diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-12-15 09:15:36 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-12-15 09:33:09 +0000 |
| commit | 002808e80f67839822a240b3c2a351b57248305a (patch) | |
| tree | 3f6ac8b0eba3ce319afa07fc54acfcbac606c90a /svl | |
| parent | c51500cb9b3fc15d371fb3f65b838ace5f126f3a (diff) | |
coverity#1242875 Untrusted loop bound
Change-Id: I5ba34dca7d9f510981b85a35c056c792159f5f98
Diffstat (limited to 'svl')
| -rw-r--r-- | svl/source/items/poolio.cxx | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/svl/source/items/poolio.cxx b/svl/source/items/poolio.cxx index 1ccba9060d73..c3c97aeb3590 100644 --- a/svl/source/items/poolio.cxx +++ b/svl/source/items/poolio.cxx @@ -580,6 +580,13 @@ SvStream &SfxItemPool::Load(SvStream &rStream) if ( nVerNo >= pImp->aVersions.size() ) { // Add new Version + const size_t nMaxRecords = rStream.remainingSize() / sizeof(sal_uInt16); + if (nCount > nMaxRecords) + { + SAL_WARN("svl", "Parsing error: " << nMaxRecords << + " max possible entries, but " << nCount << " claimed, truncating"); + nCount = nMaxRecords; + } sal_uInt16 *pMap = new sal_uInt16[nCount]; memset(pMap, 0, nCount * sizeof(sal_uInt16)); for ( sal_uInt16 n = 0; n < nCount; ++n ) |