From a329b2111c12b9a5a3bc0de53065044155f54474 Mon Sep 17 00:00:00 2001 From: Stephan Bergmann Date: Mon, 24 Jun 2019 16:00:08 +0200 Subject: Don't prematurely convert nEscapement from double to sal_Int16 ...before it is clamped to -MAX_ESC_POS..MAX_ESC_POS, anyway. That avoids some -fsanitize=float-cast-overflow > writerfilter/source/dmapper/DomainMapper.cxx:2833:39: runtime error: -327680 is outside the range of representable values of type 'short' when loading caolan/swfntobj_drawtext_heap_buffer_overflow.sample (from the crashtestdata files). Change-Id: I42c23fe30723280410f3afc0ecbe40f1f31b7f96 Reviewed-on: https://gerrit.libreoffice.org/74645 Tested-by: Jenkins Reviewed-by: Stephan Bergmann --- writerfilter/source/dmapper/DomainMapper.cxx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'writerfilter') diff --git a/writerfilter/source/dmapper/DomainMapper.cxx b/writerfilter/source/dmapper/DomainMapper.cxx index 0eef649f96d3..54e4a7bdd7a1 100644 --- a/writerfilter/source/dmapper/DomainMapper.cxx +++ b/writerfilter/source/dmapper/DomainMapper.cxx @@ -2806,7 +2806,7 @@ void DomainMapper::processDeferredCharacterProperties( const std::map< sal_Int32 break; // only for use by other properties, ignore here case NS_ooxml::LN_EG_RPrBase_position: { - sal_Int16 nEscapement = 0; + double nEscapement = 0; sal_Int8 nProp = 100; if(nIntValue == 0) nProp = 0; @@ -2851,7 +2851,7 @@ void DomainMapper::processDeferredCharacterProperties( const std::map< sal_Int32 nEscapement = -MAX_ESC_POS; } - rContext->Insert(PROP_CHAR_ESCAPEMENT, uno::makeAny( nEscapement ) ); + rContext->Insert(PROP_CHAR_ESCAPEMENT, uno::makeAny( sal_Int16(nEscapement) ) ); rContext->Insert(PROP_CHAR_ESCAPEMENT_HEIGHT, uno::makeAny( nProp ) ); } break; -- cgit