[Libreoffice-commits] core.git: emfio/source

[Caolán McNamara (via logerrit)]

 emfio/source/reader/emfreader.cxx |   16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

New commits:
commit 33150fd592162f8f3de835b42176ad87d6ad58fe
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Sat Jun 22 18:39:16 2019 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Sat Jun 22 21:38:18 2019 +0200

    Resolves; ofz#15426 Integer-overflow
    
    Change-Id: I43ac26058a98a85fc09321a93e29dbeb151f5069
    Reviewed-on: https://gerrit.libreoffice.org/74572
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>
    Tested-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/emfio/source/reader/emfreader.cxx b/emfio/source/reader/emfreader.cxx
index 51a8a6fb029b..6a974085d887 100644
--- a/emfio/source/reader/emfreader.cxx
+++ b/emfio/source/reader/emfreader.cxx
@@ -1360,14 +1360,16 @@ namespace emfio
                                 if(!aBitmapEx.IsEmpty())
                                 {
                                     // test if it is sensible to crop
-                                    if ( ( cxSrc > 0 ) && ( cySrc > 0 ) &&
-                                        ( xSrc >= 0 ) && ( ySrc >= 0 ) &&
-                                            ( xSrc + cxSrc < aBitmapEx.GetSizePixel().Width() ) &&
-                                                ( ySrc + cySrc < aBitmapEx.GetSizePixel().Height() ) )
+                                    if (cxSrc > 0 && cySrc > 0 && xSrc >= 0 && ySrc >= 0)
                                     {
-                                        const tools::Rectangle aCropRect( Point( xSrc, ySrc ), Size( cxSrc, cySrc ) );
-
-                                        aBitmapEx.Crop( aCropRect );
+                                        sal_Int32 xEndSrc;
+                                        sal_Int32 yEndSrc;
+                                        if (!o3tl::checked_add(xSrc, cxSrc, xEndSrc) && xEndSrc < aBitmapEx.GetSizePixel().Width() &&
+                                            !o3tl::checked_add(ySrc, cySrc, yEndSrc) && yEndSrc < aBitmapEx.GetSizePixel().Height())
+                                        {
+                                            const tools::Rectangle aCropRect( Point( xSrc, ySrc ), Size( cxSrc, cySrc ) );
+                                            aBitmapEx.Crop( aCropRect );
+                                        }
                                     }
 
     #ifdef DBG_UTIL