sw/source/filter/html/svxcss1.cxx | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
New commits:
commit 45e5b5da183e57c80287bf182433f529a0e64bd7
Author: Caolán McNamara <caol...@redhat.com>
Date: Sun Dec 31 14:09:44 2017 +0000
ofz#4852 Integer-overflow
Change-Id: Ifb6a56783ce02a12f5fa5dfae4c815e963dcfe3c
diff --git a/sw/source/filter/html/svxcss1.cxx
b/sw/source/filter/html/svxcss1.cxx
index 2c6b9933d6ea..a1d6ee966d87 100644
--- a/sw/source/filter/html/svxcss1.cxx
+++ b/sw/source/filter/html/svxcss1.cxx
@@ -2868,12 +2868,16 @@ static void ParseCSS1_length( const CSS1Expression
*pExpr,
case CSS1_PIXLENGTH:
case CSS1_NUMBER: // because of Netscape and IE
{
- long nWidthL = (long)pExpr->GetNumber();
- long nPWidth = bHori ? 0 : nWidthL;
- long nPHeight = bHori ? nWidthL : 0;
- SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight );
- rLength = (bHori ? nPHeight : nPWidth);
- rLengthType = SVX_CSS1_LTYPE_TWIP;
+ double fLength = pExpr->GetNumber();
+ if (fLength < SAL_MAX_INT32/2.0 && fLength > SAL_MIN_INT32/2.0)
+ {
+ long nWidthL = (long)fLength;
+ long nPWidth = bHori ? 0 : nWidthL;
+ long nPHeight = bHori ? nWidthL : 0;
+ SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight );
+ rLength = (bHori ? nPHeight : nPWidth);
+ rLengthType = SVX_CSS1_LTYPE_TWIP;
+ }
}
break;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
