From 1ca9388900b8cf4aa1ae67533432acf37a94281e Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Sat, 6 Jan 2018 20:00:05 +0000
Subject: ofz#4976 Integer-overflow

Change-Id: Iefba0ea6122bd9b1dde59f33c0c67077fecb7eca
---
 lotuswordpro/inc/lwpoverride.hxx | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

(limited to 'lotuswordpro/inc')

diff --git a/lotuswordpro/inc/lwpoverride.hxx b/lotuswordpro/inc/lwpoverride.hxx
index d9df79894382..c5f616a15dad 100644
--- a/lotuswordpro/inc/lwpoverride.hxx
+++ b/lotuswordpro/inc/lwpoverride.hxx
@@ -63,6 +63,7 @@
 
 #include "lwpobjid.hxx"
 #include "lwptools.hxx"
+#include <o3tl/safeint.hxx>
 #include <memory>
 
 class LwpObjectStream;
@@ -434,11 +435,17 @@ private:
 
 inline double LwpIndentOverride::GetFirst() const
 {
-        return LwpTools::ConvertToMetric(LwpTools::ConvertFromUnits(m_nFirst-m_nRest));
+    sal_Int32 nRes;
+    if (o3tl::checked_sub(m_nFirst, m_nRest, nRes))
+        throw std::range_error("bad len");
+    return LwpTools::ConvertToMetric(LwpTools::ConvertFromUnits(nRes));
 }
 inline double LwpIndentOverride::GetLeft() const
 {
-        return LwpTools::ConvertToMetric(LwpTools::ConvertFromUnits(m_nAll+m_nRest));
+    sal_Int32 nRes;
+    if (o3tl::checked_add(m_nAll, m_nRest, nRes))
+        throw std::range_error("bad len");
+    return LwpTools::ConvertToMetric(LwpTools::ConvertFromUnits(nRes));
 }
 inline double LwpIndentOverride::GetRight() const
 {
-- 
cgit