From 10d642580d1fa2eb3450a0323c9f1338b170ccee Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Thu, 4 Jan 2018 10:00:02 +0000 Subject: ofz#4947 Integer-overflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: I7573f2d211bf9d676c436fcc2e7b312177fa377f Reviewed-on: https://gerrit.libreoffice.org/47375 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- sw/source/filter/html/svxcss1.cxx | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/sw/source/filter/html/svxcss1.cxx b/sw/source/filter/html/svxcss1.cxx index a1d6ee966d87..392e02addbc0 100644 --- a/sw/source/filter/html/svxcss1.cxx +++ b/sw/source/filter/html/svxcss1.cxx @@ -1017,10 +1017,18 @@ static void ParseCSS1_font_size( const CSS1Expression *pExpr, break; case CSS1_PIXLENGTH: { - long nPWidth = 0; - long nPHeight = (long)pExpr->GetNumber(); - SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight ); - nHeight = (sal_uLong)nPHeight; + double fHeight = pExpr->GetNumber(); + if (fHeight < SAL_MAX_INT32/2.0 && fHeight > SAL_MIN_INT32/2.0) + { + long nPHeight = (long)fHeight; + long nPWidth = 0; + SvxCSS1Parser::PixelToTwip(nPWidth, nPHeight); + nHeight = (sal_uLong)nPHeight; + } + else + { + SAL_WARN("sw.html", "out-of-size pxlength: " << fHeight); + } } break; case CSS1_PERCENTAGE: -- cgit