diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-28 10:47:12 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-28 15:06:30 +0000 |
| commit | 95e93e9a16e19fe25737ac7eda7328ba927834ea (patch) | |
| tree | 7c4561ea94ce0477d43a8e41b9e477d2804de0e3 /sw | |
| parent | 4aa33cac14ab4954239a8b36959de05e046852d9 (diff) | |
coverity#1242653 Untrusted loop bound
Change-Id: I911685ea84e0b2dbee1f18aaba425f5d18677687
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/filter/ww8/ww8scan.cxx | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx index f0f15d89f345..8a375bf5273f 100644 --- a/sw/source/filter/ww8/ww8scan.cxx +++ b/sw/source/filter/ww8/ww8scan.cxx @@ -3837,8 +3837,6 @@ bool WW8PLCFx_FLD::GetPara(long nIdx, WW8FieldDesc& rF) } // WW8PLCF_Book - -/* to be optimized like this: */ void WW8ReadSTTBF(bool bVer8, SvStream& rStrm, sal_uInt32 nStart, sal_Int32 nLen, sal_uInt16 nExtraLen, rtl_TextEncoding eCS, std::vector<OUString> &rArray, std::vector<ww::bytes>* pExtraArray, ::std::vector<OUString>* pValueArray) @@ -3864,6 +3862,18 @@ void WW8ReadSTTBF(bool bVer8, SvStream& rStrm, sal_uInt32 nStart, sal_Int32 nLen rStrm.ReadUInt16( nExtraLen ); + size_t nMinRecordSize = nExtraLen; + if (bUnicode) + nMinRecordSize += sizeof(sal_uInt16); + else + nMinRecordSize += sizeof(sal_uInt8); + const size_t nMaxPossibleStrings = rStrm.remainingSize() / nMinRecordSize; + if (nStrings > nMaxPossibleStrings) + { + SAL_WARN("sw.ww8", "STTBF claims " << nStrings << " entries, but only " << nMaxPossibleStrings << "are possible"); + nStrings = nMaxPossibleStrings; + } + for (sal_uInt16 i=0; i < nStrings; ++i) { if (bUnicode) |