[Libreoffice-commits] core.git: writerfilter/source

[Libreoffice Gerrit user]

 writerfilter/source/dmapper/DomainMapperTableManager.cxx |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

New commits:
commit 83f12a2d4e410014c70844085f19190a50e83429
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Thu Sep 6 09:00:51 2018 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Thu Sep 6 12:44:46 2018 +0200

    ofz#10228 Integer-overflow
    
    Change-Id: I09cb2e8f4af7d34c32accf2590695799d0613d62
    Reviewed-on: https://gerrit.libreoffice.org/60070
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/writerfilter/source/dmapper/DomainMapperTableManager.cxx b/writerfilter/source/dmapper/DomainMapperTableManager.cxx
index 10c252c764b8..c473eccaf198 100644
--- a/writerfilter/source/dmapper/DomainMapperTableManager.cxx
+++ b/writerfilter/source/dmapper/DomainMapperTableManager.cxx
@@ -30,6 +30,7 @@
 #include <com/sun/star/text/VertOrientation.hpp>
 #include <com/sun/star/text/WritingMode2.hpp>
 #include <o3tl/numeric.hxx>
+#include <o3tl/safeint.hxx>
 #include <ooxml/resourceids.hxx>
 #include "DomainMapper.hxx"
 #include <rtl/math.hxx>
@@ -575,7 +576,7 @@ void DomainMapperTableManager::endOfRowAction()
             TagLogger::getInstance().endElement();
 #endif
 
-             m_nTableWidth += *aCellIter++;
+             m_nTableWidth = o3tl::saturating_add(m_nTableWidth, *aCellIter++);
         }
 
         if (m_nTableWidth > 0 && !m_bTableSizeTypeInserted)