From 683d8f58e37337085aaa817c7e918a4c1bfb8fcd Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Wed, 8 Nov 2017 10:51:49 +0000
Subject: ofz#4115 Integer-overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: Ibeb62c6df8fe1e200b97ea179d747e735a4ebf3a
Reviewed-on: https://gerrit.libreoffice.org/44451
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 svtools/source/svrtf/parrtf.cxx | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'svtools/source/svrtf')

diff --git a/svtools/source/svrtf/parrtf.cxx b/svtools/source/svrtf/parrtf.cxx
index a29e571383b9..52e350f52442 100644
--- a/svtools/source/svrtf/parrtf.cxx
+++ b/svtools/source/svrtf/parrtf.cxx
@@ -128,12 +128,12 @@ int SvRTFParser::GetNextToken_()
                         // possible numeric parameter
                         if( RTF_ISDIGIT( nNextCh ) )
                         {
-                            nTokenValue = 0;
+                            OUStringBuffer aNumber;
                             do {
-                                nTokenValue *= 10;
-                                nTokenValue += nNextCh - '0';
+                                aNumber.append(static_cast<sal_Unicode>(nNextCh));
                                 nNextCh = GetNextChar();
                             } while( RTF_ISDIGIT( nNextCh ) );
+                            nTokenValue = aNumber.toString().toInt32();
                             if( bNegValue )
                                 nTokenValue = -nTokenValue;
                             bTokenHasValue=true;
-- 
cgit