From 59d41f0bd54522a15e4177cbc9fda175b5190646 Mon Sep 17 00:00:00 2001 From: Justin Luth Date: Mon, 23 Apr 2018 09:27:00 +0300 Subject: tdf#117129 ww8import: prevent divide-by-zero MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Before commit ffc3358515799057e72379b76a1165c6ea5a9bd1 for tdf#75539, the divisor was hard-coded at 1000. The preceeding code also notes that an undefined relativeWidth is forced to 1000. So, on an invalid divisor, revert to previous behaviour. Change-Id: I40210194eec39682d9ab3ce68268d343af16e2b1 Reviewed-on: https://gerrit.libreoffice.org/53329 Tested-by: Jenkins Reviewed-by: Caolán McNamara Tested-by: Caolán McNamara (cherry picked from commit 9b55701b88c42cac491587072f1f09522207de77) Reviewed-on: https://gerrit.libreoffice.org/53517 Reviewed-by: Justin Luth Tested-by: Justin Luth --- sw/qa/core/data/ww8/pass/tdf117129_dxagoal0.doc | Bin 0 -> 53248 bytes sw/source/filter/ww8/ww8graf2.cxx | 3 ++- 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 sw/qa/core/data/ww8/pass/tdf117129_dxagoal0.doc diff --git a/sw/qa/core/data/ww8/pass/tdf117129_dxagoal0.doc b/sw/qa/core/data/ww8/pass/tdf117129_dxagoal0.doc new file mode 100644 index 000000000000..9fca8ef048ae Binary files /dev/null and b/sw/qa/core/data/ww8/pass/tdf117129_dxagoal0.doc differ diff --git a/sw/source/filter/ww8/ww8graf2.cxx b/sw/source/filter/ww8/ww8graf2.cxx index fde01e6ad296..4035d583c1ba 100644 --- a/sw/source/filter/ww8/ww8graf2.cxx +++ b/sw/source/filter/ww8/ww8graf2.cxx @@ -579,10 +579,11 @@ SwFrameFormat* SwWW8ImplReader::ImportGraf(SdrTextObj const * pTextObj, relativeWidth = pRecord->isHorizontalRule ? 1000 : 0; if( relativeWidth != 0 ) { + const sal_Int16 nScale = aPic.dxaGoal ? aPic.dxaGoal : 1000; aPic.mx = msword_cast( m_aSectionManager.GetPageWidth() - m_aSectionManager.GetPageRight() - - m_aSectionManager.GetPageLeft()) * relativeWidth / aPic.dxaGoal; + m_aSectionManager.GetPageLeft()) * relativeWidth / nScale; aPD = WW8PicDesc( aPic ); // This SetSnapRect() call adjusts the size of the // object itself, no idea why it's this call (or even -- cgit v1.2.3