diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-01-26 09:10:08 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-01-26 12:14:33 +0000 |
| commit | 91a3976aa88039d48b71242c8b8d01341d154b09 (patch) | |
| tree | b6286f7a4c3629284abcc3bf0d9638e120dd9834 /filter | |
| parent | c106f83da16726506962e19bcbc3d4c25415b81a (diff) | |
coverity#1266495 Untrusted loop bound
Change-Id: Ia96b29f291cf4dc97d2a4998850d641f16cb2a01
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/msfilter/svdfppt.cxx | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/filter/source/msfilter/svdfppt.cxx b/filter/source/msfilter/svdfppt.cxx index ab1731d3f389..fab6c672b636 100644 --- a/filter/source/msfilter/svdfppt.cxx +++ b/filter/source/msfilter/svdfppt.cxx @@ -4927,6 +4927,14 @@ void PPTStyleTextPropReader::ReadParaProps( SvStream& rIn, SdrPowerPointImport& { sal_uInt16 i, nDistance, nAlignment, nNumberOfTabStops = 0; rIn.ReadUInt16( nNumberOfTabStops ); + const size_t nMinRecordSize = 4; + const size_t nMaxRecords = rIn.remainingSize() / nMinRecordSize; + if (nNumberOfTabStops > nMaxRecords) + { + SAL_WARN("filter.ms", "Parsing error: " << nMaxRecords << + " max possible entries, but " << nNumberOfTabStops << " claimed, truncating"); + nNumberOfTabStops = nMaxRecords; + } for ( i = 0; i < nNumberOfTabStops; i++ ) { rIn.ReadUInt16( nDistance ) |