From 90248dca6bbe4a33f3d91a3cd5d7bd7d904ef8ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
Date: Sun, 1 Dec 2024 16:08:57 +0000
Subject: [PATCH] cid#1608083 Overflowed constant
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I1aaa2ca5711b932676621ee37b00fd0683593214
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/177619
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
---
 filter/source/msfilter/svdfppt.cxx | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index 676f66b57cef..bea4a2aec8e5 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -4857,7 +4857,14 @@ void PPTStyleTextPropReader::ReadParaProps(SvStream& rIn, const DffRecordHeader&
                 std::min(sal_uInt16(8),
                     aParaPropSet.mxParaSet->mnDepth);
 
-            nCharCount--;
+            if (nCharCount > 0)
+                --nCharCount;
+            else
+            {
+                SAL_WARN("filter.ms", "Suspicious 0 CharCount");
+                // will clip to legal length in later check in this loop
+                nCharCount = std::numeric_limits<sal_uInt32>::max();
+            }
 
             rIn.ReadUInt32( nMask );
             aSet.mnAttrSet = nMask & 0x207df7;