From 52869df3f080aae37a1a6fa24e3bd6404ed67646 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Tue, 28 Nov 2017 10:02:28 +0000
Subject: ofz#4461 Integer-overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: Iae41823164c09352ef8ffa97dc3361476c03add8
Reviewed-on: https://gerrit.libreoffice.org/45396
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 svx/source/table/tablelayouter.cxx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'svx')

diff --git a/svx/source/table/tablelayouter.cxx b/svx/source/table/tablelayouter.cxx
index e0ba76552c61..d1de33c1b464 100644
--- a/svx/source/table/tablelayouter.cxx
+++ b/svx/source/table/tablelayouter.cxx
@@ -805,7 +805,7 @@ void TableLayouter::LayoutTableHeight( tools::Rectangle& rArea, bool bFit )
     for( nRow = 0; nRow < nRowCount; ++nRow )
     {
         maRows[nRow].mnPos = nNewHeight;
-        nNewHeight += maRows[nRow].mnSize;
+        nNewHeight = o3tl::saturating_add(nNewHeight, maRows[nRow].mnSize);
 
         if( bFit )
         {
-- 
cgit