[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/gdi/gdimtf.cxx |    4 ++++
 1 file changed, 4 insertions(+)

New commits:
commit a07e91a5a76546863ccf71462446e8d16d07d21b
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Fri Mar 25 11:07:30 2022 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Fri Mar 25 13:18:33 2022 +0100

    ofz#45963 Integer-overflow
    
    Change-Id: I4e402a4803013fe2aee0737e1e021e657554403a
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132110
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/gdi/gdimtf.cxx b/vcl/source/gdi/gdimtf.cxx
index 11950bbe44e7..3fa9ea3d24e3 100644
--- a/vcl/source/gdi/gdimtf.cxx
+++ b/vcl/source/gdi/gdimtf.cxx
@@ -462,6 +462,10 @@ void GDIMetaFile::Play(OutputDevice& rOut, const Point& 
rPos,
     if (aDestSize.Width() <= 0 || aDestSize.Height() <= 0)
         return;
 
+    if (aDestSize.Width() > std::numeric_limits<sal_Int32>::max() ||
+        aDestSize.Height() > std::numeric_limits<sal_Int32>::max())
+        return;
+
     GDIMetaFile* pMtf = rOut.GetConnectMetaFile();
 
     if (ImplPlayWithRenderer(rOut, rPos, rSize))