[Libreoffice-commits] core.git: sw/source

[Caolán McNamara]

 sw/source/filter/html/svxcss1.cxx |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

New commits:
commit 8da8e5bf24bbcaa35d5d58d32ca3c173bda62a65
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Fri Jan 19 09:06:48 2018 +0000

    ofz#5483 Integer-overflow
    
    Change-Id: If364a961f5e144cc0f3572108020c99db6febfb8
    Reviewed-on: https://gerrit.libreoffice.org/48177
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/source/filter/html/svxcss1.cxx b/sw/source/filter/html/svxcss1.cxx
index 79151c635062..773bfc3607d5 100644
--- a/sw/source/filter/html/svxcss1.cxx
+++ b/sw/source/filter/html/svxcss1.cxx
@@ -2979,8 +2979,11 @@ static void ParseCSS1_size( const CSS1Expression *pExpr,
             break;
 
         case CSS1_PIXLENGTH:
+        {
+            double fHeight = pExpr->GetNumber();
+            if (fHeight < SAL_MAX_INT32/2.0 && fHeight > SAL_MIN_INT32/2.0)
             {
-                long nPHeight = static_cast<long>(pExpr->GetNumber());
+                long nPHeight = static_cast<long>(fHeight);
                 long nPWidth = n==0 ? nPHeight : 0;
                 SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight );
                 rPropInfo.m_nHeight = nPHeight;
@@ -2989,7 +2992,7 @@ static void ParseCSS1_size( const CSS1Expression *pExpr,
                 rPropInfo.m_eSizeType = SVX_CSS1_STYPE_TWIP;
             }
             break;
-
+        }
         default:
             ;
         }