ofz#3769 Integer-overflow

Change-Id: Ia245c6042f8c662bab870cf166db94d1cf2db9d3
Reviewed-on: https://gerrit.libreoffice.org/43781
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

1 files changed, 5 insertions, 8 deletions

diff --git a/sax/source/tools/converter.cxx b/sax/source/tools/converter.cxx
index 0c560865a7b6..1cb8cf190f04 100644
--- a/sax/source/tools/converter.cxx
+++ b/sax/source/tools/converter.cxx
@@ -969,21 +969,15 @@ static Result
 readUnsignedNumber(const OUString & rString,
     sal_Int32 & io_rnPos, sal_Int32 & o_rNumber)
 {
-    bool bOverflow(false);
-    sal_Int64 nTemp(0);
     sal_Int32 nPos(io_rnPos);
 
+    OUStringBuffer aNumber;
     while (nPos < rString.getLength())
     {
         const sal_Unicode c = rString[nPos];
         if (('0' <= c) && (c <= '9'))
         {
-            nTemp *= 10;
-            nTemp += (c - u'0');
-            if (nTemp >= SAL_MAX_INT32)
-            {
-                bOverflow = true;
-            }
+            aNumber.append(c);
         }
         else
         {
@@ -998,6 +992,9 @@ readUnsignedNumber(const OUString & rString,
         return R_NOTHING;
     }
 
+    const sal_Int64 nTemp = aNumber.toString().toInt64();
+    const bool bOverflow = (nTemp >= SAL_MAX_INT32);
+
     io_rnPos = nPos;
     o_rNumber = nTemp;
     return (bOverflow) ? R_OVERFLOW : R_SUCCESS;