diff options
-rw-r--r-- | lotuswordpro/source/filter/lwpdrawobj.cxx | 5 | ||||
-rw-r--r-- | lotuswordpro/source/filter/lwptools.hxx | 6 |
2 files changed, 10 insertions, 1 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index 4be146f0f89c..f357f9d359ae 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -505,7 +505,10 @@ void LwpDrawPolyLine::Read() m_pStream->ReadUChar( m_aPolyLineRec.aPenColor.unused ); m_pStream->ReadUInt16( m_aPolyLineRec.nNumPoints ); - m_pVector= new SdwPoint [m_aPolyLineRec.nNumPoints]; + if (m_aPolyLineRec.nNumPoints > m_pStream->remainingSize() / 4) + throw BadRead(); + + m_pVector= new SdwPoint[m_aPolyLineRec.nNumPoints]; for (sal_uInt16 nC = 0; nC < m_aPolyLineRec.nNumPoints; nC++) { diff --git a/lotuswordpro/source/filter/lwptools.hxx b/lotuswordpro/source/filter/lwptools.hxx index 51680bda1eb2..f240214ed02a 100644 --- a/lotuswordpro/source/filter/lwptools.hxx +++ b/lotuswordpro/source/filter/lwptools.hxx @@ -148,6 +148,12 @@ public: BadSeek() : std::runtime_error("Lotus Word Pro Bad Seek") { } }; +class BadRead: public std::runtime_error +{ +public: + BadRead() : std::runtime_error("Lotus Word Pro Bad Read") { } +}; + class BadDecompress : public std::runtime_error { public: |