From b0486259aa2a1a839f5e46522b73ae9f051e20eb Mon Sep 17 00:00:00 2001 From: Caolán McNamara Date: Wed, 10 Jan 2018 10:10:12 +0000 Subject: ofz: Integer-overflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change-Id: Iad8ebd0861a74399f6bb4a18aecf0de735a60b61 Reviewed-on: https://gerrit.libreoffice.org/47694 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara --- sw/source/filter/html/svxcss1.cxx | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) (limited to 'sw') diff --git a/sw/source/filter/html/svxcss1.cxx b/sw/source/filter/html/svxcss1.cxx index 37c0a88df992..e442644271f2 100644 --- a/sw/source/filter/html/svxcss1.cxx +++ b/sw/source/filter/html/svxcss1.cxx @@ -2019,11 +2019,15 @@ static void ParseCSS1_text_indent( const CSS1Expression *pExpr, break; case CSS1_PIXLENGTH: { - long nPWidth = (long)pExpr->GetNumber(); - long nPHeight = 0; - SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight ); - nIndent = (short)nPWidth; - bSet = true; + double fWidth = pExpr->GetNumber(); + if (fWidth < SAL_MAX_INT32/2.0 && fWidth > SAL_MIN_INT32/2.0) + { + long nPWidth = (long)fWidth; + long nPHeight = 0; + SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight ); + nIndent = (short)nPWidth; + bSet = true; + } } break; case CSS1_PERCENTAGE: -- cgit