[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/html/svxcss1.cxx |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

New commits:
commit 10d642580d1fa2eb3450a0323c9f1338b170ccee
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Thu Jan 4 10:00:02 2018 +0000

    ofz#4947 Integer-overflow
    
    Change-Id: I7573f2d211bf9d676c436fcc2e7b312177fa377f
    Reviewed-on: https://gerrit.libreoffice.org/47375
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/html/svxcss1.cxx b/sw/source/filter/html/svxcss1.cxx
index a1d6ee966d87..392e02addbc0 100644
--- a/sw/source/filter/html/svxcss1.cxx
+++ b/sw/source/filter/html/svxcss1.cxx
@@ -1017,10 +1017,18 @@ static void ParseCSS1_font_size( const CSS1Expression *pExpr,
         break;
     case CSS1_PIXLENGTH:
         {
-            long nPWidth = 0;
-            long nPHeight = (long)pExpr->GetNumber();
-            SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight );
-            nHeight = (sal_uLong)nPHeight;
+            double fHeight = pExpr->GetNumber();
+            if (fHeight < SAL_MAX_INT32/2.0 && fHeight > SAL_MIN_INT32/2.0)
+            {
+                long nPHeight = (long)fHeight;
+                long nPWidth = 0;
+                SvxCSS1Parser::PixelToTwip(nPWidth, nPHeight);
+                nHeight = (sal_uLong)nPHeight;
+            }
+            else
+            {
+                SAL_WARN("sw.html", "out-of-size pxlength: " << fHeight);
+            }
         }
         break;
     case CSS1_PERCENTAGE: