ofz#5561 Integer-overflow

Change-Id: I57660848190efff8e6354670eb68b60ed57f0094
Reviewed-on: https://gerrit.libreoffice.org/48308Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

sw/source/filter/ww8/ww8scan.cxx

@@ -1464,7 +1464,17 @@ WW8_CP WW8ScannerBase::WW8Fc2Cp( WW8_FC nFcPos ) const
             {
                 bIsUnicode = m_pWw8Fib->m_fExtChar;
             }
-            sal_Int32 nLen = (nCpEnd - nCpStart) * (bIsUnicode ? 2 : 1);
+
+            sal_Int32 nLen = nCpEnd - nCpStart;
+            if (bIsUnicode)
+            {
+                bool bFail = o3tl::checked_multiply<WW8_CP>(nLen, 2, nLen);
+                if (bFail)
+                {
+                    SAL_WARN("sw.ww8", "broken offset, ignoring");
+                    return WW8_CP_MAX;
+                }
+            }
 
             /*
             If this cp is inside this piece, or it's the last piece and we are