oox/source/vml/vmldrawing.cxx | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
New commits:
commit 1c49a6d5aab168ca02fdda6d2c27d4ca1fa152f6
Author: Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Sat Nov 23 19:37:27 2024 +0000
Commit: Caolán McNamara <caolan.mcnam...@collabora.com>
CommitDate: Mon Nov 25 11:28:56 2024 +0100
cid#1607224 Overflowed return value
Change-Id: I297159aec76a497c5082c70adc0c2e45878322a5
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/177240
Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
Tested-by: Jenkins
diff --git a/oox/source/vml/vmldrawing.cxx b/oox/source/vml/vmldrawing.cxx
index c44b9e426119..69b0557c173b 100644
--- a/oox/source/vml/vmldrawing.cxx
+++ b/oox/source/vml/vmldrawing.cxx
@@ -235,7 +235,6 @@ sal_Int32 Drawing::getLocalShapeIndex( std::u16string_view
rShapeId ) const
sal_Int32 nBlockId = (nShapeId - 1) / 1024;
BlockIdVector::iterator aIt = ::std::lower_bound( maBlockIds.begin(),
maBlockIds.end(), nBlockId );
sal_Int32 nIndex = static_cast< sal_Int32 >( aIt - maBlockIds.begin() );
- assert(nIndex < std::numeric_limits<sal_Int32>::max() / 1024 -1 &&
"possible overflow");
// block id not found in set -> register it now (value of nIndex remains
valid)
if( (aIt == maBlockIds.end()) || (*aIt != nBlockId) )
@@ -245,7 +244,13 @@ sal_Int32 Drawing::getLocalShapeIndex( std::u16string_view
rShapeId ) const
sal_Int32 nBlockOffset = (nShapeId - 1) % 1024 + 1;
// calculate the local shape index
- return 1024 * nIndex + nBlockOffset;
+ sal_Int32 nRet;
+ if (o3tl::checked_add(1024 * nIndex, nBlockOffset, nRet))
+ {
+ SAL_WARN("oox", "getLocalShapeIndex: overflow on " << 1024 * nIndex <<
" + " << nBlockOffset);
+ nRet = -1;
+ }
+ return nRet;
}
const OleObjectInfo* Drawing::getOleObjectInfo( const OUString& rShapeId )
const
