ofz#68172 Integer-overflow

Change-Id: Ie80487e20217d7a54cb401b0423dfec01df1292e
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/166373
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>

1 files changed, 12 insertions, 4 deletions

diff --git a/emfio/source/reader/mtftools.cxx b/emfio/source/reader/mtftools.cxx
index e6ac4893730b..40b040820960 100644
--- a/emfio/source/reader/mtftools.cxx
+++ b/emfio/source/reader/mtftools.cxx
@@ -975,10 +975,18 @@ namespace emfio
                 if ( pLineStyle->aLineInfo.GetStyle() == LineStyle::Dash )
                 {
                     aSize.AdjustWidth(1 );
-                    tools::Long nDotLen = ImplMap( aSize ).Width();
-                    pLineStyle->aLineInfo.SetDistance( nDotLen );
-                    pLineStyle->aLineInfo.SetDotLen( nDotLen );
-                    pLineStyle->aLineInfo.SetDashLen( nDotLen * 3 );
+                    tools::Long nDashLen, nDotLen = ImplMap( aSize ).Width();
+                    const bool bFail = o3tl::checked_multiply<tools::Long>(nDotLen, 3, nDashLen);
+                    if (!bFail)
+                    {
+                        pLineStyle->aLineInfo.SetDistance( nDotLen );
+                        pLineStyle->aLineInfo.SetDotLen( nDotLen );
+                        pLineStyle->aLineInfo.SetDashLen( nDotLen * 3 );
+                    }
+                    else
+                    {
+                        SAL_WARN("emfio", "DotLen too long: " << nDotLen);
+                    }
                 }
             }
         }