diff options
author | Caolán McNamara <caolanm@redhat.com> | 2015-02-04 10:16:37 +0000 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2015-02-04 11:11:00 +0000 |
commit | 9327373a02f498b13f2c0da1c7dc37b6de1005e6 (patch) | |
tree | dba4aef911b371a1030a59f62c2580cca5096a33 | |
parent | coverity#1266450 Explicit null dereferenced (diff) | |
download | core-9327373a02f498b13f2c0da1c7dc37b6de1005e6.tar.gz core-9327373a02f498b13f2c0da1c7dc37b6de1005e6.zip |
coverity#1242624 Untrusted loop bound
Change-Id: I277e98156c9a9832d1f5e968e590356d14b91af6
-rw-r--r-- | filter/source/msfilter/msdffimp.cxx | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx index 656c93fe6243..3e60db1431ff 100644 --- a/filter/source/msfilter/msdffimp.cxx +++ b/filter/source/msfilter/msdffimp.cxx @@ -2203,6 +2203,12 @@ void DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt sal_uInt16 nElemSizeSeg = 2; rIn.ReadUInt16( nNumElemSeg ).ReadUInt16( nNumElemMemSeg ).ReadUInt16( nElemSizeSeg ); } + sal_Size nMaxEntriesPossible = rIn.remainingSize() / sizeof(sal_uInt16); + if (nNumElemSeg > nMaxEntriesPossible) + { + SAL_WARN("filter.ms", "NumElem list is longer than remaining bytes, ppt or parser is wrong"); + nNumElemSeg = nMaxEntriesPossible; + } if ( nNumElemSeg ) { sal_Int16 nCommand; |