ofz#4738 Integer-overflow

Change-Id: Id15409ecde9e001d3be7ee60b34d43cbcc654a2e
Reviewed-on: https://gerrit.libreoffice.org/47045
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 12 insertions, 4 deletions

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index cf0527555ea8..da92297ebd5b 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -7328,11 +7328,15 @@ void CreateTableRows( const Reference< XTableRows >& xTableRows, const std::set<
         sal_Int32 nHeight;
         if ( ++aIter != rRows.end() )
         {
-            nHeight = *aIter - nLastPosition;
+            if (o3tl::checked_sub<sal_Int32>(*aIter, nLastPosition, nHeight))
+                throw lang::IllegalArgumentException();
             nLastPosition = *aIter;
         }
         else
-            nHeight = nTableBottom - nLastPosition;
+        {
+            if (o3tl::checked_sub<sal_Int32>(nTableBottom, nLastPosition, nHeight))
+                throw lang::IllegalArgumentException();
+        }
 
         Reference< XPropertySet > xPropSet( xTableRows->getByIndex( n ), UNO_QUERY_THROW );
         xPropSet->setPropertyValue( "Height", Any( nHeight ) );
@@ -7351,11 +7355,15 @@ void CreateTableColumns( const Reference< XTableColumns >& xTableColumns, const
         sal_Int32 nWidth;
         if ( ++aIter != rColumns.end() )
         {
-            nWidth = *aIter - nLastPosition;
+            if (o3tl::checked_sub<sal_Int32>(*aIter, nLastPosition, nWidth))
+                throw lang::IllegalArgumentException();
             nLastPosition = *aIter;
         }
         else
-            nWidth = nTableRight - nLastPosition;
+        {
+            if (o3tl::checked_sub<sal_Int32>(nTableRight, nLastPosition, nWidth))
+                throw lang::IllegalArgumentException();
+        }
 
         Reference< XPropertySet > xPropSet( xTableColumns->getByIndex( n ), UNO_QUERY_THROW );
         xPropSet->setPropertyValue( "Width", Any( nWidth ) );