emfio/source/reader/emfreader.cxx |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

New commits:
commit aab1018339fba9e6c618a17dfb2a01464555c4dc
Author: Caolán McNamara <caol...@redhat.com>
Date:   Tue Oct 31 09:02:24 2017 +0000

    ofz#3939 Integer-overflow
    
    Change-Id: Ic35cf6dd77d536ba3ab486b1c752d81037fe7cae
    Reviewed-on: https://gerrit.libreoffice.org/44103
    Tested-by: Jenkins <c...@libreoffice.org>
    Reviewed-by: Caolán McNamara <caol...@redhat.com>
    Tested-by: Caolán McNamara <caol...@redhat.com>

diff --git a/emfio/source/reader/emfreader.cxx 
b/emfio/source/reader/emfreader.cxx
index cfcb6e3feea5..bcd8b7a83855 100644
--- a/emfio/source/reader/emfreader.cxx
+++ b/emfio/source/reader/emfreader.cxx
@@ -1413,14 +1413,17 @@ namespace emfio
                                 ReadDIB(aBitmap, aTmp, true);
 
                                 // test if it is sensible to crop
-                                if ( ( cxSrc > 0 ) && ( cySrc > 0 ) &&
-                                    ( xSrc >= 0 ) && ( ySrc >= 0 ) &&
-                                        ( xSrc + cxSrc <= 
aBitmap.GetSizePixel().Width() ) &&
-                                            ( ySrc + cySrc <= 
aBitmap.GetSizePixel().Height() ) )
+                                if ( (cxSrc > 0) && (cySrc > 0) &&
+                                     (xSrc >= 0) && (ySrc >= 0) &&
+                                     (aBitmap.GetSizePixel().Width() >= cxSrc) 
&&
+                                     (xSrc <= aBitmap.GetSizePixel().Width() - 
cxSrc) &&
+                                     (aBitmap.GetSizePixel().Height() >= 
cySrc) &&
+                                     (ySrc <= aBitmap.GetSizePixel().Height() 
- cySrc) )
                                 {
                                     tools::Rectangle aCropRect( Point( xSrc, 
ySrc ), Size( cxSrc, cySrc ) );
                                     aBitmap.Crop( aCropRect );
                                 }
+
                                 maBmpSaveList.emplace_back(new 
BSaveStruct(aBitmap, aRect, dwRop));
                             }
                         }
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits

Reply via email to