diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-28 09:41:44 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-28 10:31:30 +0000 |
| commit | cb67f0c5f9424fc085c4169211bda7e36cfbd904 (patch) | |
| tree | 6ac7afeba04322fc91e4a04c1097fbe7c6ebfb2f /sw | |
| parent | 8c8c2dd14a5f8f2771b8b750937156a98f4a74b6 (diff) | |
coverity#1242656 Untrusted loop bound
Change-Id: Iaf60d887860476e17d3db306a2089bfffd0564c9
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/filter/ww8/ww8par2.cxx | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/sw/source/filter/ww8/ww8par2.cxx b/sw/source/filter/ww8/ww8par2.cxx index b5cc9a846a82..542afa90ddd9 100644 --- a/sw/source/filter/ww8/ww8par2.cxx +++ b/sw/source/filter/ww8/ww8par2.cxx @@ -4265,8 +4265,15 @@ void WW8RStyle::ImportOldFormatStyles() } std::vector<pxoffset> aPAPXOffsets(stcp); + size_t nMaxByteCount = rSt.remainingSize(); sal_uInt16 cbPapx(0); - rSt.ReadUInt16( cbPapx ); + rSt.ReadUInt16(cbPapx); + if (cbPapx > nMaxByteCount) + { + SAL_WARN("sw.ww8", "WW8RStyle::ImportOldFormatStyles: truncating out of range " + << cbPapx << " to " << nMaxByteCount); + cbPapx = nMaxByteCount; + } nByteCount = 2; stcp=0; while (nByteCount < cbPapx) |