ofz#4034 Integer-overflow

Change-Id: I99a4e24e2038387f749051bc268bc74ce808bd96
Reviewed-on: https://gerrit.libreoffice.org/44306Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

svx/source/table/tablelayouter.cxx

@@ -127,12 +127,18 @@ bool TableLayouter::getCellArea( const CellRef& xCell, const CellPos& rPos, base
                 {
                     ///For RTL Table Calculate the Right End of cell instead of Left
                     const sal_Int32 x = maColumns[rPos.mnCol].mnPos + maColumns[rPos.mnCol].mnSize;
-                    rArea = basegfx::B2IRectangle( x-aCellSize.getX(), y, x, y + aCellSize.getY()  );
+                    sal_Int32 startx, endy;
+                    if (o3tl::checked_sub(x, aCellSize.getX(), startx) || o3tl::checked_add(y, aCellSize.getY(), endy))
+                        return false;
+                    rArea = basegfx::B2IRectangle(startx, y, x, endy);
                 }
                 else
                 {
                     const sal_Int32 x = maColumns[rPos.mnCol].mnPos;
-                    rArea = basegfx::B2IRectangle( x, y, x + aCellSize.getX(), y + aCellSize.getY()  );
+                    sal_Int32 endx, endy;
+                    if (o3tl::checked_add(x, aCellSize.getX(), endx) || o3tl::checked_add(y, aCellSize.getY(), endy))
+                        return false;
+                    rArea = basegfx::B2IRectangle(x, y, endx, endy);
                 }
                 return true;
             }