[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/xml/xmltbli.cxx |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

New commits:
commit 3c0189c7f04b9b457ed5621fef68fcb1843df891
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon Feb 26 14:45:45 2018 +0000

    ofz#6571 Integer-overflow
    
    Change-Id: If4a0b9532c69a1b3746fab8c727f245cd2e8a131
    Reviewed-on: https://gerrit.libreoffice.org/50375
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/xml/xmltbli.cxx b/sw/source/filter/xml/xmltbli.cxx
index 27ef0cb043e7..c82d15e75919 100644
--- a/sw/source/filter/xml/xmltbli.cxx
+++ b/sw/source/filter/xml/xmltbli.cxx
@@ -24,6 +24,7 @@
 #include <com/sun/star/table/XCellRange.hpp>
 #include <o3tl/numeric.hxx>
 #include <o3tl/make_unique.hxx>
+#include <o3tl/safeint.hxx>
 #include <svl/itemset.hxx>
 #include <svl/zformat.hxx>
 #include <sax/tools/converter.hxx>
@@ -2415,7 +2416,10 @@ void SwXMLTableContext::MakeTable_( SwTableBox *pBox )
                 {
                     if (nMinAbsColWidth == 0)
                         throw o3tl::divide_by_zero();
-                    sal_Int32 nRelCol = ( colIter->width * nMinRelColWidth) / nMinAbsColWidth;
+                    sal_Int32 nVal;
+                    if (o3tl::checked_multiply<sal_Int32>(colIter->width, nMinRelColWidth, nVal))
+                        throw std::overflow_error("overflow in multiply");
+                    sal_Int32 nRelCol = nVal / nMinAbsColWidth;
                     colIter->width = nRelCol;
                     colIter->isRelative = true;
                     nRelWidth += nRelCol;