diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-08-23 12:52:52 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-08-23 16:57:37 +0100 |
| commit | de26ef857bf3b39a02192289a374605ca9491721 (patch) | |
| tree | 1c411347a877e2d4938c4e0020b96fe5b90f2a63 /basic | |
| parent | ca09871bc0c2672370d23c66148afe25006962f8 (diff) | |
coverity#1242865 Untrusted loop bound
Change-Id: I9c6f821f7bd1e9bd3eb8f47e269e62a792523f1a
Diffstat (limited to 'basic')
| -rw-r--r-- | basic/source/classes/image.cxx | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/basic/source/classes/image.cxx b/basic/source/classes/image.cxx index ef468dc2e5a1..703dbd41b7e1 100644 --- a/basic/source/classes/image.cxx +++ b/basic/source/classes/image.cxx @@ -241,6 +241,17 @@ bool SbiImage::Load( SvStream& r, sal_uInt32& nVersion ) break; } case B_SBXOBJECTS: + { + //assuming an empty string with just the lead 32bit/16bit len indicator + const size_t nMinStringSize = (eCharSet == RTL_TEXTENCODING_UNICODE) ? 4 : 2; + const size_t nMinRecordSize = nMinStringSize + sizeof(sal_Int16); + const size_t nMaxRecords = r.remainingSize() / nMinRecordSize; + if (nCount > nMinRecordSize) + { + SAL_WARN("basic", "Parsing error: " << nMaxRecords << + " max possible entries, but " << nCount << " claimed, truncating"); + nCount = nMaxRecords; + } // User defined types for (sal_uInt16 i = 0; i < nCount; i++) @@ -319,9 +330,8 @@ bool SbiImage::Load( SvStream& r, sal_uInt32& nVersion ) AddType(pType); } - break; - + } case B_MODEND: goto done; default: |