fdo#78432 : DOCX: File gets corrupt after RoundTrip

	Issue :
	- In RT in document.xml, value of Absolute Position Offset
	<wp:posOffset> was going out of bounds.
	- <wp:posOffset> is of type Int(32-bits), hence it's value
	should not cross the MAX and MIN limits of Int.

	Implementation :
	- Added check for <wp:posOffset> should not cross
	Maximum/Minimum limit of Int.
	- Written Export Unit test case.

Reviewed on:
	https://gerrit.libreoffice.org/9328

Change-Id: I22e75d7e603ebbf6a49e764fb1a3e6a4d2fd8b23

sw/qa/extras/ooxmlexport/ooxmlexport.cxx

@@ -3310,6 +3310,33 @@ DECLARE_OOXMLEXPORT_TEST(testPageBreakInFirstPara,"fdo77727.docx")
     assertXPath(pXmlDoc, "/w:document/w:body/w:p[1]/w:r[2]/w:br","type","page");
 }
 
+DECLARE_OOXMLEXPORT_TEST(testAbsolutePositionOffsetValue,"fdo78432.docx")
+{
+    xmlDocPtr pXmlDoc = parseExport("word/document.xml");
+    if (!pXmlDoc)
+        return;
+
+    sal_Int32 IntMax = 2147483647;
+
+    xmlNodeSetPtr pXmlNodes[6];
+    pXmlNodes[0] = getXPathNode(pXmlDoc,"/w:document[1]/w:body[1]/w:p[1]/w:r[1]/mc:AlternateContent[1]/mc:Choice[1]/w:drawing[1]/wp:anchor[1]/wp:positionH[1]/wp:posOffset[1]");
+    pXmlNodes[1] = getXPathNode(pXmlDoc,"/w:document[1]/w:body[1]/w:p[1]/w:r[1]/mc:AlternateContent[1]/mc:Choice[1]/w:drawing[1]/wp:anchor[1]/wp:positionV[1]/wp:posOffset[1]");
+
+    pXmlNodes[2] = getXPathNode(pXmlDoc,"/w:document[1]/w:body[1]/w:p[1]/w:r[1]/mc:AlternateContent[2]/mc:Choice[1]/w:drawing[1]/wp:anchor[1]/wp:positionH[1]/wp:posOffset[1]");
+    pXmlNodes[3] = getXPathNode(pXmlDoc,"/w:document[1]/w:body[1]/w:p[1]/w:r[1]/mc:AlternateContent[2]/mc:Choice[1]/w:drawing[1]/wp:anchor[1]/wp:positionV[1]/wp:posOffset[1]");
+
+    pXmlNodes[4] = getXPathNode(pXmlDoc,"/w:document[1]/w:body[1]/w:p[1]/w:r[1]/mc:AlternateContent[3]/mc:Choice[1]/w:drawing[1]/wp:anchor[1]/wp:positionH[1]/wp:posOffset[1]");
+    pXmlNodes[5] = getXPathNode(pXmlDoc,"/w:document[1]/w:body[1]/w:p[1]/w:r[1]/mc:AlternateContent[3]/mc:Choice[1]/w:drawing[1]/wp:anchor[1]/wp:positionV[1]/wp:posOffset[1]");
+
+    for(sal_Int32 index = 0; index<6; ++index)
+    {
+        CPPUNIT_ASSERT(pXmlNodes[index] != 0);
+        xmlNodePtr pXmlNode = pXmlNodes[index]->nodeTab[0];
+        OUString contents = OUString::createFromAscii((const char*)((pXmlNode->children[0]).content));
+        CPPUNIT_ASSERT( contents.toInt64() <= IntMax );
+    }
+}
+
 DECLARE_OOXMLEXPORT_TEST(testFDO78284, "fdo78284.docx")
 {
     xmlDocPtr pXmlDoc = parseExport("[Content_Types].xml");

sw/source/filter/ww8/docxsdrexport.cxx

@@ -44,6 +44,8 @@
 #include <writerhelper.hxx>
 #include <comphelper/seqstream.hxx>
 
+#include <climits>
+
 using namespace com::sun::star;
 using namespace oox;
 
@@ -422,7 +424,27 @@ void DocxSdrExport::startDMLAnchorInline(const SwFrmFmt* pFrmFmt, const Size& rS
         else
         {
             m_pImpl->m_pSerializer->startElementNS(XML_wp, XML_posOffset, FSEND);
-            m_pImpl->m_pSerializer->write(TwipsToEMU(aPos.X));
+            sal_Int64 nTwipstoEMU = TwipsToEMU(aPos.X);
+
+            /* Absolute Position Offset Value is of type Int. Hence it should not be greater than
+             * Maximum value for Int OR Less than the Minimum value for Int.
+             * - Maximum value for Int = 2147483647
+             * - Minimum value for Int = -2147483648
+             *
+             * As per ECMA Specification : ECMA-376, Second Edition,
+             * Part 1 - Fundamentals And Markup Language Reference[20.4.3.3 ST_PositionOffset (Absolute Position Offset Value)]
+             *
+             * Please refer : http://www.schemacentral.com/sc/xsd/t-xsd_int.html
+             */
+            if (nTwipstoEMU > INT_MAX)
+            {
+                nTwipstoEMU = INT_MAX;
+            }
+            else if (nTwipstoEMU < INT_MIN)
+            {
+                nTwipstoEMU = INT_MIN;
+            }
+            m_pImpl->m_pSerializer->write(nTwipstoEMU);
             m_pImpl->m_pSerializer->endElementNS(XML_wp, XML_posOffset);
         }
         m_pImpl->m_pSerializer->endElementNS(XML_wp, XML_positionH);
@@ -436,7 +458,16 @@ void DocxSdrExport::startDMLAnchorInline(const SwFrmFmt* pFrmFmt, const Size& rS
         else
         {
             m_pImpl->m_pSerializer->startElementNS(XML_wp, XML_posOffset, FSEND);
-            m_pImpl->m_pSerializer->write(TwipsToEMU(aPos.Y));
+            sal_Int64 nTwipstoEMU = TwipsToEMU(aPos.Y);
+            if (nTwipstoEMU > INT_MAX)
+            {
+                nTwipstoEMU = INT_MAX;
+            }
+            else if (nTwipstoEMU < INT_MIN)
+            {
+                nTwipstoEMU = INT_MIN;
+            }
+            m_pImpl->m_pSerializer->write(nTwipstoEMU);
             m_pImpl->m_pSerializer->endElementNS(XML_wp, XML_posOffset);
         }
         m_pImpl->m_pSerializer->endElementNS(XML_wp, XML_positionV);