vcl/source/outdev/hatch.cxx | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-)
New commits: commit b03f8414a0504fe7a25fb4fb6e6950320a654a39 Author: Caolán McNamara <[email protected]> AuthorDate: Tue May 17 16:58:19 2022 +0100 Commit: Caolán McNamara <[email protected]> CommitDate: Tue May 17 20:50:46 2022 +0200 ofz: Avoid Integer-overflow Change-Id: Ic61403673b09a148f69aa582b1799e01564f84e3 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/134487 Tested-by: Jenkins Reviewed-by: Caolán McNamara <[email protected]> diff --git a/vcl/source/outdev/hatch.cxx b/vcl/source/outdev/hatch.cxx index c85febe3a38f..39c4e124ad38 100644 --- a/vcl/source/outdev/hatch.cxx +++ b/vcl/source/outdev/hatch.cxx @@ -165,8 +165,24 @@ void OutputDevice::DrawHatch( const tools::PolyPolygon& rPolyPoly, const Hatch& { if (utl::ConfigManager::IsFuzzing()) { - tools::Long nVertSteps = aInc.Height() ? ((aEndPt1.Y() - aPt1.Y()) / aInc.Height()) : -1; - tools::Long nHorzSteps = aInc.Width() ? ((aEndPt1.X() - aPt1.X()) / aInc.Width()) : -1; + tools::Long nVertSteps = -1; + if (aInc.Height()) + { + bool bFail = o3tl::checked_sub(aEndPt1.Y(), aPt1.Y(), nVertSteps); + if (bFail) + nVertSteps = std::numeric_limits<tools::Long>::max(); + else + nVertSteps = nVertSteps / aInc.Height(); + } + tools::Long nHorzSteps = -1; + if (aInc.Width()) + { + bool bFail = o3tl::checked_sub(aEndPt1.X(), aPt1.X(), nHorzSteps); + if (bFail) + nHorzSteps = std::numeric_limits<tools::Long>::max(); + else + nHorzSteps = nHorzSteps / aInc.Width(); + } auto nSteps = std::max(nVertSteps, nHorzSteps); if (nSteps > 1024) {
