diff options
| author | Stephan Bergmann <sbergman@redhat.com> | 2019-06-24 16:00:08 +0200 |
|---|---|---|
| committer | Stephan Bergmann <sbergman@redhat.com> | 2019-06-24 21:20:11 +0200 |
| commit | a329b2111c12b9a5a3bc0de53065044155f54474 (patch) | |
| tree | 3b1a02aaf7db565f2349100c16c59ffad1cbfb20 /writerfilter | |
| parent | ab7652aabf9c1c91980d47c9d1be30b24313f142 (diff) | |
Don't prematurely convert nEscapement from double to sal_Int16
...before it is clamped to -MAX_ESC_POS..MAX_ESC_POS, anyway. That avoids some
-fsanitize=float-cast-overflow
> writerfilter/source/dmapper/DomainMapper.cxx:2833:39: runtime error: -327680 is outside the range of representable values of type 'short'
when loading caolan/swfntobj_drawtext_heap_buffer_overflow.sample (from the
crashtestdata files).
Change-Id: I42c23fe30723280410f3afc0ecbe40f1f31b7f96
Reviewed-on: https://gerrit.libreoffice.org/74645
Tested-by: Jenkins
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
Diffstat (limited to 'writerfilter')
| -rw-r--r-- | writerfilter/source/dmapper/DomainMapper.cxx | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/writerfilter/source/dmapper/DomainMapper.cxx b/writerfilter/source/dmapper/DomainMapper.cxx index 0eef649f96d3..54e4a7bdd7a1 100644 --- a/writerfilter/source/dmapper/DomainMapper.cxx +++ b/writerfilter/source/dmapper/DomainMapper.cxx @@ -2806,7 +2806,7 @@ void DomainMapper::processDeferredCharacterProperties( const std::map< sal_Int32 break; // only for use by other properties, ignore here case NS_ooxml::LN_EG_RPrBase_position: { - sal_Int16 nEscapement = 0; + double nEscapement = 0; sal_Int8 nProp = 100; if(nIntValue == 0) nProp = 0; @@ -2851,7 +2851,7 @@ void DomainMapper::processDeferredCharacterProperties( const std::map< sal_Int32 nEscapement = -MAX_ESC_POS; } - rContext->Insert(PROP_CHAR_ESCAPEMENT, uno::makeAny( nEscapement ) ); + rContext->Insert(PROP_CHAR_ESCAPEMENT, uno::makeAny( sal_Int16(nEscapement) ) ); rContext->Insert(PROP_CHAR_ESCAPEMENT_HEIGHT, uno::makeAny( nProp ) ); } break; |