ofz#4115 Integer-overflow

Change-Id: Ibeb62c6df8fe1e200b97ea179d747e735a4ebf3a
Reviewed-on: https://gerrit.libreoffice.org/44451
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 3 insertions, 3 deletions

diff --git a/svtools/source/svrtf/parrtf.cxx b/svtools/source/svrtf/parrtf.cxx
index a29e571383b9..52e350f52442 100644
--- a/svtools/source/svrtf/parrtf.cxx
+++ b/svtools/source/svrtf/parrtf.cxx
@@ -128,12 +128,12 @@ int SvRTFParser::GetNextToken_()
                         // possible numeric parameter
                         if( RTF_ISDIGIT( nNextCh ) )
                         {
-                            nTokenValue = 0;
+                            OUStringBuffer aNumber;
                             do {
-                                nTokenValue *= 10;
-                                nTokenValue += nNextCh - '0';
+                                aNumber.append(static_cast<sal_Unicode>(nNextCh));
                                 nNextCh = GetNextChar();
                             } while( RTF_ISDIGIT( nNextCh ) );
+                            nTokenValue = aNumber.toString().toInt32();
                             if( bNegValue )
                                 nTokenValue = -nTokenValue;
                             bTokenHasValue=true;