[Libreoffice-commits] core.git: writerfilter/source

[Stephan Bergmann (via logerrit)]

 writerfilter/source/dmapper/DomainMapper.cxx |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

New commits:
commit a329b2111c12b9a5a3bc0de53065044155f54474
Author:     Stephan Bergmann <sbergman at redhat.com>
AuthorDate: Mon Jun 24 16:00:08 2019 +0200
Commit:     Stephan Bergmann <sbergman at redhat.com>
CommitDate: Mon Jun 24 21:20:11 2019 +0200

    Don't prematurely convert nEscapement from double to sal_Int16
    
    ...before it is clamped to -MAX_ESC_POS..MAX_ESC_POS, anyway.  That avoids some
    -fsanitize=float-cast-overflow
    
    > writerfilter/source/dmapper/DomainMapper.cxx:2833:39: runtime error: -327680 is outside the range of representable values of type 'short'
    
    when loading caolan/swfntobj_drawtext_heap_buffer_overflow.sample (from the
    crashtestdata files).
    
    Change-Id: I42c23fe30723280410f3afc0ecbe40f1f31b7f96
    Reviewed-on: https://gerrit.libreoffice.org/74645
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sbergman at redhat.com>

diff --git a/writerfilter/source/dmapper/DomainMapper.cxx b/writerfilter/source/dmapper/DomainMapper.cxx
index 0eef649f96d3..54e4a7bdd7a1 100644
--- a/writerfilter/source/dmapper/DomainMapper.cxx
+++ b/writerfilter/source/dmapper/DomainMapper.cxx
@@ -2806,7 +2806,7 @@ void DomainMapper::processDeferredCharacterProperties( const std::map< sal_Int32
         break; // only for use by other properties, ignore here
         case NS_ooxml::LN_EG_RPrBase_position:
         {
-            sal_Int16 nEscapement = 0;
+            double nEscapement = 0;
             sal_Int8 nProp  = 100;
             if(nIntValue == 0)
                 nProp = 0;
@@ -2851,7 +2851,7 @@ void DomainMapper::processDeferredCharacterProperties( const std::map< sal_Int32
                 nEscapement = -MAX_ESC_POS;
             }
 
-            rContext->Insert(PROP_CHAR_ESCAPEMENT,         uno::makeAny( nEscapement ) );
+            rContext->Insert(PROP_CHAR_ESCAPEMENT,         uno::makeAny( sal_Int16(nEscapement) ) );
             rContext->Insert(PROP_CHAR_ESCAPEMENT_HEIGHT,  uno::makeAny( nProp ) );
         }
         break;