From 91a3976aa88039d48b71242c8b8d01341d154b09 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Mon, 26 Jan 2015 09:10:08 +0000
Subject: coverity#1266495 Untrusted loop bound

Change-Id: Ia96b29f291cf4dc97d2a4998850d641f16cb2a01
---
 filter/source/msfilter/svdfppt.cxx | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'filter/source')

diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx
index ab1731d3f389..fab6c672b636 100644
--- a/filter/source/msfilter/svdfppt.cxx
+++ b/filter/source/msfilter/svdfppt.cxx
@@ -4927,6 +4927,14 @@ void PPTStyleTextPropReader::ReadParaProps( SvStream& rIn, SdrPowerPointImport&
             {
                 sal_uInt16 i, nDistance, nAlignment, nNumberOfTabStops = 0;
                 rIn.ReadUInt16( nNumberOfTabStops );
+                const size_t nMinRecordSize = 4;
+                const size_t nMaxRecords = rIn.remainingSize() / nMinRecordSize;
+                if (nNumberOfTabStops > nMaxRecords)
+                {
+                    SAL_WARN("filter.ms", "Parsing error: " << nMaxRecords <<
+                             " max possible entries, but " << nNumberOfTabStops << " claimed, truncating");
+                    nNumberOfTabStops = nMaxRecords;
+                }
                 for ( i = 0; i < nNumberOfTabStops; i++ )
                 {
                     rIn.ReadUInt16( nDistance )
-- 
cgit