summaryrefslogtreecommitdiff
path: root/tools
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2015-01-26 11:03:08 +0000
committerCaolán McNamara <caolanm@redhat.com>2015-01-26 12:14:43 +0000
commit381ea04355deae554aeb84f373f012e28518a5f2 (patch)
tree96e8ed0ee7c077418a4f3414e3afc6381adea30e /tools
parentb700de5417742c2c1c3f01692313d25d610dedc0 (diff)
coverity#1244946 Untrusted value as argument
Change-Id: Id7ad0f2060afb2f12d3111400f45d3d63e6abf8f
Diffstat (limited to 'tools')
-rw-r--r--tools/source/generic/poly2.cxx9
1 files changed, 9 insertions, 0 deletions
diff --git a/tools/source/generic/poly2.cxx b/tools/source/generic/poly2.cxx
index 9ed24b1b7484..f6b6f3efc2ce 100644
--- a/tools/source/generic/poly2.cxx
+++ b/tools/source/generic/poly2.cxx
@@ -578,6 +578,15 @@ SvStream& ReadPolyPolygon( SvStream& rIStream, tools::PolyPolygon& rPolyPoly )
// Read number of polygons
rIStream.ReadUInt16( nPolyCount );
+ const size_t nMinRecordSize = sizeof(sal_uInt16);
+ const size_t nMaxRecords = rIStream.remainingSize() / nMinRecordSize;
+ if (nPolyCount > nMaxRecords)
+ {
+ SAL_WARN("vcl.gdi", "Parsing error: " << nMaxRecords <<
+ " max possible entries, but " << nPolyCount << " claimed, truncating");
+ nPolyCount = nMaxRecords;
+ }
+
if( nPolyCount )
{
if ( rPolyPoly.mpImplPolyPolygon->mnRefCount > 1 )