFocus = -nFocus;
+        nFocus = o3tl::saturating_toggle_sign(nFocus);
         nChgColors ^= 1;
     }