Related: ofz#36348 ubsan runtime error: value outside representable range

Change-Id: I0dbbba2c4020d7fc7e6f12aba4bfcb003fa13893
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/119611
Reviewed-by: Stephan Bergmann <sbergman@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

3 files changed, 40 insertions, 20 deletions

diff --git a/filter/source/graphicfilter/icgm/actimpr.cxx b/filter/source/graphicfilter/icgm/actimpr.cxx
index 317b7b2885e3..664616b41f2e 100644
--- a/filter/source/graphicfilter/icgm/actimpr.cxx
+++ b/filter/source/graphicfilter/icgm/actimpr.cxx
@@ -18,6 +18,7 @@
  */
 
 #include <sal/config.h>
+#include <sal/log.hxx>
 
 #include <o3tl/any.hxx>
 #include <o3tl/safeint.hxx>
@@ -451,16 +452,35 @@ void CGMImpressOutAct::EndGrouping()
 
 void CGMImpressOutAct::DrawRectangle( FloatRect const & rFloatRect )
 {
-    if ( mnGroupActCount != ( mpCGM->mnActCount - 1 ) )         // POWERPOINT HACK !!!
+    if (mnGroupActCount == (mpCGM->mnActCount - 1))         // POWERPOINT HACK !!!
+        return;
+    if (useless(rFloatRect.Left))
     {
-        if ( ImplCreateShape( "com.sun.star.drawing.RectangleShape" ) )
-        {
-            awt::Size aSize( static_cast<tools::Long>(rFloatRect.Right - rFloatRect.Left ), static_cast<tools::Long>(rFloatRect.Bottom-rFloatRect.Top ) );
-            maXShape->setSize( aSize );
-            maXShape->setPosition( awt::Point( static_cast<tools::Long>(rFloatRect.Left), static_cast<tools::Long>(rFloatRect.Top) ) );
-            ImplSetFillBundle();
-        }
+        SAL_WARN("filter.icgm", "bad left: " << rFloatRect.Left);
+        return;
     }
+    if (useless(rFloatRect.Top))
+    {
+        SAL_WARN("filter.icgm", "bad top: " << rFloatRect.Top);
+        return;
+    }
+    double fWidth = rFloatRect.Right - rFloatRect.Left;
+    if (useless(fWidth))
+    {
+        SAL_WARN("filter.icgm", "bad width: " << fWidth);
+        return;
+    }
+    double fHeight = rFloatRect.Bottom - rFloatRect.Top;
+    if (useless(fHeight))
+    {
+        SAL_WARN("filter.icgm", "bad height: " << fHeight);
+        return;
+    }
+    if (!ImplCreateShape( "com.sun.star.drawing.RectangleShape"))
+        return;
+    maXShape->setSize(awt::Size(fWidth, fHeight));
+    maXShape->setPosition(awt::Point(rFloatRect.Left, rFloatRect.Top));
+    ImplSetFillBundle();
 }
 
 void CGMImpressOutAct::DrawEllipse( FloatPoint const & rCenter, FloatPoint const & rSize, double& rOrientation )
diff --git a/filter/source/graphicfilter/icgm/cgm.hxx b/filter/source/graphicfilter/icgm/cgm.hxx
index 7709b743d4f0..b344cb22e707 100644
--- a/filter/source/graphicfilter/icgm/cgm.hxx
+++ b/filter/source/graphicfilter/icgm/cgm.hxx
@@ -21,8 +21,9 @@
 
 #include <com/sun/star/frame/XModel.hpp>
 
-#include <vector>
+#include <cmath>
 #include <memory>
+#include <vector>
 #include "cgmtypes.hxx"
 
 class   Graphic;
@@ -137,4 +138,14 @@ class CGM
 
 };
 
+inline bool useless(double value)
+{
+    if (!std::isfinite(value))
+        return true;
+    int exp;
+    std::frexp(value, &exp);
+    const int maxbits = sizeof(tools::Long) * 8;
+    return exp > maxbits;
+}
+
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/filter/source/graphicfilter/icgm/class4.cxx b/filter/source/graphicfilter/icgm/class4.cxx
index 8f972ed4f1ee..04b8f7c6fb63 100644
--- a/filter/source/graphicfilter/icgm/class4.cxx
+++ b/filter/source/graphicfilter/icgm/class4.cxx
@@ -26,7 +26,6 @@
 
 #include <o3tl/safeint.hxx>
 
-#include <math.h>
 #include <memory>
 
 using namespace ::com::sun::star;
@@ -107,16 +106,6 @@ bool CGM::ImplGetEllipse( FloatPoint& rCenter, FloatPoint& rRadius, double& rAng
     return true;
 }
 
-static bool useless(double value)
-{
-    if (!std::isfinite(value))
-        return true;
-    int exp;
-    std::frexp(value, &exp);
-    const int maxbits = sizeof(tools::Long) * 8;
-    return exp > maxbits;
-}
-
 void CGM::ImplDoClass4()
 {
     if ( mbFirstOutPut )