diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-12-10 11:50:09 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-12-10 21:02:33 +0100 |
| commit | cd5a4971bb84bb588a990a252a84ed799fe1ebeb (patch) | |
| tree | ab30763b51410ae4dd915bcdb3164ab782b04955 /starmath | |
| parent | ofz#4571 more Direct-leaks (diff) | |
| download | core-cd5a4971bb84bb588a990a252a84ed799fe1ebeb.tar.gz core-cd5a4971bb84bb588a990a252a84ed799fe1ebeb.zip | |
ofz#4578 Integer-overflow
Change-Id: I2fcd530b3217c72385301b8f3456557c8c8cec13
Reviewed-on: https://gerrit.libreoffice.org/46183
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'starmath')
| -rw-r--r-- | starmath/source/mathmlattr.cxx | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/starmath/source/mathmlattr.cxx b/starmath/source/mathmlattr.cxx index f68bc003e4ff..2b0c70335430 100644 --- a/starmath/source/mathmlattr.cxx +++ b/starmath/source/mathmlattr.cxx @@ -62,8 +62,12 @@ sal_Int32 ParseMathMLUnsignedNumber(const OUString &rStr, Fraction *pUN) assert(nDecimalPoint < nIdx); *pUN = Fraction(rStr.copy(0, nDecimalPoint).toInt32(), 1); if (++nDecimalPoint < nIdx) - *pUN += Fraction(rStr.copy(nDecimalPoint, nIdx-nDecimalPoint).toInt32(), - lcl_GetPowerOf10(nIdx-nDecimalPoint)); + { + const sal_Int32 nDigits = nIdx - nDecimalPoint; + if (nDigits > 9) + return -1; + *pUN += Fraction(rStr.copy(nDecimalPoint, nDigits).toInt32(), lcl_GetPowerOf10(nDigits)); + } return nIdx; } |