From f69e2f739ca3c23c9de055c8600c867e864cd4ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
Date: Thu, 18 Jan 2018 21:28:02 +0000
Subject: [PATCH] ofz#5475 Integer-overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I11d706c544698d57b75231e33e3d49f1ac1d4d73
Reviewed-on: https://gerrit.libreoffice.org/48159
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
---
 emfio/source/reader/mtftools.cxx |  5 ++++-
 include/tools/gen.hxx            |  4 ++++
 starmath/source/mathmlimport.cxx |  4 ++--
 tools/source/generic/gen.cxx     | 19 ++++++++++++++++++-
 4 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/emfio/source/reader/mtftools.cxx b/emfio/source/reader/mtftools.cxx
index e3bbb5f6c4b8..44316fd29d0f 100644
--- a/emfio/source/reader/mtftools.cxx
+++ b/emfio/source/reader/mtftools.cxx
@@ -497,7 +497,10 @@ namespace emfio
 
     tools::Rectangle MtfTools::ImplMap( const tools::Rectangle& rRect )
     {
-        return tools::Rectangle( ImplMap( rRect.TopLeft() ), ImplMap( rRect.GetSize() ) );
+        tools::Rectangle aRect;
+        aRect.SetPos(ImplMap(rRect.TopLeft()));
+        aRect.SaturatingSetSize(ImplMap(rRect.GetSize()));
+        return aRect;
     }
 
     void MtfTools::ImplMap( vcl::Font& rFont )
diff --git a/include/tools/gen.hxx b/include/tools/gen.hxx
index 1f72a32078bb..a10b74e03b0b 100644
--- a/include/tools/gen.hxx
+++ b/include/tools/gen.hxx
@@ -430,6 +430,10 @@ public:
     inline void expand(long nExpandBy);
     inline void shrink(long nShrinkBy);
 
+    /**
+     * Sanitizing variants for handling data from the outside
+     */
+    void                SaturatingSetSize(const Size& rSize);
 private:
     long                nLeft;
     long                nTop;
diff --git a/starmath/source/mathmlimport.cxx b/starmath/source/mathmlimport.cxx
index bf2caa0a8458..032feb61a260 100644
--- a/starmath/source/mathmlimport.cxx
+++ b/starmath/source/mathmlimport.cxx
@@ -3062,14 +3062,14 @@ void SmXMLImport::SetViewSettings(const Sequence<PropertyValue>& aViewProps)
             pValue->Value >>= nTmp;
             Size aSize( aRect.GetSize() );
             aSize.Width() = nTmp;
-            aRect.SetSize( aSize );
+            aRect.SaturatingSetSize(aSize);
         }
         else if (pValue->Name == "ViewAreaHeight" )
         {
             pValue->Value >>= nTmp;
             Size aSize( aRect.GetSize() );
             aSize.Height() = nTmp;
-            aRect.SetSize( aSize );
+            aRect.SaturatingSetSize(aSize);
         }
         pValue++;
     }
diff --git a/tools/source/generic/gen.cxx b/tools/source/generic/gen.cxx
index 2627d9202842..5fe6eeeaa3d6 100644
--- a/tools/source/generic/gen.cxx
+++ b/tools/source/generic/gen.cxx
@@ -20,7 +20,7 @@
 #include <sal/config.h>
 
 #include <sstream>
-
+#include <o3tl/safeint.hxx>
 #include <tools/gen.hxx>
 #include <tools/stream.hxx>
 
@@ -68,6 +68,23 @@ void tools::Rectangle::SetSize( const Size& rSize )
         nBottom = RECT_EMPTY;
 }
 
+void tools::Rectangle::SaturatingSetSize(const Size& rSize)
+{
+    if (rSize.Width() < 0)
+        nRight = o3tl::saturating_add(nLeft, (rSize.Width() + 1));
+    else if ( rSize.Width() > 0 )
+        nRight = o3tl::saturating_add(nLeft, (rSize.Width() - 1));
+    else
+        nRight = RECT_EMPTY;
+
+    if ( rSize.Height() < 0 )
+        nBottom = o3tl::saturating_add(nTop, (rSize.Height() + 1));
+    else if ( rSize.Height() > 0 )
+        nBottom = o3tl::saturating_add(nTop, (rSize.Height() - 1));
+    else
+        nBottom = RECT_EMPTY;
+}
+
 tools::Rectangle& tools::Rectangle::Union( const tools::Rectangle& rRect )
 {
     if ( rRect.IsEmpty() )