[Libreoffice-commits] core.git: sax/qa sax/source

[Michael Stahl]

 sax/qa/cppunit/test_converter.cxx |    1 +
 sax/source/tools/converter.cxx    |    6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)

New commits:
commit b2aafa91233189a623032894e9259b0f850efe2a
Author: Michael Stahl <Michael.Stahl at cib.de>
Date:   Fri Jun 29 17:14:58 2018 +0200

    sax: fix overflow in sax::Converter::convertMeasure()
    
    The problem is that -2^31 is negative after negation in 2's
    complement.
    
    This causes ODF validation error now in CppunitTest_sd_export_tests
    testFdo84043:
    
    Error: attribute "svg:x" has a bad value: ...
    svg:x="--2147483.-6-4-7cm"
    
    The validation error only happens in 32-bit builds; 64-bit builds
    show a different value svg:x="2139324.72cm", so there must be another
    problem somewhere else that isn't fixed here.
    
    Change-Id: If2040cb6ae914c69b7cc651d3ab2d5d232fc71fb
    Reviewed-on: https://gerrit.libreoffice.org/56718
    Tested-by: Jenkins
    Reviewed-by: Thorsten Behrens <Thorsten.Behrens at CIB.de>

diff --git a/sax/qa/cppunit/test_converter.cxx b/sax/qa/cppunit/test_converter.cxx
index d58dd0bfb020..4cf2142c9a60 100644
--- a/sax/qa/cppunit/test_converter.cxx
+++ b/sax/qa/cppunit/test_converter.cxx
@@ -502,6 +502,7 @@ void ConverterTest::testMeasure()
     doTestMeasureToString("979.928cm", 555550, MeasureUnit::TWIP, MeasureUnit::CM);
     doTestMeasureToString("111.1pt", 2222, MeasureUnit::TWIP, MeasureUnit::POINT);
     doTestMeasureToString("385.7986in", 555550, MeasureUnit::TWIP, MeasureUnit::INCH);
+    doTestMeasureToString("-2147483.648cm", std::numeric_limits<sal_Int32>::min(), MeasureUnit::MM_100TH, MeasureUnit::CM);
 }
 
 void doTestStringToBool(bool bBool, char const*const pis)
diff --git a/sax/source/tools/converter.cxx b/sax/source/tools/converter.cxx
index 250c756e64e6..fd450affb5f4 100644
--- a/sax/source/tools/converter.cxx
+++ b/sax/source/tools/converter.cxx
@@ -280,10 +280,11 @@ void Converter::convertMeasure( OUStringBuffer& rBuffer,
 
         return;
     }
+    sal_Int64 nValue(nMeasure); // extend to 64-bit first to avoid overflow
     // the sign is processed separately
-    if( nMeasure < 0 )
+    if (nValue < 0)
     {
-        nMeasure = -nMeasure;
+        nValue = -nValue;
         rBuffer.append( '-' );
     }
 
@@ -401,7 +402,6 @@ void Converter::convertMeasure( OUStringBuffer& rBuffer,
         break;
     }
 
-    sal_Int64 nValue = nMeasure;
     OSL_ENSURE(nValue <= SAL_MAX_INT64 / nMul, "convertMeasure: overflow");
     nValue *= nMul;
     nValue /= nDiv;