ofz#4852 Integer-overflow

Change-Id: Ifb6a56783ce02a12f5fa5dfae4c815e963dcfe3c

ofz#4852 Integer-overflow
Change-Id: Ifb6a56783ce02a12f5fa5dfae4c815e963dcfe3c
45e5b5da · Caolán McNamara · 1b0ef94e · 45e5b5da
Kaydet (Commit) 45e5b5da authored Ara 31, 2017 tarafından Caolán McNamara
Hide whitespace changes
Inline Side-by-side

Showing with 10 additions and 6 deletions

svxcss1.cxx sw/source/filter/html/svxcss1.cxx +10 -6

No files found.
--- a/sw/source/filter/html/svxcss1.cxx
+++ b/sw/source/filter/html/svxcss1.cxx
@@ -2868,12 +2868,16 @@ static void ParseCSS1_length( const CSS1Expression *pExpr,
    case CSS1_PIXLENGTH:
    case CSS1_NUMBER:       // because of Netscape and IE
        {
-            long nWidthL = (long)pExpr->GetNumber();
+            double fLength = pExpr->GetNumber();
-            long nPWidth = bHori ? 0 : nWidthL;
+            if (fLength < SAL_MAX_INT32/2.0 && fLength > SAL_MIN_INT32/2.0)
-            long nPHeight = bHori ? nWidthL : 0;
+            {
-            SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight );
+                long nWidthL = (long)fLength;
-            rLength = (bHori ? nPHeight : nPWidth);
+                long nPWidth = bHori ? 0 : nWidthL;
-            rLengthType = SVX_CSS1_LTYPE_TWIP;
+                long nPHeight = bHori ? nWidthL : 0;
+                SvxCSS1Parser::PixelToTwip( nPWidth, nPHeight );
+                rLength = (bHori ? nPHeight : nPWidth);
+                rLengthType = SVX_CSS1_LTYPE_TWIP;
+            }
        }
        break;