From f2573a3f1bd50d4bbc6dffaac17c7ba10d6fd6a3 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Wed, 28 Feb 2018 21:15:44 +0000
Subject: ofz#6617 Integer-overflow

Change-Id: I4fc99ef32e769222164b30373acc5c387a922b88
---
 filter/source/msfilter/msdffimp.cxx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'filter')

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index 96c29b639302..12e8cdb6b005 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -5010,8 +5010,8 @@ void SvxMSDffManager::GetGroupAnchors( const DffRecordHeader& rHd, SvStream& rSt
                     {
                         if ( !rGlobalChildRect.IsEmpty() && !rClientRect.IsEmpty() && rGlobalChildRect.GetWidth() && rGlobalChildRect.GetHeight() )
                         {
-                            double fWidth = r - l;
-                            double fHeight= u - o;
+                            double fWidth = o3tl::saturating_sub(r, l);
+                            double fHeight= o3tl::saturating_sub(u, o);
                             double fXScale = static_cast<double>(rClientRect.GetWidth()) / static_cast<double>(rGlobalChildRect.GetWidth());
                             double fYScale = static_cast<double>(rClientRect.GetHeight()) / static_cast<double>(rGlobalChildRect.GetHeight());
                             double fl = ( ( l - rGlobalChildRect.Left() ) * fXScale ) + rClientRect.Left();
-- 
cgit