diff options
author | Caolán McNamara <caolanm@redhat.com> | 2015-01-26 09:10:08 +0000 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2015-01-26 12:14:33 +0000 |
commit | 91a3976aa88039d48b71242c8b8d01341d154b09 (patch) | |
tree | b6286f7a4c3629284abcc3bf0d9638e120dd9834 /filter/source | |
parent | sal,sd: Windows SDK 8.1 deprecates inet_addr() (diff) | |
download | core-91a3976aa88039d48b71242c8b8d01341d154b09.tar.gz core-91a3976aa88039d48b71242c8b8d01341d154b09.zip |
coverity#1266495 Untrusted loop bound
Change-Id: Ia96b29f291cf4dc97d2a4998850d641f16cb2a01
Diffstat (limited to 'filter/source')
-rw-r--r-- | filter/source/msfilter/svdfppt.cxx | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx index ab1731d3f389..fab6c672b636 100644 --- a/filter/source/msfilter/svdfppt.cxx +++ b/filter/source/msfilter/svdfppt.cxx @@ -4927,6 +4927,14 @@ void PPTStyleTextPropReader::ReadParaProps( SvStream& rIn, SdrPowerPointImport& { sal_uInt16 i, nDistance, nAlignment, nNumberOfTabStops = 0; rIn.ReadUInt16( nNumberOfTabStops ); + const size_t nMinRecordSize = 4; + const size_t nMaxRecords = rIn.remainingSize() / nMinRecordSize; + if (nNumberOfTabStops > nMaxRecords) + { + SAL_WARN("filter.ms", "Parsing error: " << nMaxRecords << + " max possible entries, but " << nNumberOfTabStops << " claimed, truncating"); + nNumberOfTabStops = nMaxRecords; + } for ( i = 0; i < nNumberOfTabStops; i++ ) { rIn.ReadUInt16( nDistance ) |