From cc32ab7342efa3043eb373cd9e33331978ca3f2f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= Date: Wed, 15 Apr 2026 21:00:10 +0100 Subject: [PATCH] ofz#496349582 Integer-overflow Change-Id: I537f96838f402f20b537440a5cf94967814a64ce Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/1052 Tested-by: Jenkins CPCI Reviewed-by: Mike Kaganski (cherry picked from commit 4c4f052a5f3700c332ede70bc71dda3529266ba5) Reviewed-on: https://gerrit.libreoffice.org/c/core/+/204398 Reviewed-by: Xisco Fauli Tested-by: Jenkins --- emfio/source/reader/wmfreader.cxx | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/emfio/source/reader/wmfreader.cxx b/emfio/source/reader/wmfreader.cxx index 4ba63d53172d..7db073c3b61f 100644 --- a/emfio/source/reader/wmfreader.cxx +++ b/emfio/source/reader/wmfreader.cxx @@ -1490,6 +1490,8 @@ namespace emfio // inch mpInputStream->ReadUInt16( mnUnitsPerInch ); + SAL_WARN_IF(!mnUnitsPerInch, "emfio", "Invalid WMF: mnUnitsPerInch is 0"); + // reserved mpInputStream->SeekRel( 4 ); @@ -1556,7 +1558,7 @@ namespace emfio SAL_INFO("emfio", "WMF size w: " << aWMFSize.Width() << " h: " << aWMFSize.Height()); Size aDevExt( 10000, 10000 ); - if( ( std::abs( aWMFSize.Width() ) > 1 ) && ( std::abs( aWMFSize.Height() ) > 1 ) ) + if( ( std::abs( aWMFSize.Width() ) > 1 ) && ( std::abs( aWMFSize.Height() ) > 1 ) && mnUnitsPerInch ) { const double fFrac = 1.0 / mnUnitsPerInch; MapMode aWMFMap( MapUnit::MapInch, Point(), fFrac, fFrac );