[Libreoffice-commits] core.git: editeng/source

[Libreoffice Gerrit user]

 editeng/source/items/frmitems.cxx |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

New commits:
commit c97df0d704bfa5eebe573386445abfa4dcfd95b8
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Jul 28 16:06:14 2018 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Sat Jul 28 20:36:59 2018 +0200

    ofz#9613 Integer-overflow in shadow multiplication
    
    Change-Id: I1c7dda7391987ea7bf5aa841aab576af0fc3759e
    Reviewed-on: https://gerrit.libreoffice.org/58219
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/editeng/source/items/frmitems.cxx b/editeng/source/items/frmitems.cxx
index 951a19fc77b3..f66dfff63a63 100644
--- a/editeng/source/items/frmitems.cxx
+++ b/editeng/source/items/frmitems.cxx
@@ -84,6 +84,7 @@
 #include <editeng/editerr.hxx>
 #include <libxml/xmlwriter.h>
 #include <o3tl/enumrange.hxx>
+#include <o3tl/safeint.hxx>
 #include <vcl/GraphicLoader.hxx>
 
 using namespace ::editeng;
@@ -1127,10 +1128,10 @@ bool SvxShadowItem::PutValue( const uno::Any& rVal, sal_uInt8 nMemberId )
         case MID_SHADOW_TRANSPARENCE:
         {
             sal_Int32 nTransparence = 0;
-            if (rVal >>= nTransparence)
+            if ((rVal >>= nTransparence) && !o3tl::checked_multiply<sal_Int32>(nTransparence, 255, nTransparence))
             {
                 Color aColor(aShadow.Color);
-                aColor.SetTransparency(rtl::math::round(float(nTransparence * 255) / 100));
+                aColor.SetTransparency(rtl::math::round(float(nTransparence) / 100));
                 aShadow.Color = sal_Int32(aColor);
             }
             break;