ofz#5621 Integer-overflow

Change-Id: Ie0a7c29428e686e5c480997b84b8d12e5be4539f
Reviewed-on: https://gerrit.libreoffice.org/48790
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

2 files changed, 34 insertions, 4 deletions

diff --git a/include/o3tl/safeint.hxx b/include/o3tl/safeint.hxx
index 67af99cf810c..fa08b6dfc899 100644
--- a/include/o3tl/safeint.hxx
+++ b/include/o3tl/safeint.hxx
@@ -57,6 +57,36 @@ typename std::enable_if<std::is_unsigned<T>::value, T>::type saturating_add(
 }
 
 template<typename T> inline
+typename std::enable_if<std::is_signed<T>::value, T>::type saturating_sub(
+    T a, T b)
+{
+    if (b >= 0) {
+        if (a >= std::numeric_limits<T>::min() + b) {
+            return a - b;
+        } else {
+            return std::numeric_limits<T>::min();
+        }
+    } else {
+        if (a <= std::numeric_limits<T>::max() + b) {
+            return a - b;
+        } else {
+            return std::numeric_limits<T>::max();
+        }
+    }
+}
+
+template<typename T> inline
+typename std::enable_if<std::is_unsigned<T>::value, T>::type saturating_sub(
+    T a, T b)
+{
+    if (a >= std::numeric_limits<T>::min() + b) {
+        return a - b;
+    } else {
+        return std::numeric_limits<T>::min();
+    }
+}
+
+template<typename T> inline
 typename std::enable_if<std::is_signed<T>::value, T>::type saturating_toggle_sign(
     T a)
 {
diff --git a/xmloff/source/draw/ximpshap.cxx b/xmloff/source/draw/ximpshap.cxx
index 616dec4d1ba2..4ccdb68d5ff1 100644
--- a/xmloff/source/draw/ximpshap.cxx
+++ b/xmloff/source/draw/ximpshap.cxx
@@ -1083,16 +1083,16 @@ void SdXMLLineShapeContext::StartElement(const uno::Reference< xml::sax::XAttrib
         pOuterSequence->realloc(2);
         awt::Point* pInnerSequence = pOuterSequence->getArray();
 
-        *pInnerSequence = awt::Point(o3tl::saturating_add(mnX1, -aTopLeft.X), o3tl::saturating_add(mnY1, -aTopLeft.Y));
+        *pInnerSequence = awt::Point(o3tl::saturating_sub(mnX1, aTopLeft.X), o3tl::saturating_sub(mnY1, aTopLeft.Y));
         pInnerSequence++;
-        *pInnerSequence = awt::Point(o3tl::saturating_add(mnX2, -aTopLeft.X), o3tl::saturating_add(mnY2, -aTopLeft.Y));
+        *pInnerSequence = awt::Point(o3tl::saturating_sub(mnX2, aTopLeft.X), o3tl::saturating_sub(mnY2, aTopLeft.Y));
 
         xPropSet->setPropertyValue("Geometry", Any(aPolyPoly));
     }
 
     // set sizes for transformation
-    maSize.Width = o3tl::saturating_add(aBottomRight.X, -aTopLeft.X);
-    maSize.Height = o3tl::saturating_add(aBottomRight.Y, -aTopLeft.Y);
+    maSize.Width = o3tl::saturating_sub(aBottomRight.X, aTopLeft.X);
+    maSize.Height = o3tl::saturating_sub(aBottomRight.Y, aTopLeft.Y);
     maPosition.X = aTopLeft.X;
     maPosition.Y = aTopLeft.Y;