ofz#5248 Integer-overflow

Change-Id: I7cefb6cb37370ed41c42dfc4fafa81b64e0709d6
Reviewed-on: https://gerrit.libreoffice.org/47771
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 10 insertions, 3 deletions

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index ac7de6b6034f..a54ee36f8c0f 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -3862,9 +3862,16 @@ SdrObject* SvxMSDffManager::ImportGraphic( SvStream& rSt, SfxItemSet& rSet, cons
                 nContrast = 0;
             else
             {
-                nContrast *= 101;   //100 + 1 to round
-                nContrast /= 0x10000;
-                nContrast -= 100;
+                if (o3tl::checked_multiply(nContrast, 101, nContrast))  //100 + 1 to round
+                {
+                    SAL_WARN("filter.ms", "bad Contrast value:" << nContrast);
+                    nContrast = 0;
+                }
+                else
+                {
+                    nContrast /= 0x10000;
+                    nContrast -= 100;
+                }
             }
             sal_Int16   nBrightness     = (sal_Int16)( (sal_Int32)GetPropertyValue( DFF_Prop_pictureBrightness, 0 ) / 327 );
             sal_Int32   nGamma          = GetPropertyValue( DFF_Prop_pictureGamma, 0x10000 );