diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-17 10:01:45 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-17 15:19:55 +0100 |
| commit | be31503ef86d2ad3291ced8fddb9c4da4d324c46 (patch) | |
| tree | d483e562104989fff02eb29f1b30a3afe7880469 | |
| parent | b520fca88d29bb130115224317bf6b627b5a7c54 (diff) | |
coverity#1242778 Untrusted value as argument
Change-Id: I34d5a5e7c5f0eef51d941c65ab73d5421d5a36cb
| -rw-r--r-- | sw/source/filter/ww8/ww8par.cxx | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/sw/source/filter/ww8/ww8par.cxx b/sw/source/filter/ww8/ww8par.cxx index 555aa16c42bc..c162f75cfed1 100644 --- a/sw/source/filter/ww8/ww8par.cxx +++ b/sw/source/filter/ww8/ww8par.cxx @@ -1043,19 +1043,26 @@ SdrObject* SwMSDffManager::ProcessObj(SvStream& rSt, delete pImpRec->pWrapPolygon; pImpRec->pWrapPolygon = NULL; - sal_uInt16 nNumElemVert, nNumElemMemVert, nElemSizeVert; + sal_uInt16 nNumElemVert(0), nNumElemMemVert(0), nElemSizeVert(0); rSt.ReadUInt16( nNumElemVert ).ReadUInt16( nNumElemMemVert ).ReadUInt16( nElemSizeVert ); + bool bOk = false; if (nNumElemVert && ((nElemSizeVert == 8) || (nElemSizeVert == 4))) { + //check if there is enough data in the file to make the + //record sane + bOk = rSt.remainingSize() / nElemSizeVert >= nNumElemVert; + } + if (bOk) + { pImpRec->pWrapPolygon = new Polygon(nNumElemVert); for (sal_uInt16 i = 0; i < nNumElemVert; ++i) { - sal_Int32 nX, nY; + sal_Int32 nX(0), nY(0); if (nElemSizeVert == 8) rSt.ReadInt32( nX ).ReadInt32( nY ); else { - sal_Int16 nSmallX, nSmallY; + sal_Int16 nSmallX(0), nSmallY(0); rSt.ReadInt16( nSmallX ).ReadInt16( nSmallY ); nX = nSmallX; nY = nSmallY; |