ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

ofz#563849779 Integer-overflow

Browse Source 
writerfilter::rtftok::RTFDocumentImpl::dispatchValue
 writerfilter::rtftok::RTFDocumentImpl::dispatchValue
 writerfilter::rtftok::RTFTokenizer::dispatchKeyword

\brdrw2147483647 overflowed int converting twips to 1/8 pt

Signed-off-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Change-Id: I150e3d0227e8fd4d6f1125d0c27078f43f1f0f9d
Reviewed-on: https://gerrit.collaboraoffice.com/c/online/+/13414
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Reviewed-by: Noel Grandin <noel.grandin@collabora.com>
(cherry picked from commit 68c853c46592d3ac4c79d8dede0dd88b5a080b3e)
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/211526
Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
Tested-by: Jenkins
This commit is contained in:
Caolán McNamara
2026-09-28 22:04:12 +02:00
committed by Xisco Fauli
parent b46c38a45d
commit 5208370de8
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sw/source/writerfilter/rtftok/rtfdispatchvalue.cxx
+1 -1
View File
@@ -1022,7 +1022,7 @@ RTFError RTFDocumentImpl::dispatchValue(RTFKeyword nKeyword, int nParam)
if (nParam == 2)
nParam = 1;
else if (nParam > 1)
nParam = nParam * 2 / 5;
nParam = sal_Int64(nParam) * 2 / 5;
auto pValue = new RTFValue(nParam);
putBorderProperty(m_aStates, NS_ooxml::LN_CT_Border_sz, pValue);
}