From 9327373a02f498b13f2c0da1c7dc37b6de1005e6 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Wed, 4 Feb 2015 10:16:37 +0000
Subject: coverity#1242624 Untrusted loop bound

Change-Id: I277e98156c9a9832d1f5e968e590356d14b91af6
---
 filter/source/msfilter/msdffimp.cxx | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'filter/source')

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index 656c93fe6243..3e60db1431ff 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -2203,6 +2203,12 @@ void DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
                 sal_uInt16 nElemSizeSeg = 2;
                 rIn.ReadUInt16( nNumElemSeg ).ReadUInt16( nNumElemMemSeg ).ReadUInt16( nElemSizeSeg );
             }
+            sal_Size nMaxEntriesPossible = rIn.remainingSize() / sizeof(sal_uInt16);
+            if (nNumElemSeg > nMaxEntriesPossible)
+            {
+                SAL_WARN("filter.ms", "NumElem list is longer than remaining bytes, ppt or parser is wrong");
+                nNumElemSeg = nMaxEntriesPossible;
+            }
             if ( nNumElemSeg )
             {
                 sal_Int16 nCommand;
-- 
cgit