[Libreoffice-commits] core.git: emfio/source

[Caolán McNamara (via logerrit)]

 emfio/source/reader/emfreader.cxx |   17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

New commits:
commit de82849f2475b7626df19c0d29758d95388af1b2
Author:     Caolán McNamara <caolanm at redhat.com>
AuthorDate: Wed Jun 2 09:00:05 2021 +0100
Commit:     Caolán McNamara <caolanm at redhat.com>
CommitDate: Wed Jun 2 12:08:31 2021 +0200

    ofz#34847 Integer-overflow
    
    Change-Id: I45e27efbceff76456f6c22a256a5fce1310272c5
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/116567
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caolanm at redhat.com>

diff --git a/emfio/source/reader/emfreader.cxx b/emfio/source/reader/emfreader.cxx
index 106b9a52564f..b0fafab81604 100644
--- a/emfio/source/reader/emfreader.cxx
+++ b/emfio/source/reader/emfreader.cxx
@@ -1335,11 +1335,18 @@ namespace emfio
                     {
                         mpInputStream->ReadInt32( nX32 ).ReadInt32( nY32 ).ReadInt32( nx32 ).ReadInt32( ny32 );
                         SAL_INFO("emfio", "\t\t Rectangle, left: " << nX32 << ", top: " << nY32 << ", right: " << nx32 << ", bottom: " << ny32);
-                        tools::Long dw = (nx32 - nX32) / 2;
-                        tools::Long dh = (ny32 - nY32) / 2;
-                        Point aCenter( nX32 + dw, nY32 + dh );
-                        tools::Polygon aPoly( aCenter, dw, dh );
-                        DrawPolygon( aPoly, mbRecordPath );
+
+                        sal_Int32 w(0), h(0);
+                        if (o3tl::checked_sub(nx32, nX32, w) || o3tl::checked_sub(ny32, nY32, h))
+                            SAL_WARN("emfio", "broken ellipse");
+                        else
+                        {
+                            tools::Long dw = w / 2;
+                            tools::Long dh = h / 2;
+                            Point aCenter( nX32 + dw, nY32 + dh );
+                            tools::Polygon aPoly( aCenter, dw, dh );
+                            DrawPolygon( aPoly, mbRecordPath );
+                        }
                     }
                     break;