From cc6128d727d1e92b2aa2b4dd9cbae8e045cf1f6b Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Thu, 2 Nov 2017 09:34:10 +0000
Subject: ofz#3886 Integer-overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I936f681b835cca62fc14a326b7ae5cb062b3f1df
Reviewed-on: https://gerrit.libreoffice.org/44197
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 svx/source/table/tablelayouter.cxx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'svx')

diff --git a/svx/source/table/tablelayouter.cxx b/svx/source/table/tablelayouter.cxx
index 63ca7b8c1bcc..4823f6a8ef92 100644
--- a/svx/source/table/tablelayouter.cxx
+++ b/svx/source/table/tablelayouter.cxx
@@ -472,11 +472,11 @@ sal_Int32 TableLayouter::distribute( LayoutVector& rLayouts, sal_Int32 nDistribu
                     if (nIndex != (nCount-1))
                     {
                         bConstrainsBroken |= o3tl::checked_multiply(nDistribute, rLayout.mnSize, n);
-                        n  /= nCurrentWidth;
+                        n /= nCurrentWidth;
                     }
 
+                    bConstrainsBroken |= o3tl::checked_add(rLayout.mnSize, n, rLayout.mnSize);
                     nDistributed -= n;
-                    rLayout.mnSize += n;
 
                     if( rLayout.mnSize < rLayout.mnMinSize )
                         bConstrainsBroken = true;
-- 
cgit