From d754330e05ba2d81fb263f569bddf3e537b8054c Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Wed, 25 Oct 2017 10:22:00 +0100
Subject: ofz#3789 Integer-overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

with input 69e9223372036854775807

Change-Id: Iaf5a85170d144be2db5604340d784a8982754e08
Reviewed-on: https://gerrit.libreoffice.org/43815
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 sal/rtl/math.cxx | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'sal')

diff --git a/sal/rtl/math.cxx b/sal/rtl/math.cxx
index a9404871c228..997280784351 100644
--- a/sal/rtl/math.cxx
+++ b/sal/rtl/math.cxx
@@ -19,6 +19,7 @@
 
 #include <rtl/math.h>
 
+#include <o3tl/safeint.hxx>
 #include <osl/diagnose.h>
 #include <rtl/alloc.h>
 #include <rtl/character.hxx>
@@ -938,7 +939,9 @@ inline double stringToDouble(CharT const * pBegin, CharT const * pEnd,
                     if ( bExpSign )
                         nExp = -nExp;
 
-                    long nAllExp = ( bOverflow ? 0 : nExp + nValExp );
+                    long nAllExp(0);
+                    if (!bOverflow)
+                        bOverflow = o3tl::checked_add(nExp, nValExp, nAllExp);
                     if ( nAllExp > DBL_MAX_10_EXP || (bOverflow && !bExpSign) )
                     {   // overflow
                         fVal = HUGE_VAL;
-- 
cgit