[Libreoffice-commits] core.git: vcl/source

[Caolán McNamara (via logerrit)]

 vcl/source/gdi/metaact.cxx |   41 ++++++++++++++++++++++-------------------
 1 file changed, 22 insertions(+), 19 deletions(-)

New commits:
commit b49904f92d1df12311330cf7e40163349d0e82e9
Author:     Caolán McNamara <caol...@redhat.com>
AuthorDate: Mon Dec 12 20:25:13 2022 +0000
Commit:     Caolán McNamara <caol...@redhat.com>
CommitDate: Tue Dec 13 08:50:11 2022 +0000

    ofz#54240 Integer-overflow
    
    Change-Id: I78058fa65c496ae537942222cff242943e6114ef
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144010
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <caol...@redhat.com>

diff --git a/vcl/source/gdi/metaact.cxx b/vcl/source/gdi/metaact.cxx
index fc034d2abcd7..88f3da979c88 100644
--- a/vcl/source/gdi/metaact.cxx
+++ b/vcl/source/gdi/metaact.cxx
@@ -570,8 +570,30 @@ MetaTextAction::MetaTextAction( const Point& rPt, OUString 
aStr,
     mnLen       ( nLen )
 {}
 
+static bool AllowY(tools::Long nY)
+{
+    static bool bFuzzing = utl::ConfigManager::IsFuzzing();
+    if (bFuzzing)
+    {
+        if (nY > 0x20000000 || nY < -0x20000000)
+        {
+            SAL_WARN("vcl", "skipping huge y: " << nY);
+            return false;
+        }
+    }
+    return true;
+}
+
+static bool AllowRect(const tools::Rectangle& rRect)
+{
+    return AllowY(rRect.Top()) && AllowY(rRect.Bottom());
+}
+
 void MetaTextAction::Execute( OutputDevice* pOut )
 {
+    if (!AllowY(maPt.Y()))
+        return;
+
     pOut->DrawText( maPt, maStr, mnIndex, mnLen );
 }
 
@@ -736,25 +758,6 @@ MetaTextRectAction::MetaTextRectAction( const 
tools::Rectangle& rRect,
     mnStyle     ( nStyle )
 {}
 
-static bool AllowRect(const tools::Rectangle& rRect)
-{
-    static bool bFuzzing = utl::ConfigManager::IsFuzzing();
-    if (bFuzzing)
-    {
-        if (rRect.Top() > 0x20000000 || rRect.Top() < -0x20000000)
-        {
-            SAL_WARN("vcl", "skipping huge rect top: " << rRect.Top());
-            return false;
-        }
-        if (rRect.Bottom() > 0x20000000 || rRect.Bottom() < -0x20000000)
-        {
-            SAL_WARN("vcl", "skipping huge rect bottom: " << rRect.Bottom());
-            return false;
-        }
-    }
-    return true;
-}
-
 void MetaTextRectAction::Execute( OutputDevice* pOut )
 {
     if (!AllowRect(maRect))