cid#1456609 Operands don't affect result

2.2.2.37 EmfPlusPointR Object has...

"X (variable) This value MUST be specified by either an EmfPlusInteger7 object
or an EmfPlusInteger15 object." and the same for Y. where variable is variable
length.

I think ReadInt32 isn't the right choice here and we need to read either one or
two bytes, using the highbit of the first byte to determine if we need to
read another byte.

Change-Id: I60c0687403ff58dc393bd55a22f37c89357f60c3
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/86207
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 30 insertions, 8 deletions

diff --git a/drawinglayer/source/tools/emfppath.cxx b/drawinglayer/source/tools/emfppath.cxx
index 471cc6729cf3..0c1baa3d2634 100644
--- a/drawinglayer/source/tools/emfppath.cxx
+++ b/drawinglayer/source/tools/emfppath.cxx
@@ -23,14 +23,38 @@
 #include <sal/log.hxx>
 #include "emfppath.hxx"
 
+namespace
+{
+    const unsigned char nTopBitInt7 = 0x80;
+    const unsigned char nSignBitInt7 = 0x40;
+    // include the sign bit so if its negative we get
+    // that "missing" bit pre-set to 1
+    const unsigned char nValueMaskInt7 = 0x7F;
+}
+
 namespace emfplushelper
 {
-    static sal_Int16 GetEmfPlusInteger(sal_Int32 nInt)
+    // see 2.2.2.21 EmfPlusInteger7
+    //     2.2.2.22 EmfPlusInteger15
+    // and 2.2.2.37 EmfPlusPointR Object
+    static sal_Int16 GetEmfPlusInteger(SvStream& s)
     {
-        if (nInt & 0x80000000)
-            return (nInt & 0x7FFF) >> 16;
+        unsigned char u8(0);
+        s.ReadUChar(u8);
+
+        bool bIsEmfPlusInteger15 = u8 & nTopBitInt7;
+        bool bNegative = u8 & nSignBitInt7;
+        unsigned char val1 = u8 & nValueMaskInt7;
+        if (bNegative)
+            val1 |= nTopBitInt7;
+        if (!bIsEmfPlusInteger15)
+        {
+            return static_cast<signed char>(val1);
+        }
 
-        return nInt >> 24;
+        s.ReadUChar(u8);
+        sal_uInt16 nRet = (val1 << 8) | u8;
+        return static_cast<sal_Int16>(nRet);
     }
 
     EMFPPath::EMFPPath (sal_Int32 _nPoints, bool bLines)
@@ -60,10 +84,8 @@ namespace emfplushelper
                 // EMFPlusPointR: points are stored in EMFPlusInteger7 or
                 // EMFPlusInteger15 objects, see section 2.2.2.21/22
                 // If 0x800 bit is set, the 0x4000 bit is undefined and must be ignored
-                sal_Int32 x, y;
-                s.ReadInt32(x).ReadInt32(y);
-                x = GetEmfPlusInteger(x);
-                y = GetEmfPlusInteger(y);
+                sal_Int32 x = GetEmfPlusInteger(s);
+                sal_Int32 y = GetEmfPlusInteger(s);
                 pPoints [i*2] = x;
                 pPoints [i*2 + 1] = y;
                 SAL_INFO("drawinglayer", "EMF+\t\t\tEmfPlusPointR [x,y]: " << x << ", " << y);