From 1eb31467a5af90fe41dc646dd716bdb7d3e5db45 Mon Sep 17 00:00:00 2001 From: Stephan Bergmann Date: Wed, 12 Nov 2014 08:58:57 +0100 Subject: Guard against wrap-around in SvxFontHeightItem ...though the whole design there looks broken Change-Id: I6c3a53d606ea835d34729fcfb661fad0f1897716 --- editeng/source/items/textitem.cxx | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/editeng/source/items/textitem.cxx b/editeng/source/items/textitem.cxx index 4a2bbd8b83a8..c471b45b3052 100644 --- a/editeng/source/items/textitem.cxx +++ b/editeng/source/items/textitem.cxx @@ -884,7 +884,13 @@ bool SvxFontHeightItem::QueryValue( uno::Any& rVal, sal_uInt8 nMemberId ) const return true; } -// Calculate the relative deviation from the expected height. +// Try to reconstruct the original height input value from the modified height +// and the prop data; this seems somewhat futile given the various ways how the +// modified height is calculated (with and without conversion between twips and +// 100th mm; with an additional eCoreMetric input in one of the SetHeight +// overloads), and indeed known to occassionally produce nRet values that would +// be negative, so just guard against negative results here and throw the hands +// up in despair: static sal_uInt32 lcl_GetRealHeight_Impl(sal_uInt32 nHeight, sal_uInt16 nProp, SfxMapUnit eProp, bool bCoreInTwip) { sal_uInt32 nRet = nHeight; @@ -913,7 +919,9 @@ static sal_uInt32 lcl_GetRealHeight_Impl(sal_uInt32 nHeight, sal_uInt16 nProp, S break; default: ;//prevent warning } - nRet -= nDiff; + nRet = (nDiff < 0 || nRet >= static_cast(nDiff)) + ? nRet - nDiff : 0; + //TODO: overflow in case nDiff < 0 and nRet - nDiff > SAL_MAX_UINT32 return nRet; } -- cgit