[Libreoffice-commits] core.git: sw/qa sw/source

[Caolán McNamara]

 sw/qa/core/data/html/pass/ofz8255-1.html |    1 +
 sw/source/core/layout/atrfrm.cxx         |   16 ++++++++++++----
 2 files changed, 13 insertions(+), 4 deletions(-)

New commits:
commit 881636aed7b1b5d2e4929a31751b45a656b6fe8a
Author: Caolán McNamara <caolanm at redhat.com>
Date:   Mon May 14 14:37:03 2018 +0100

    ofz#8255 check multiply
    
    Change-Id: I3b125aba227e46c92510f7388aff4fff1478c78e
    Reviewed-on: https://gerrit.libreoffice.org/54329
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/sw/qa/core/data/html/pass/ofz8255-1.html b/sw/qa/core/data/html/pass/ofz8255-1.html
new file mode 100644
index 000000000000..7bad71504edd
--- /dev/null
+++ b/sw/qa/core/data/html/pass/ofz8255-1.html
@@ -0,0 +1 @@
+<MULTICOL GUTTER=4228 COLS=48346>
\ No newline at end of file
diff --git a/sw/source/core/layout/atrfrm.cxx b/sw/source/core/layout/atrfrm.cxx
index 7f4d27ad6e1c..57012946c9b5 100644
--- a/sw/source/core/layout/atrfrm.cxx
+++ b/sw/source/core/layout/atrfrm.cxx
@@ -22,6 +22,7 @@
 #include <com/sun/star/container/XIndexContainer.hpp>
 #include <com/sun/star/text/TextGridMode.hpp>
 #include <o3tl/any.hxx>
+#include <o3tl/safeint.hxx>
 #include <svtools/unoimap.hxx>
 #include <svtools/imap.hxx>
 #include <svtools/imapobj.hxx>
@@ -994,16 +995,23 @@ sal_uInt16 SwFormatCol::CalcPrtColWidth( sal_uInt16 nCol, sal_uInt16 nAct ) cons
 
 void SwFormatCol::Calc( sal_uInt16 nGutterWidth, sal_uInt16 nAct )
 {
-    if(!GetNumCols())
+    if (!GetNumCols())
         return;
+
     //First set the column widths with the current width, then calculate the
     //column's requested width using the requested total width.
-
     const sal_uInt16 nGutterHalf = nGutterWidth ? nGutterWidth / 2 : 0;
 
     //Width of PrtAreas is totalwidth - spacings / count
-    const sal_uInt16 nPrtWidth =
-                (nAct - ((GetNumCols()-1) * nGutterWidth)) / GetNumCols();
+    sal_uInt16 nSpacings;
+    bool bFail = o3tl::checked_multiply<sal_uInt16>(GetNumCols() - 1, nGutterWidth, nSpacings);
+    if (bFail)
+    {
+        SAL_WARN("sw.core", "SwFormatVertOrient::Calc: overflow");
+        return;
+    }
+
+    const sal_uInt16 nPrtWidth = (nAct - nSpacings) / GetNumCols();
     sal_uInt16 nAvail = nAct;
 
     //The first column is PrtWidth + (gap width / 2)