diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-14 15:13:01 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-14 17:09:24 +0100 |
| commit | da859a7949238e74e5287f1bacc61886b4294858 (patch) | |
| tree | 1e45cfad2d389da5859b4e98f1ca702c8d0eb8cb /lotuswordpro | |
| parent | e4ebd97a9b5dc3a25a142109d2a0dbe41925e431 (diff) | |
coverity#1242791 Untrusted loop bound
Change-Id: Iba6d6b77fe30e11f50e16c1ee899b71ea4337355
Diffstat (limited to 'lotuswordpro')
| -rw-r--r-- | lotuswordpro/source/filter/lwpdrawobj.cxx | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index f357f9d359ae..4ae627918441 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -591,7 +591,10 @@ void LwpDrawPolygon::Read() this->ReadClosedObjStyle(); m_pStream->ReadUInt16( m_nNumPoints ); - m_pVector = new SdwPoint [m_nNumPoints]; + if (m_nNumPoints > m_pStream->remainingSize() / 4) + throw BadRead(); + + m_pVector = new SdwPoint[m_nNumPoints]; for (sal_uInt16 nC = 0; nC < m_nNumPoints; nC++) { |