diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-12-31 14:09:44 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-12-31 14:09:44 +0000 |
| commit | 45e5b5da183e57c80287bf182433f529a0e64bd7 (patch) | |
| tree | 498261ab3be13674448462d13dd6a672832a3f16 /sw/source | |
| parent | 1b0ef94e222019e78c77f40bdae17e74d83a2aaf (diff) | |
ofz#4852 Integer-overflow
Change-Id: Ifb6a56783ce02a12f5fa5dfae4c815e963dcfe3c
Diffstat (limited to 'sw/source')
| -rw-r--r-- | sw/source/filter/html/svxcss1.cxx | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/sw/source/filter/html/svxcss1.cxx b/sw/source/filter/html/svxcss1.cxx index 2c6b9933d6ea..a1d6ee966d87 100644 --- a/sw/source/filter/html/svxcss1.cxx +++ b/sw/source/filter/html/svxcss1.cxx @@ -2868,12 +2868,16 @@ static void ParseCSS1_length( const CSS1Expression *pExpr, case CSS1_PIXLENGTH: case CSS1_NUMBER: // because of Netscape and IE { - long nWidthL = (long)pExpr->GetNumber(); - long nPWidth = bHori ? 0 : nWidthL; - long nPHeight = bHori ? nWidthL : 0; - SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight ); - rLength = (bHori ? nPHeight : nPWidth); - rLengthType = SVX_CSS1_LTYPE_TWIP; + double fLength = pExpr->GetNumber(); + if (fLength < SAL_MAX_INT32/2.0 && fLength > SAL_MIN_INT32/2.0) + { + long nWidthL = (long)fLength; + long nPWidth = bHori ? 0 : nWidthL; + long nPHeight = bHori ? nWidthL : 0; + SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight ); + rLength = (bHori ? nPHeight : nPWidth); + rLengthType = SVX_CSS1_LTYPE_TWIP; + } } break; |