diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2017-01-17 21:25:28 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2017-01-17 21:25:28 +0000 |
| commit | 2a9b4363ca190f1d783d540e95a031357f852858 (patch) | |
| tree | a7a7266f0837834f7f84aa36cddc94eb18703a8a /filter | |
| parent | 5434d51d12611eb2726ce1394eb01921d008fa89 (diff) | |
ofz#415 crash in DXFVector::DXFVector
Change-Id: Ia8edfebd0b69ed2500e2c3f575d51f40dc8718c0
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/idxf/dxfentrd.cxx | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/filter/source/graphicfilter/idxf/dxfentrd.cxx b/filter/source/graphicfilter/idxf/dxfentrd.cxx index f9a5d97bba26..a3e64f1d9418 100644 --- a/filter/source/graphicfilter/idxf/dxfentrd.cxx +++ b/filter/source/graphicfilter/idxf/dxfentrd.cxx @@ -421,7 +421,8 @@ void DXFLWPolyLineEntity::EvaluateGroup( DXFGroupReader & rDGR ) case 90 : { nCount = rDGR.GetI(); - if ( nCount ) + // limit alloc to max reasonable size based on remaining data in stream + if (nCount > 0 && static_cast<sal_uInt32>(nCount) <= rDGR.remainingSize()) pP.reset( new DXFVector[ nCount ] ); } break; |