[Libreoffice-commits] core.git: filter/source

[Libreoffice Gerrit user]

 filter/source/msfilter/msdffimp.cxx |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

New commits:
commit a8f0068fccfa3495ea8c7f1548a3cd4662bf391c
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Oct 24 14:06:03 2018 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Wed Oct 24 22:12:38 2018 +0200

    ofz#11103 Integer-overflow
    
    Change-Id: I4ca56e675056b8bd40c6e9b43516815511b33f20
    Reviewed-on: https://gerrit.libreoffice.org/62302
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index 59a60d772fbd..7b6d979d445a 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -4566,7 +4566,12 @@ SdrObject* SvxMSDffManager::ImportShape( const DffRecordHeader& rHd, SvStream& r
                             {
                                 double fNumber;
                                 seqAdjustmentValues[ 0 ].Value >>= fNumber;
-                                nEndAngle = NormAngle36000( - static_cast<sal_Int32>(fNumber) * 100 );
+                                sal_Int32 nValue;
+                                bool bFail = o3tl::checked_multiply<sal_Int32>(fNumber, 100, nValue);
+                                if (!bFail)
+                                    SAL_WARN("filter.ms", "nEndAngle too large: " << fNumber);
+                                else
+                                    nEndAngle = NormAngle36000(-nValue);
                             }
                             else
                             {