diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-17 10:03:32 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-17 15:19:56 +0100 |
| commit | bbe264a19fb82f50d859fc72a47312db0527640f (patch) | |
| tree | 784b4eb74df0ceba7d7423378ce02f349c28b046 | |
| parent | be31503ef86d2ad3291ced8fddb9c4da4d324c46 (diff) | |
coverity#1242724 Untrusted value as argument
Change-Id: I6041d09ef0a4ed4af5f1bf93f31a1eac60be1af7
| -rw-r--r-- | filter/source/msfilter/msdffimp.cxx | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx index fe6538664eff..fdb4898384b5 100644 --- a/filter/source/msfilter/msdffimp.cxx +++ b/filter/source/msfilter/msdffimp.cxx @@ -5318,19 +5318,24 @@ SdrObject* SvxMSDffManager::ProcessObj(SvStream& rSt, { delete pTextImpRec->pWrapPolygon; pTextImpRec->pWrapPolygon = NULL; - sal_uInt16 nNumElemVert, nNumElemMemVert, nElemSizeVert; + sal_uInt16 nNumElemVert(0), nNumElemMemVert(0), nElemSizeVert(0); rSt.ReadUInt16( nNumElemVert ).ReadUInt16( nNumElemMemVert ).ReadUInt16( nElemSizeVert ); + bool bOk = false; if (nNumElemVert && ((nElemSizeVert == 8) || (nElemSizeVert == 4))) { + bOk = rSt.remainingSize() / nElemSizeVert >= nNumElemVert; + } + if (bOk) + { pTextImpRec->pWrapPolygon = new Polygon(nNumElemVert); for (sal_uInt16 i = 0; i < nNumElemVert; ++i) { - sal_Int32 nX, nY; + sal_Int32 nX(0), nY(0); if (nElemSizeVert == 8) rSt.ReadInt32( nX ).ReadInt32( nY ); else { - sal_Int16 nSmallX, nSmallY; + sal_Int16 nSmallX(0), nSmallY(0); rSt.ReadInt16( nSmallX ).ReadInt16( nSmallY ); nX = nSmallX; nY = nSmallY; |