ofz#4578 Integer-overflow

Change-Id: I2fcd530b3217c72385301b8f3456557c8c8cec13
Reviewed-on: https://gerrit.libreoffice.org/46183Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

starmath/source/mathmlattr.cxx

@@ -62,8 +62,12 @@ sal_Int32 ParseMathMLUnsignedNumber(const OUString &rStr, Fraction *pUN)
     assert(nDecimalPoint < nIdx);
     *pUN = Fraction(rStr.copy(0, nDecimalPoint).toInt32(), 1);
     if (++nDecimalPoint < nIdx)
-        *pUN += Fraction(rStr.copy(nDecimalPoint, nIdx-nDecimalPoint).toInt32(),
-                         lcl_GetPowerOf10(nIdx-nDecimalPoint));
+    {
+        const sal_Int32 nDigits = nIdx - nDecimalPoint;
+        if (nDigits > 9)
+            return -1;
+        *pUN += Fraction(rStr.copy(nDecimalPoint, nDigits).toInt32(), lcl_GetPowerOf10(nDigits));
+    }
     return nIdx;
 }