From cac4d3b9c2790cfa6575f55aa4052efe88779056 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 29 May 2020 20:38:54 +0100
Subject: ofz#22775 Integer-overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I616350ce96e83f92beac711a59077815ff00fe50
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/95172
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
---
 sw/source/filter/xml/xmlmeta.cxx | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'sw')

diff --git a/sw/source/filter/xml/xmlmeta.cxx b/sw/source/filter/xml/xmlmeta.cxx
index 10079d9f64ef..423bb25805a1 100644
--- a/sw/source/filter/xml/xmlmeta.cxx
+++ b/sw/source/filter/xml/xmlmeta.cxx
@@ -143,6 +143,7 @@ void SwXMLImport::SetStatistics(
     // and autostyles.
     bool bSetFallback = true;
     sal_Int32 nProgressReference = sal_Int32(); // silence C4701
+    const sal_Int32 nProgressReferenceWriggleRoom = 3 * PROGRESS_BAR_STEP;
     if (nTokens & XML_TOK_META_STAT_PARA)
     {
         nProgressReference = static_cast<sal_Int32>(aDocStat.nPara);
@@ -150,10 +151,12 @@ void SwXMLImport::SetStatistics(
     }
     else if (nTokens & XML_TOK_META_STAT_PAGE)
         bSetFallback = o3tl::checked_multiply<sal_Int32>(aDocStat.nPage, 10, nProgressReference);
+    if (!bSetFallback)
+        bSetFallback = o3tl::checked_add(nProgressReference, nProgressReferenceWriggleRoom, nProgressReference);
     if (bSetFallback)
-        nProgressReference = 250;
+        nProgressReference = 250 + nProgressReferenceWriggleRoom;
     ProgressBarHelper* pProgress = GetProgressBarHelper();
-    pProgress->SetReference( nProgressReference + 3*PROGRESS_BAR_STEP );
+    pProgress->SetReference(nProgressReference);
     pProgress->SetValue( 0 );
 }
 
-- 
cgit