oox/source/export/drawingml.cxx | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
New commits: commit f5f9ab2ae10e05e07330cee765baa949a619e294 Author: Justin Luth <[email protected]> AuthorDate: Tue Feb 17 13:50:57 2026 -0500 Commit: Xisco Fauli <[email protected]> CommitDate: Wed Feb 18 22:56:02 2026 +0100 tdf#169487 tdf#169705: docx export: invalid values in a:chExt / a:off MS Office is not accepting values greater than 2147483647 for 'x' and 'y' attributes inside a:off, or 'cx' and 'cy' attributes inside 'a:chExt' MSO was reporting those documents as corrupt. Specifically, attachment 72701 from bug 59153 'WAD-Lab Manual.docx' aka fdo59153-1.docx Change-Id: I67dd47781098b0dfe9d12f75f591138d0e80c2f8 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/199569 Reviewed-by: Justin Luth <[email protected]> Tested-by: Jenkins (cherry picked from commit 55507043004d55816cdc238733a9f5c7a2240f2d) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/199582 Reviewed-by: Xisco Fauli <[email protected]> diff --git a/oox/source/export/drawingml.cxx b/oox/source/export/drawingml.cxx index d46d02daf35a..84df3b895aa1 100644 --- a/oox/source/export/drawingml.cxx +++ b/oox/source/export/drawingml.cxx @@ -2286,12 +2286,12 @@ void DrawingML::WriteTransformation(const Reference< XShape >& xShape, const too if (bIsGroupShape && (GetDocumentType() != DOCUMENT_DOCX || IsTopGroupObj(xShape))) { - mpFS->singleElementNS(XML_a, XML_chOff, - XML_x, OString::number(oox::drawingml::convertHmmToEmu(nChildLeft)), - XML_y, OString::number(oox::drawingml::convertHmmToEmu(nChildTop))); - mpFS->singleElementNS(XML_a, XML_chExt, - XML_cx, OString::number(oox::drawingml::convertHmmToEmu(rRect.GetWidth())), - XML_cy, OString::number(oox::drawingml::convertHmmToEmu(rRect.GetHeight()))); + nX = std::min(oox::drawingml::convertHmmToEmu(nChildLeft), MAX_SIZE); + nY = std::min(oox::drawingml::convertHmmToEmu(nChildTop), MAX_SIZE); + mpFS->singleElementNS( + XML_a, XML_chOff, XML_x, OString::number(nX), XML_y, OString::number(nY)); + mpFS->singleElementNS( + XML_a, XML_chExt, XML_cx, OString::number(nCx), XML_cy, OString::number(nCy)); } mpFS->endElementNS( nXmlNamespace, XML_xfrm );
