diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-01-26 10:33:27 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-01-26 12:14:40 +0000 |
| commit | a00df5c384dea542fbb47d7d0d4ae3ca14cc8bd1 (patch) | |
| tree | ea1f189dcc788118daecfc78e82df2455db16042 /sw/source/filter/ww8 | |
| parent | 4223914a61c73b2167881c599f5feab7e1254f76 (diff) | |
coverity#1266488 Untrusted loop bound
Change-Id: I41592965590d53fbaa632cf01abed430427a9698
Diffstat (limited to 'sw/source/filter/ww8')
| -rw-r--r-- | sw/source/filter/ww8/ww8par3.cxx | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx index a301046ea74d..5c03e1536c4e 100644 --- a/sw/source/filter/ww8/ww8par3.cxx +++ b/sw/source/filter/ww8/ww8par3.cxx @@ -2232,6 +2232,14 @@ void WW8FormulaControl::FormulaRead(SwWw8ControlType nWhich, "Unknown formfield dropdown list structure. Report to cmc"); if (!bAllOk) //Not as expected, don't risk it at all. nNoStrings = 0; + const size_t nMinRecordSize = sizeof(sal_uInt16); + const size_t nMaxRecords = pDataStream->remainingSize() / nMinRecordSize; + if (nNoStrings > nMaxRecords) + { + SAL_WARN("sw.ww8", "Parsing error: " << nMaxRecords << + " max possible entries, but " << nNoStrings << " claimed, truncating"); + nNoStrings = nMaxRecords; + } maListEntries.reserve(nNoStrings); for (sal_uInt32 nI = 0; nI < nNoStrings; ++nI) { |