emfio/source/reader/emfreader.cxx | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
New commits:
commit de82849f2475b7626df19c0d29758d95388af1b2
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Wed Jun 2 09:00:05 2021 +0100
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Wed Jun 2 12:08:31 2021 +0200
ofz#34847 Integer-overflow
Change-Id: I45e27efbceff76456f6c22a256a5fce1310272c5
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/116567
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
diff --git a/emfio/source/reader/emfreader.cxx
b/emfio/source/reader/emfreader.cxx
index 106b9a52564f..b0fafab81604 100644
--- a/emfio/source/reader/emfreader.cxx
+++ b/emfio/source/reader/emfreader.cxx
@@ -1335,11 +1335,18 @@ namespace emfio
{
mpInputStream->ReadInt32( nX32 ).ReadInt32( nY32
).ReadInt32( nx32 ).ReadInt32( ny32 );
SAL_INFO("emfio", "\t\t Rectangle, left: " << nX32 <<
", top: " << nY32 << ", right: " << nx32 << ", bottom: " << ny32);
- tools::Long dw = (nx32 - nX32) / 2;
- tools::Long dh = (ny32 - nY32) / 2;
- Point aCenter( nX32 + dw, nY32 + dh );
- tools::Polygon aPoly( aCenter, dw, dh );
- DrawPolygon( aPoly, mbRecordPath );
+
+ sal_Int32 w(0), h(0);
+ if (o3tl::checked_sub(nx32, nX32, w) ||
o3tl::checked_sub(ny32, nY32, h))
+ SAL_WARN("emfio", "broken ellipse");
+ else
+ {
+ tools::Long dw = w / 2;
+ tools::Long dh = h / 2;
+ Point aCenter( nX32 + dw, nY32 + dh );
+ tools::Polygon aPoly( aCenter, dw, dh );
+ DrawPolygon( aPoly, mbRecordPath );
+ }
}
break;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
