crashtesting+ubsan: rhbz1003919-1.svg left shift of negative number

Change-Id: I6175b4b28af3257f5734685b8fa323f0b9078512

1 files changed, 4 insertions, 2 deletions

diff --git a/vcl/source/fontsubset/sft.cxx b/vcl/source/fontsubset/sft.cxx
index ac999a62f0d9..51f3f957ddea 100644
--- a/vcl/source/fontsubset/sft.cxx
+++ b/vcl/source/fontsubset/sft.cxx
@@ -643,9 +643,11 @@ static int GetCompoundTTOutline(TrueTypeFont *ttf, sal_uInt32 glyphID, ControlPo
             F16Dot16 t;
             ControlPoint cp;
             cp.flags = nextComponent[i].flags;
-            t = fixedMulDiv(a, nextComponent[i].x << 16, m) + fixedMulDiv(c, nextComponent[i].y << 16, m) + (e << 16);
+            const sal_uInt16 x = nextComponent[i].x;
+            const sal_uInt16 y = nextComponent[i].y;
+            t = fixedMulDiv(a, x << 16, m) + fixedMulDiv(c, y << 16, m) + (e << 16);
             cp.x = (sal_Int16)(fixedMul(t, m) >> 16);
-            t = fixedMulDiv(b, nextComponent[i].x << 16, n) + fixedMulDiv(d, nextComponent[i].y << 16, n) + (f << 16);
+            t = fixedMulDiv(b, x << 16, n) + fixedMulDiv(d, y << 16, n) + (f << 16);
             cp.y = (sal_Int16)(fixedMul(t, n) >> 16);
 
             myPoints.push_back( cp );