sw/source/filter/ww8/ww8par5.cxx | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
New commits: commit 7dd83ed395bbdb03c9c8a9da3d0226aa602bb624 Author: Caolán McNamara <caol...@redhat.com> Date: Tue May 22 09:03:53 2018 +0100 ofz#8442 Integer-overflow Change-Id: I8d09ce583abac38420646b60b83f56e02eb48cab Reviewed-on: https://gerrit.libreoffice.org/54656 Reviewed-by: Caolán McNamara <caol...@redhat.com> Tested-by: Caolán McNamara <caol...@redhat.com> diff --git a/sw/source/filter/ww8/ww8par5.cxx b/sw/source/filter/ww8/ww8par5.cxx index 5c27518b87b6..978c9f877e3e 100644 --- a/sw/source/filter/ww8/ww8par5.cxx +++ b/sw/source/filter/ww8/ww8par5.cxx @@ -82,6 +82,7 @@ #include "ww8par2.hxx" #include "writerhelper.hxx" #include "fields.hxx" +#include <o3tl/safeint.hxx> #include <unotools/fltrcfg.hxx> #include <xmloff/odffields.hxx> @@ -1895,8 +1896,12 @@ eF_ResT SwWW8ImplReader::Read_F_Symbol( WW8FieldDesc*, OUString& rStr ) if ( aReadParam.GoToTokenParam() ) { const OUString aSiz = aReadParam.GetResult(); - if ( !aSiz.isEmpty() ) - nSize = aSiz.toInt32() * 20; // pT -> twip + if (!aSiz.isEmpty()) + { + bool bFail = o3tl::checked_multiply<sal_Int32>(aSiz.toInt32(), 20, nSize); // pT -> twip + if (bFail) + nSize = -1; + } } break; } _______________________________________________ Libreoffice-commits mailing list libreoffice-comm...@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits