sw/source/filter/html/svxcss1.cxx |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

New commits:
commit ea2184d3dcd018e41e4448727b674976e116d1ef
Author:     Stephan Bergmann <sberg...@redhat.com>
AuthorDate: Wed Mar 30 18:04:36 2022 +0200
Commit:     Stephan Bergmann <sberg...@redhat.com>
CommitDate: Wed Mar 30 20:25:31 2022 +0200

    Avoid float-cast-overflow
    
    > sw/source/filter/html/parcss1.hxx:163:35: runtime error: -1.0458e+22 is 
outside the range of representable values of type 'int'
    >  #0 in CSS1Expression::GetSLength() const at 
sw/source/filter/html/parcss1.hxx:163:35
    >  #1 in ParseCSS1_text_indent(CSS1Expression const*, SfxItemSet&, 
SvxCSS1PropertyInfo&, SvxCSS1Parser const&) at 
sw/source/filter/html/svxcss1.cxx:1955:45
    
    during recently introduced testForcepoint94::TestBody in
    CppunitTest_sw_layoutwriter, where 
sw/qa/extras/layout/data/forcepoint94.html
    contains "text-indent: -18446744073709551616.0cm"
    
    Change-Id: I1070f07ea0304a3813ab9a58441c9d7e45f79ffd
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/132322
    Tested-by: Jenkins
    Reviewed-by: Stephan Bergmann <sberg...@redhat.com>

diff --git a/sw/source/filter/html/svxcss1.cxx 
b/sw/source/filter/html/svxcss1.cxx
index ee46ff297821..7edbfbb7bf10 100644
--- a/sw/source/filter/html/svxcss1.cxx
+++ b/sw/source/filter/html/svxcss1.cxx
@@ -21,6 +21,7 @@
 
 #include <algorithm>
 #include <cmath>
+#include <limits>
 #include <memory>
 #include <stdlib.h>
 
@@ -1952,8 +1953,17 @@ static void ParseCSS1_text_indent( const CSS1Expression 
*pExpr,
     switch( pExpr->GetType() )
     {
     case CSS1_LENGTH:
-        nIndent = static_cast<short>(pExpr->GetSLength());
-        bSet = true;
+        {
+            double n = std::round(pExpr->GetNumber());
+            SAL_WARN_IF(
+                n < std::numeric_limits<short>::min() || n > 
std::numeric_limits<short>::max(),
+                "sw.html", "clamping length " << n << " to short range");
+            nIndent = static_cast<short>(
+                std::clamp(
+                    n, double(std::numeric_limits<short>::min()),
+                    double(std::numeric_limits<short>::max())));
+            bSet = true;
+        }
         break;
     case CSS1_PIXLENGTH:
         {

Reply via email to