From ec1e5e9573e09ef56cf311fe0531f84c5b75abe4 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Wed, 15 Nov 2017 20:53:35 +0000
Subject: ofz#4230 Integer-overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: If7c7591780fe7fa8d6fde3d17b606a4ab0acbf56
Reviewed-on: https://gerrit.libreoffice.org/44794
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 emfio/source/reader/mtftools.cxx | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

(limited to 'emfio')

diff --git a/emfio/source/reader/mtftools.cxx b/emfio/source/reader/mtftools.cxx
index c6bbfa745b9a..24222eb2d0fe 100644
--- a/emfio/source/reader/mtftools.cxx
+++ b/emfio/source/reader/mtftools.cxx
@@ -2072,8 +2072,14 @@ namespace emfio
         }
         else if ( mnMapMode == MM_HIMETRIC )
         {
-            mnWinExtX = mnMillX * 100;
-            mnWinExtY = mnMillY * 100;
+            sal_Int32 nWinExtX, nWinExtY;
+            if (o3tl::checked_multiply<sal_Int32>(mnMillX, 100, nWinExtX) ||
+                o3tl::checked_multiply<sal_Int32>(mnMillY, 100, nWinExtY))
+            {
+                return;
+            }
+            mnWinExtX = nWinExtX;
+            mnWinExtY = nWinExtY;
         }
     }
 
-- 
cgit