ofz#7366 Integer overflow

Change-Id: Ia81f6681dd846715b75c87dd9ddc8520a2e9ed5a
Reviewed-on: https://gerrit.libreoffice.org/52403
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 7 insertions, 1 deletions

diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx
index 1c1a077355e5..9b0a772ee1c0 100644
--- a/filter/source/graphicfilter/ios2met/ios2met.cxx
+++ b/filter/source/graphicfilter/ios2met/ios2met.cxx
@@ -2037,10 +2037,16 @@ void OS2METReader::ReadOrder(sal_uInt16 nOrderID, sal_uInt16 nOrderLen)
             sal_uInt16 nLen=nOrderLen;
             auto nWidth = ReadCoord(bCoord32);
             auto nHeight = ReadCoord(bCoord32);
-            if (nWidth < 0 || nHeight < 0)
+            if (nWidth < 0 || nHeight < 0 ||
+                nWidth > std::numeric_limits<decltype(nWidth)>::max() ||
+                nHeight > std::numeric_limits<decltype(nHeight)>::max())
+            {
                 aAttr.aChrCellSize = aDefAttr.aChrCellSize;
+            }
             else
+            {
                 aAttr.aChrCellSize = Size(nWidth, nHeight);
+            }
             if (bCoord32) nLen-=8; else nLen-=4;
             if (nLen>=4) {
                 pOS2MET->SeekRel(4); nLen-=4;