Make sure that the big value doesn't readily overflow

As shown in https://gerrit.libreoffice.org/c/core/+/168235/6#message-5e7ed6fecf7fd36dc167193e25c3ec94daa11cb3

> looks like this started to break e.g. CppunitTest_sw_mailmerge2 with
>
> /sw/inc/swrect.hxx:251:48: runtime error: signed integer overflow: 13569 + 9223372036854775807 cannot be represented in type 'long'
>     #0 0x7f30b337cb90 in SwRect::Bottom() const /sw/inc/swrect.hxx:251:48
>     #1 0x7f30b337234f in SwRect::Overlaps(SwRect const&) const /sw/inc/swrect.hxx:376:30
>     #2 0x7f30b699354b in lcl_CheckFlowBack(SwFrame*, SwRect const&) /sw/source/core/layout/frmtool.cxx:3316:23
>     #3 0x7f30b699376f in lcl_CheckFlowBack(SwFrame*, SwRect const&) /sw/source/core/layout/frmtool.cxx:3317:17
>     #4 0x7f30b699376f in lcl_CheckFlowBack(SwFrame*, SwRect const&) /sw/source/core/layout/frmtool.cxx:3317:17
>     #5 0x7f30b698d21e in Notify_Background(SdrObject const*, SwPageFrame*, SwRect const&, PrepareHint, bool) /sw/source/core/layout/frmtool.cxx:3415:13
>     #6 0x7f30b5b941b4 in lcl_NotifyBackgroundOfObj(SwDrawContact const&, SdrObject const&, tools::Rectangle const*) /sw/source/core/draw/dcontact.cxx:955:13
>     #7 0x7f30b5b7c9b9 in SwDrawContact::DisconnectFromLayout(bool) /sw/source/core/draw/dcontact.cxx:1689:9
>     #8 0x7f30b5ba0cae in SwDrawContact::SwClientNotify(SwModify const&, SfxHint const&) /sw/source/core/draw/dcontact.cxx:1544:17
>     #9 0x7f30b399e3c2 in SwModify::CallSwClientNotify(SfxHint const&) const /sw/source/core/attr/calbck.cxx:311:18
>     #10 0x7f30b399e6c5 in sw::BroadcastingModify::CallSwClientNotify(SfxHint const&) const /sw/source/core/attr/calbck.cxx:316:15
>     #11 0x7f30b6656d23 in SwDrawFrameFormat::DelFrames() /sw/source/core/layout/atrfrm.cxx:3525:5
>     #12 0x7f30b51785f8 in sw::DocumentLayoutManager::DelLayoutFormat(SwFrameFormat*) /sw/source/core/doc/DocumentLayoutManager.cxx:235:14
>     #13 0x7f30b4df70ac in sw::DocumentContentOperationsManager::DelFullPara(SwPaM&) /sw/source/core/doc/DocumentContentOperationsManager.cxx:2343:55
>     #14 0x7f30b42b5701 in SwDoc::RemoveInvisibleContent() /sw/source/core/doc/doc.cxx:1576:57
>     #15 0x7f30ba70c920 in SwDBManager::MergeMailFiles(SwWrtShell*, SwMergeDescriptor const&) /sw/source/uibase/dbui/dbmgr.cxx:1468:35
>     #16 0x7f30ba6f7eff in SwDBManager::Merge(SwMergeDescriptor const&) /sw/source/uibase/dbui/dbmgr.cxx:556:20
>     #17 0x7f30bbe0d561 in SwXMailMerge::execute(com::sun::star::uno::Sequence<com::sun::star::beans::NamedValue> const&) /sw/source/uibase/uno/unomailmerge.cxx:786:24
>     #18 0x7f30bbe103ce in non-virtual thunk to SwXMailMerge::execute(com::sun::star::uno::Sequence<com::sun::star::beans::NamedValue> const&) /sw/source/uibase/uno/unomailmerge.cxx
>     #19 0x7f30d009b8ed in (anonymous namespace)::MMTest2::executeMailMerge(bool) /sw/qa/extras/mailmerge/mailmerge2.cxx:195:31
>     #20 0x7f30d00eb3e5 in (anonymous namespace)::testTdf123057_file::verify() /sw/qa/extras/mailmerge/mailmerge2.cxx:597:5
>     #21 0x7f30d00a11eb in (anonymous namespace)::MMTest2::executeMailMergeTest(char const*, char const*, char const*, char const*, int, char const*) /sw/qa/extras/mailmerge/mailmerge2.cxx:99:9
>     #22 0x7f30d00efc32 in (anonymous namespace)::testTdf123057_file::MailMerge() /sw/qa/extras/mailmerge/mailmerge2.cxx:594:1
> (<https://ci.libreoffice.org/job/lo_ubsan/3194/>;)

Change-Id: Ic34ad5c39d3b89c84f124e145a30714ba3752103
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168364
Reviewed-by: Mike Kaganski <mike.kaganski@collabora.com>
Tested-by: Jenkins
(cherry picked from commit ecd42fe1885e8fca0ec302a6d0a666f925fa62d9)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168322
Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoffice@gmail.com>
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>

2 files changed, 3 insertions, 2 deletions

diff --git a/sw/source/core/layout/flowfrm.cxx b/sw/source/core/layout/flowfrm.cxx
index 66ec8ea9e7c2..b45c8d100fcb 100644
--- a/sw/source/core/layout/flowfrm.cxx
+++ b/sw/source/core/layout/flowfrm.cxx
@@ -609,7 +609,7 @@ bool SwFlowFrame::PasteTree( SwFrame *pStart, SwLayoutFrame *pParent, SwFrame *p
         else
             bRet = true;
 
-        nGrowVal += aRectFnSet.GetHeight(pFloat->getFrameArea());
+        nGrowVal = o3tl::saturating_add(nGrowVal, aRectFnSet.GetHeight(pFloat->getFrameArea()));
         if ( pFloat->GetNext() )
             pFloat = pFloat->GetNext();
         else
diff --git a/sw/source/core/layout/sectfrm.cxx b/sw/source/core/layout/sectfrm.cxx
index c92af1303fae..4dc31c4256fd 100644
--- a/sw/source/core/layout/sectfrm.cxx
+++ b/sw/source/core/layout/sectfrm.cxx
@@ -2726,8 +2726,9 @@ void SwSectionFrame::SwClientNotify(const SwModify& rMod, const SfxHint& rHint)
         InvalidateObjs(false);
         {
             // Set it to a huge positive value, to make sure a recalculation fires
+            constexpr SwTwips HUGE_POSITIVE = o3tl::toTwips(100, o3tl::Length::m);
             SwFrameAreaDefinition::FrameAreaWriteAccess area(*this);
-            SwRectFnSet(this).SetHeight(area, std::numeric_limits<tools::Long>::max());
+            SwRectFnSet(this).SetHeight(area, HUGE_POSITIVE);
         }
 
         for (SwFrame* pLowerFrame = Lower(); pLowerFrame; pLowerFrame = pLowerFrame->GetNext())