diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-01-26 11:03:08 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-01-26 12:14:43 +0000 |
| commit | 381ea04355deae554aeb84f373f012e28518a5f2 (patch) | |
| tree | 96e8ed0ee7c077418a4f3414e3afc6381adea30e /tools/source/generic/poly2.cxx | |
| parent | b700de5417742c2c1c3f01692313d25d610dedc0 (diff) | |
coverity#1244946 Untrusted value as argument
Change-Id: Id7ad0f2060afb2f12d3111400f45d3d63e6abf8f
Diffstat (limited to 'tools/source/generic/poly2.cxx')
| -rw-r--r-- | tools/source/generic/poly2.cxx | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/tools/source/generic/poly2.cxx b/tools/source/generic/poly2.cxx index 9ed24b1b7484..f6b6f3efc2ce 100644 --- a/tools/source/generic/poly2.cxx +++ b/tools/source/generic/poly2.cxx @@ -578,6 +578,15 @@ SvStream& ReadPolyPolygon( SvStream& rIStream, tools::PolyPolygon& rPolyPoly ) // Read number of polygons rIStream.ReadUInt16( nPolyCount ); + const size_t nMinRecordSize = sizeof(sal_uInt16); + const size_t nMaxRecords = rIStream.remainingSize() / nMinRecordSize; + if (nPolyCount > nMaxRecords) + { + SAL_WARN("vcl.gdi", "Parsing error: " << nMaxRecords << + " max possible entries, but " << nPolyCount << " claimed, truncating"); + nPolyCount = nMaxRecords; + } + if( nPolyCount ) { if ( rPolyPoly.mpImplPolyPolygon->mnRefCount > 1 ) |