diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-15 10:52:40 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-15 16:56:58 +0100 |
| commit | 159ea0e04e0e284da14b474fc88546bedbf47ba2 (patch) | |
| tree | a25c66475bba3863de7673bbf3d705c68d75d2bb /sw | |
| parent | e178c45a47c394fe50463aeee9e7996a7c03277f (diff) | |
coverity#1242719 Untrusted value as argument
Change-Id: I444233dcf0a1e5e3792089be605b340b24882c89
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/filter/ww8/ww8scan.cxx | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index 752c78e5badc..d12a40d7e0a6 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -2565,12 +2565,21 @@ WW8PLCFx_Fc_FKP::WW8Fkp::WW8Fkp(ww::WordVersion eVersion, SvStream* pSt, { sal_uInt32 nCurr = pDataSt->Tell(); sal_uInt32 nPos = SVBT32ToUInt32(aEntry.mpData + 2); - if (checkSeek(*pDataSt, nPos)) + sal_uInt16 nLen(0); + + bool bOk = checkSeek(*pDataSt, nPos); + if (bOk) + { + pDataSt->ReadUInt16( nLen ); + bOk = nLen <= pDataSt->remainingSize(); + } + + if (bOk) { const sal_uInt16 nOrigLen = bExpand ? aEntry.mnLen : 0; sal_uInt8 *pOrigData = bExpand ? aEntry.mpData : 0; - pDataSt->ReadUInt16( aEntry.mnLen ); + aEntry.mnLen = nLen; aEntry.mpData = new sal_uInt8[aEntry.mnLen + nOrigLen]; aEntry.mbMustDelete = true; |