sw/source/filter/ww8/docxsdrexport.cxx |    7 +++++++
 1 file changed, 7 insertions(+)

New commits:
commit 8f9ae7d4f0e443ce79491d725e0d40844d4b11f8
Author:     Justin Luth <[email protected]>
AuthorDate: Tue Jan 20 10:32:27 2026 -0500
Commit:     Miklos Vajna <[email protected]>
CommitDate: Wed Jan 21 10:03:59 2026 +0100

    mso-test tdf#121923 docx export: max effectExtent value is SAL_MAX_INT32
    
    The problem being fixed is that when LO round-tripped tdf121923-2.docx,
    MS Word was reporting that it was corrupt.
    
    Although the spec says
    <xsd:simpleType name="ST_CoordinateUnqualified">
      <xsd:restriction base="xsd:long">
        <xsd:minInclusive value="-27273042329600"/>
        <xsd:maxInclusive value="27273042316900"/>
    in the real world an effectExtent value outside of a 32bit integer
    causes MS Word to complain that the document is corrupt.
    
    Other places in the code suggest that effectExtent cannot be negative,
    but even if that is true, at least a negative 32bit value
    does not result in a supposedly corrupt file.
    
    I don't see any value in creating a unit test for this.
    It would be pretty hard/intentional to "break" this.
    
    Change-Id: I5cb0e2c1c090f0e0088ec1d1593e489ea3a0b9c1
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/197677
    Reviewed-by: Justin Luth <[email protected]>
    Tested-by: Jenkins
    (cherry picked from commit 009a065df4f43d57f573fc38f7c11e56656b0e1b)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/197690
    Reviewed-by: Miklos Vajna <[email protected]>
    Tested-by: Jenkins CollaboraOffice <[email protected]>

diff --git a/sw/source/filter/ww8/docxsdrexport.cxx 
b/sw/source/filter/ww8/docxsdrexport.cxx
index 5482d2f5150c..ac419fbf8666 100644
--- a/sw/source/filter/ww8/docxsdrexport.cxx
+++ b/sw/source/filter/ww8/docxsdrexport.cxx
@@ -1192,6 +1192,13 @@ void DocxSdrExport::startDMLAnchorInline(const 
SwFrameFormat* pFrameFormat, cons
             }
         }
     }
+    // Although the spec allows some randomly larger 27273042316900,
+    // MS Word reports a document as corrupt if the effectExtent > 
SAL_MAX_INT32 or < SAL_MIN_INT32
+    nLeftExtEMU = std::clamp<sal_Int64>(nLeftExtEMU, SAL_MIN_INT32, 
SAL_MAX_INT32);
+    nTopExtEMU = std::clamp<sal_Int64>(nTopExtEMU, SAL_MIN_INT32, 
SAL_MAX_INT32);
+    nRightExtEMU = std::clamp<sal_Int64>(nRightExtEMU, SAL_MIN_INT32, 
SAL_MAX_INT32);
+    nBottomExtEMU = std::clamp<sal_Int64>(nBottomExtEMU, SAL_MIN_INT32, 
SAL_MAX_INT32);
+
     m_pImpl->getSerializer()->singleElementNS(
         XML_wp, XML_effectExtent, XML_l, OString::number(nLeftExtEMU), XML_t,
         OString::number(nTopExtEMU), XML_r, OString::number(nRightExtEMU), 
XML_b,

Reply via email to