diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-01-26 10:31:03 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-01-26 12:14:40 +0000 |
| commit | 4223914a61c73b2167881c599f5feab7e1254f76 (patch) | |
| tree | b258eff8be961ba2c34b60f6c23c1fe3c0d7a7c2 | |
| parent | 9cc20c9f0080270aff096f4e7e7aecbb01aa9a5f (diff) | |
coverity#1266486 Untrusted loop bound
Change-Id: I3c2ad66dd181c33073f8393dc81d1f56a80d5a87
| -rw-r--r-- | sw/source/filter/ww8/ww8par3.cxx | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx index b5918c06f9f7..a301046ea74d 100644 --- a/sw/source/filter/ww8/ww8par3.cxx +++ b/sw/source/filter/ww8/ww8par3.cxx @@ -1148,7 +1148,14 @@ WW8ListManager::WW8ListManager(SvStream& rSt_, SwWW8ImplReader& rReader_) return; // 1.1 alle LST einlesen - + const size_t nMinRecordSize = 10 + 2*nMaxLevel; + const size_t nMaxRecords = rSt.remainingSize() / nMinRecordSize; + if (nListCount > nMaxRecords) + { + SAL_WARN("sw.ww8", "Parsing error: " << nMaxRecords << + " max possible entries, but " << nListCount << " claimed, truncating"); + nListCount = nMaxRecords; + } for (sal_uInt16 nList=0; nList < nListCount; ++nList) { if (nRemainingPlcfLst < cbLSTF) |