diff options
author | Caolán McNamara <caolanm@redhat.com> | 2018-01-07 20:27:27 +0000 |
---|---|---|
committer | Caolán McNamara <caolanm@redhat.com> | 2018-01-07 20:27:27 +0000 |
commit | 0a3380ae54e9c33aa4773c6d9878b99b9636dabf (patch) | |
tree | 9a848378625b66efedceae1a3dee08522fe049c2 /filter | |
parent | ofz#5007 Null-dereference READ (diff) | |
download | core-0a3380ae54e9c33aa4773c6d9878b99b9636dabf.tar.gz core-0a3380ae54e9c33aa4773c6d9878b99b9636dabf.zip |
ofz: fail early
Change-Id: I86790efea5ad4a12578477301959704fb09d67b6
Diffstat (limited to 'filter')
-rw-r--r-- | filter/source/graphicfilter/ios2met/ios2met.cxx | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx index b737ac664d14..faf82a7569ed 100644 --- a/filter/source/graphicfilter/ios2met/ios2met.cxx +++ b/filter/source/graphicfilter/ios2met/ios2met.cxx @@ -887,6 +887,8 @@ void OS2METReader::ReadRelLine(bool bGivenPos, sal_uInt16 nOrderLen) if (bCoord32) nOrderLen-=8; else nOrderLen-=4; } else aP0=aAttr.aCurPos; + if (nOrderLen > pOS2MET->remainingSize()) + throw css::uno::Exception("attempt to read past end of input", nullptr); nPolySize=nOrderLen/2; if (nPolySize==0) return; tools::Polygon aPolygon(nPolySize); |