diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-10-24 11:47:27 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-10-25 09:54:35 +0200 |
| commit | 08deeace490acc5b84b97b92e5960f6b6a920e53 (patch) | |
| tree | 666675179794c54599970f915eb6335766f6fde4 | |
| parent | 9cfb27ae6cb94f0a853ff70e9ad9f3109d305a94 (diff) | |
ofz#3755 Integer-overflow
Change-Id: If21e45ce711d483cdd27e96877ee7f3ca35c2f14
Reviewed-on: https://gerrit.libreoffice.org/43753
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | filter/source/graphicfilter/ios2met/ios2met.cxx | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx index 369de5eca38a..ee0d2d7a885f 100644 --- a/filter/source/graphicfilter/ios2met/ios2met.cxx +++ b/filter/source/graphicfilter/ios2met/ios2met.cxx @@ -2048,8 +2048,12 @@ void OS2METReader::ReadOrder(sal_uInt16 nOrderID, sal_uInt16 nOrderLen) case GOrdSChCel: { sal_uInt8 nbyte; sal_uInt16 nLen=nOrderLen; - aAttr.aChrCellSize.Width()=ReadCoord(bCoord32); - aAttr.aChrCellSize.Height()=ReadCoord(bCoord32); + auto nWidth = ReadCoord(bCoord32); + auto nHeight = ReadCoord(bCoord32); + if (nWidth < 0 || nHeight < 0) + aAttr.aChrCellSize = aDefAttr.aChrCellSize; + else + aAttr.aChrCellSize = Size(nWidth, nHeight); if (bCoord32) nLen-=8; else nLen-=4; if (nLen>=4) { pOS2MET->SeekRel(4); nLen-=4; @@ -2057,7 +2061,7 @@ void OS2METReader::ReadOrder(sal_uInt16 nOrderID, sal_uInt16 nOrderLen) if (nLen>=2) { pOS2MET->ReadUChar( nbyte ); if ((nbyte&0x80)==0 && aAttr.aChrCellSize==Size(0,0)) - aAttr.aChrCellSize=aDefAttr.aChrCellSize; + aAttr.aChrCellSize = aDefAttr.aChrCellSize; } break; } |