oox/source/export/drawingml.cxx |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

New commits:
commit 55507043004d55816cdc238733a9f5c7a2240f2d
Author:     Justin Luth <[email protected]>
AuthorDate: Tue Feb 17 13:50:57 2026 -0500
Commit:     Justin Luth <[email protected]>
CommitDate: Tue Feb 17 22:31:45 2026 +0100

    tdf#169487 tdf#169705: docx export: invalid values in a:chExt / a:off
    
    MS Office is not accepting values greater than 2147483647
    for 'x' and 'y' attributes inside a:off,
    or 'cx' and 'cy' attributes inside 'a:chExt'
    
    MSO was reporting those documents as corrupt.
    Specifically, attachment 72701 from bug 59153
    'WAD-Lab Manual.docx' aka fdo59153-1.docx
    
    Change-Id: I67dd47781098b0dfe9d12f75f591138d0e80c2f8
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/199569
    Reviewed-by: Justin Luth <[email protected]>
    Tested-by: Jenkins

diff --git a/oox/source/export/drawingml.cxx b/oox/source/export/drawingml.cxx
index 837043b948d8..473e1f7b6c45 100644
--- a/oox/source/export/drawingml.cxx
+++ b/oox/source/export/drawingml.cxx
@@ -2294,12 +2294,12 @@ void DrawingML::WriteTransformation(const Reference< 
XShape >& xShape, const too
 
     if (bIsGroupShape && (GetDocumentType() != DOCUMENT_DOCX || 
IsTopGroupObj(xShape)))
     {
-        mpFS->singleElementNS(XML_a, XML_chOff,
-            XML_x, 
OString::number(oox::drawingml::convertHmmToEmu(nChildLeft)),
-            XML_y, 
OString::number(oox::drawingml::convertHmmToEmu(nChildTop)));
-        mpFS->singleElementNS(XML_a, XML_chExt,
-            XML_cx, 
OString::number(oox::drawingml::convertHmmToEmu(rRect.GetWidth())),
-            XML_cy, 
OString::number(oox::drawingml::convertHmmToEmu(rRect.GetHeight())));
+        nX = std::min(oox::drawingml::convertHmmToEmu(nChildLeft), MAX_SIZE);
+        nY = std::min(oox::drawingml::convertHmmToEmu(nChildTop), MAX_SIZE);
+        mpFS->singleElementNS(
+            XML_a, XML_chOff, XML_x, OString::number(nX), XML_y, 
OString::number(nY));
+        mpFS->singleElementNS(
+            XML_a, XML_chExt, XML_cx, OString::number(nCx), XML_cy, 
OString::number(nCy));
     }
 
     mpFS->endElementNS( nXmlNamespace, XML_xfrm );

Reply via email to