summaryrefslogtreecommitdiff
path: root/libreofficekit/source
diff options
context:
space:
mode:
authorMiklos Vajna <vmiklos@collabora.co.uk>2016-09-20 17:04:50 +0200
committerMiklos Vajna <vmiklos@collabora.co.uk>2016-09-20 20:38:51 +0200
commit28447258fb6d9b8246f2a96d1a86945ef255d110 (patch)
tree781ae22aa7ab86769046ac003cfbe659f21fae92 /libreofficekit/source
parent11aa8ac4e3ae212cd06ffe9f24c5d99af5dfb9a3 (diff)
lokdocview: guard against int overflow
If a too large rectangle is parsed, the width or the height may be larger than std::numeric_limits<int>::max(), in that case just set width/height to that max value, instead of allowing an overflow. Change-Id: Ic01319b01a3f9286501c346ea765868be57466a1
Diffstat (limited to 'libreofficekit/source')
-rw-r--r--libreofficekit/source/gtk/lokdocview.cxx12
1 files changed, 10 insertions, 2 deletions
diff --git a/libreofficekit/source/gtk/lokdocview.cxx b/libreofficekit/source/gtk/lokdocview.cxx
index 195335c6a531..d8f2074511ee 100644
--- a/libreofficekit/source/gtk/lokdocview.cxx
+++ b/libreofficekit/source/gtk/lokdocview.cxx
@@ -1035,13 +1035,21 @@ payloadToRectangle (LOKDocView* pDocView, const char* pPayload)
++ppCoordinate;
if (!*ppCoordinate)
return aRet;
- aRet.width = atoi(*ppCoordinate);
+ long l = atol(*ppCoordinate);
+ if (l > std::numeric_limits<int>::max())
+ aRet.width = std::numeric_limits<int>::max();
+ else
+ aRet.width = l;
if (aRet.x + aRet.width > priv->m_nDocumentWidthTwips)
aRet.width = priv->m_nDocumentWidthTwips - aRet.x;
++ppCoordinate;
if (!*ppCoordinate)
return aRet;
- aRet.height = atoi(*ppCoordinate);
+ l = atol(*ppCoordinate);
+ if (l > std::numeric_limits<int>::max())
+ aRet.height = std::numeric_limits<int>::max();
+ else
+ aRet.height = l;
if (aRet.y + aRet.height > priv->m_nDocumentHeightTwips)
aRet.height = priv->m_nDocumentHeightTwips - aRet.y;
g_strfreev(ppCoordinates);