diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2021-06-02 09:00:05 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2021-06-02 12:08:31 +0200 |
| commit | de82849f2475b7626df19c0d29758d95388af1b2 (patch) | |
| tree | 68077f9d01ba8c82c4a96abdc8adf9bbb67e58b6 /emfio/source | |
| parent | 168c1df143ac493d554ea4c2bff5314b67581b51 (diff) | |
ofz#34847 Integer-overflow
Change-Id: I45e27efbceff76456f6c22a256a5fce1310272c5
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/116567
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'emfio/source')
| -rw-r--r-- | emfio/source/reader/emfreader.cxx | 17 |
1 files changed, 12 insertions, 5 deletions
diff --git a/emfio/source/reader/emfreader.cxx b/emfio/source/reader/emfreader.cxx index 106b9a52564f..b0fafab81604 100644 --- a/emfio/source/reader/emfreader.cxx +++ b/emfio/source/reader/emfreader.cxx @@ -1335,11 +1335,18 @@ namespace emfio { mpInputStream->ReadInt32( nX32 ).ReadInt32( nY32 ).ReadInt32( nx32 ).ReadInt32( ny32 ); SAL_INFO("emfio", "\t\t Rectangle, left: " << nX32 << ", top: " << nY32 << ", right: " << nx32 << ", bottom: " << ny32); - tools::Long dw = (nx32 - nX32) / 2; - tools::Long dh = (ny32 - nY32) / 2; - Point aCenter( nX32 + dw, nY32 + dh ); - tools::Polygon aPoly( aCenter, dw, dh ); - DrawPolygon( aPoly, mbRecordPath ); + + sal_Int32 w(0), h(0); + if (o3tl::checked_sub(nx32, nX32, w) || o3tl::checked_sub(ny32, nY32, h)) + SAL_WARN("emfio", "broken ellipse"); + else + { + tools::Long dw = w / 2; + tools::Long dh = h / 2; + Point aCenter( nX32 + dw, nY32 + dh ); + tools::Polygon aPoly( aCenter, dw, dh ); + DrawPolygon( aPoly, mbRecordPath ); + } } break; |