diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-28 10:39:10 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-28 15:06:30 +0000 |
| commit | 4aa33cac14ab4954239a8b36959de05e046852d9 (patch) | |
| tree | 921ff753451cc5023b867ce46c1e8795ba62af50 /sw | |
| parent | 4673bbef97f7352d6e83520c098d4d8b3c6bad54 (diff) | |
coverity#1242656 Untrusted loop bound
Change-Id: I229701ad12d33f2fe73b2db5fce217abbb6ea155
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/filter/ww8/ww8par2.cxx | 20 |
1 files changed, 13 insertions, 7 deletions
diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx index 8ef7a81c3757..13190bfee18f 100644 --- a/sw/source/filter/ww8/ww8par2.cxx +++ b/sw/source/filter/ww8/ww8par2.cxx @@ -4177,8 +4177,15 @@ void WW8RStyle::ImportOldFormatStyles() sal_uInt16 cstcStd(0); rSt.ReadUInt16( cstcStd ); + size_t nMaxByteCount = rSt.remainingSize(); sal_uInt16 cbName(0); - rSt.ReadUInt16( cbName ); + rSt.ReadUInt16(cbName); + if (cbName > nMaxByteCount) + { + SAL_WARN("sw.ww8", "WW8RStyle::ImportOldFormatStyles: truncating out of range " + << cbName << " to " << nMaxByteCount); + cbName = nMaxByteCount; + } sal_uInt16 nByteCount = 2; sal_uInt16 stcp=0; while (nByteCount < cbName) @@ -4227,16 +4234,15 @@ void WW8RStyle::ImportOldFormatStyles() sal_uInt16 nStyles=stcp; std::vector<pxoffset> aCHPXOffsets(stcp); - size_t nMaxByteCount = rSt.remainingSize(); + nMaxByteCount = rSt.remainingSize(); sal_uInt16 cbChpx(0); rSt.ReadUInt16(cbChpx); - if (cbPapx > nMaxByteCount) + if (cbChpx > nMaxByteCount) { SAL_WARN("sw.ww8", "WW8RStyle::ImportOldFormatStyles: truncating out of range " - << cbPapx << " to " << nMaxByteCount); - cbPapx = nMaxByteCount; + << cbChpx << " to " << nMaxByteCount); + cbChpx = nMaxByteCount; } - nByteCount = 2; stcp=0; std::vector< std::vector<sal_uInt8> > aConvertedChpx; @@ -4273,7 +4279,7 @@ void WW8RStyle::ImportOldFormatStyles() } std::vector<pxoffset> aPAPXOffsets(stcp); - size_t nMaxByteCount = rSt.remainingSize(); + nMaxByteCount = rSt.remainingSize(); sal_uInt16 cbPapx(0); rSt.ReadUInt16(cbPapx); if (cbPapx > nMaxByteCount) |