coverity#1242794 Untrusted loop bound

Change-Id: I902a5bf989a8f385994a2f927cce4975b18f06d2

1 files changed, 10 insertions, 2 deletions

diff --git a/basic/source/classes/sb.cxx b/basic/source/classes/sb.cxx
index 5a88c3d3450a..8c2155e610b4 100644
--- a/basic/source/classes/sb.cxx
+++ b/basic/source/classes/sb.cxx
@@ -1895,10 +1895,18 @@ bool StarBASIC::LoadData( SvStream& r, sal_uInt16 nVer )
     }
     ppDeleteTab.reset();
 
-    sal_uInt16 nMod;
+    sal_uInt16 nMod(0);
     pModules->Clear();
     r.ReadUInt16( nMod );
-    for( sal_uInt16 i = 0; i < nMod; i++ )
+    const size_t nMinSbxSize(14);
+    const size_t nMaxPossibleEntries = r.remainingSize() / nMinSbxSize;
+    if (nMod > nMaxPossibleEntries)
+    {
+        nMod = nMaxPossibleEntries;
+        SAL_WARN("basic", "Parsing error: " << nMaxPossibleEntries <<
+                 " max possible entries, but " << nMod << " claimed, truncating");
+    }
+    for (sal_uInt16 i = 0; i < nMod; ++i)
     {
         SbxBase* pBase = SbxBase::Load( r );
         SbModule* pMod = dynamic_cast<SbModule*>(pBase);