2 files changed, 11 insertions, 6 deletions
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.cxx b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
index 60c7b3a3d475..29d5dedb7308 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.cxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.cxx
@@ -14,6 +14,7 @@
 #include <com/sun/star/lang/XServiceInfo.hpp>
 #include <com/sun/star/text/WrapTextMode.hpp>
 #include <com/sun/star/text/TextContentAnchorType.hpp>
+#include <o3tl/clamp.hxx>
 #include <unotools/ucbstreamhelper.hxx>
 #include <unotools/streamwrap.hxx>
 #include <com/sun/star/drawing/XDrawPageSupplier.hpp>
@@ -875,8 +876,12 @@ void RTFDocumentImpl::resolvePict(bool const bInline, uno::Reference<drawing::XS
     uno::Reference<io::XInputStream> xInputStream(new utl::OInputStreamWrapper(pStream));
     WmfExternal aExtHeader;
     aExtHeader.mapMode = m_aStates.top().aPicture.eWMetafile;
-    aExtHeader.xExt = m_aStates.top().aPicture.nWidth;
-    aExtHeader.yExt = m_aStates.top().aPicture.nHeight;
+    aExtHeader.xExt = sal_uInt16(
+        o3tl::clamp<sal_Int32>(m_aStates.top().aPicture.nWidth, 0,
+                               SAL_MAX_UINT16)); //TODO: better way to handle out-of-bounds values?
+    aExtHeader.yExt = sal_uInt16(
+        o3tl::clamp<sal_Int32>(m_aStates.top().aPicture.nHeight, 0,
+                               SAL_MAX_UINT16)); //TODO: better way to handle out-of-bounds values?
     WmfExternal* pExtHeader = &aExtHeader;
     uno::Reference<lang::XServiceInfo> xServiceInfo(m_aStates.top().aDrawingObject.xShape,
                                                     uno::UNO_QUERY);
diff --git a/writerfilter/source/rtftok/rtfdocumentimpl.hxx b/writerfilter/source/rtftok/rtfdocumentimpl.hxx
index bdc6af35bae4..a5a04781ebf6 100644
--- a/writerfilter/source/rtftok/rtfdocumentimpl.hxx
+++ b/writerfilter/source/rtftok/rtfdocumentimpl.hxx
@@ -226,10 +226,10 @@ class RTFPicture : public virtual SvRefBase
 {
 public:
     RTFPicture();
-    sal_uInt16 nWidth = 0;
-    sal_uInt16 nHeight = 0;
-    sal_uInt16 nGoalWidth = 0;
-    sal_uInt16 nGoalHeight = 0;
+    sal_Int32 nWidth = 0;
+    sal_Int32 nHeight = 0;
+    sal_Int32 nGoalWidth = 0;
+    sal_Int32 nGoalHeight = 0;
     sal_uInt16 nScaleX = 100;
     sal_uInt16 nScaleY = 100;
     short nCropT = 0;