mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ofz+ubsan

Browse Source 
Change-Id: I03f4bae4dd35eea9b5d3996e0655ca9a2ccd6a5f
Reviewed-on: https://gerrit.libreoffice.org/42944
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
This commit is contained in:
Caolán McNamara
2017-09-29 15:26:59 +01:00
parent 150e93dbb4
commit e8879de7bc
2 changed files with 27 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
emfio/source/reader/emfreader.cxx
View File

@@ -22,6 +22,7 @@
#include <basegfx/matrix/b2dhommatrix.hxx>
#include <vcl/dibtools.hxx>
#include <o3tl/make_unique.hxx>
#include <o3tl/safeint.hxx>
#include <tools/stream.hxx>
#include <memory>
@@ -1590,8 +1591,10 @@ namespace emfio
}
std::unique_ptr<long[]> pDXAry, pDYAry;
sal_Int32 nDxSize = nLen * ((nOptions & ETO_PDY) ? 8 : 4);
if ( offDx && (( nCurPos + offDx + nDxSize ) <= nNextPos ) && nNextPos <= mnEndPos )
sal_Int32 nDxSize;
bool bOverflow = o3tl::checked_multiply<sal_Int32>(nLen, (nOptions & ETO_PDY) ? 8 : 4, nDxSize);
if (!bOverflow && offDx && ((nCurPos + offDx + nDxSize) <= nNextPos ) && nNextPos <= mnEndPos)
{
mpInputStream->Seek( nCurPos + offDx );
pDXAry.reset( new long[aText.getLength()] );

34
emfio/source/reader/mtftools.cxx
View File

@@ -386,16 +386,24 @@ namespace emfio
break;
default :
{
fX2 -= mnWinOrgX;
fY2 -= mnWinOrgY;
fX2 /= mnWinExtX;
fY2 /= mnWinExtY;
fX2 *= mnDevWidth;
fY2 *= mnDevHeight;
fX2 += mnDevOrgX;
fY2 += mnDevOrgY; // fX2, fY2 now in device units
fX2 *= (double)mnMillX * 100.0 / (double)mnPixX;
fY2 *= (double)mnMillY * 100.0 / (double)mnPixY;
if (mnPixX == 0 || mnPixY == 0)
{
SAL_WARN("vcl.emf", "invalid scaling factor");
return Point();
}
else
{
fX2 -= mnWinOrgX;
fY2 -= mnWinOrgY;
fX2 /= mnWinExtX;
fY2 /= mnWinExtY;
fX2 *= mnDevWidth;
fY2 *= mnDevHeight;
fX2 += mnDevOrgX;
fY2 += mnDevOrgY; // fX2, fY2 now in device units
fX2 *= (double)mnMillX * 100.0 / (double)mnPixX;
fY2 *= (double)mnMillY * 100.0 / (double)mnPixY;
}
}
break;
}
@@ -1421,7 +1429,8 @@ namespace emfio
// #i121382# Map DXArray using WorldTransform
const Size aSizeX(ImplMap(Size(nSumX, 0)));
const basegfx::B2DVector aVectorX(aSizeX.Width(), aSizeX.Height());
pDXArry[i] = basegfx::fround(aVectorX.getLength()) * (nSumX >= 0 ? 1 : -1);
pDXArry[i] = basegfx::fround(aVectorX.getLength());
pDXArry[i] *= (nSumX >= 0 ? 1 : -1);
if (pDYArry)
{
@@ -1430,7 +1439,8 @@ namespace emfio
const Size aSizeY(ImplMap(Size(0, nSumY)));
const basegfx::B2DVector aVectorY(aSizeY.Width(), aSizeY.Height());
// Reverse Y
pDYArry[i] = basegfx::fround(aVectorY.getLength()) * (nSumY >= 0 ? -1 : 1);
pDYArry[i] = basegfx::fround(aVectorY.getLength());
pDYArry[i] *= (nSumY >= 0 ? -1 : 1);
}
}
}