core.git: sc/source

[Caolán McNamara (via logerrit)]

 sc/source/core/tool/address.cxx |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

New commits:
commit 6cd7d9322e24ffed4dbaa4cd9b09c3c8e65d9128
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Sat Jun 8 21:00:09 2024 +0100
Commit:     Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Sun Jun 9 15:28:02 2024 +0200

    ofz#69444 Integer-overflow
    
    Change-Id: I24d93f4c61256cd0750ab01cf5a8f313e875d35b
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168580
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    Tested-by: Jenkins

diff --git a/sc/source/core/tool/address.cxx b/sc/source/core/tool/address.cxx
index c419d9f3a312..ffbeb495d4ab 100644
--- a/sc/source/core/tool/address.cxx
+++ b/sc/source/core/tool/address.cxx
@@ -147,25 +147,25 @@ static sal_Int64 sal_Unicode_strtol ( const sal_Unicode*  
p, const sal_Unicode**
     else if( *p == '+' )
         p++;
 
-    const sal_Int64 cutoff = is_neg ? -(std::numeric_limits<sal_Int64>::min() 
/ 10)
-                                    : std::numeric_limits<sal_Int64>::max() / 
10;
-    const sal_Int64 cutlim = is_neg ? -(std::numeric_limits<sal_Int64>::min() 
% 10)
-                                    : std::numeric_limits<sal_Int64>::max() % 
10;
+    const sal_Int64 cutoff = is_neg ? std::numeric_limits<sal_Int64>::min() / 
10
+                                    : -(std::numeric_limits<sal_Int64>::max() 
/ 10);
+    const int cutlim = is_neg ? -(std::numeric_limits<sal_Int64>::min() % 10)
+                              : std::numeric_limits<sal_Int64>::max() % 10;
 
     while (rtl::isAsciiDigit( *p ))
     {
         int val = *p - '0';
-        if (accum > cutoff || (accum == cutoff && val > cutlim))
+        if (accum < cutoff || (accum == cutoff && val > cutlim))
         {
             *pEnd = nullptr;
             return 0;
         }
-        accum = accum * 10 + val;
+        accum = accum * 10 - val;
         p++;
     }
 
     *pEnd = p;
-    return is_neg ? -accum : accum;
+    return is_neg ? accum : -accum;
 }
 
 static const sal_Unicode* lcl_eatWhiteSpace( const sal_Unicode* p )