diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-05-09 11:38:16 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-05-09 11:39:03 +0100 |
| commit | b43ad2e67550a3c085e080dead0c6fad970563f7 (patch) | |
| tree | 4bfd2c67757961e63971aa161b51f14f46530693 | |
| parent | 4e63ff0dcb5c90ad5caf5ab91c3b9bc74e89bc7a (diff) | |
ofz avoid oom
Change-Id: I7d7e249a75fb33ac6a72e941f6b8f92ff8edf25a
| -rw-r--r-- | sw/source/filter/ww8/ww8toolbar.cxx | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/sw/source/filter/ww8/ww8toolbar.cxx b/sw/source/filter/ww8/ww8toolbar.cxx index 61208f586b79..33a4547ae6ba 100644 --- a/sw/source/filter/ww8/ww8toolbar.cxx +++ b/sw/source/filter/ww8/ww8toolbar.cxx @@ -1048,8 +1048,13 @@ bool PlfKme::Read(SvStream &rS) nOffSet = rS.Tell(); Tcg255SubStruct::Read( rS ); rS.ReadInt32( iMac ); - if ( iMac ) + if (iMac > 0) { + //each Kme is 14 bytes in size + size_t nMaxAvailableRecords = rS.remainingSize() / 14; + if (static_cast<sal_uInt32>(iMac) > nMaxAvailableRecords) + return false; + rgkme.reset( new Kme[ iMac ] ); for( sal_Int32 index=0; index<iMac; ++index ) { |