diff options
-rw-r--r-- | svl/source/items/rngitem.cxx | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/svl/source/items/rngitem.cxx b/svl/source/items/rngitem.cxx index 3c093311cab4..71e278fdf127 100644 --- a/svl/source/items/rngitem.cxx +++ b/svl/source/items/rngitem.cxx @@ -106,25 +106,28 @@ SvStream& SfxRangeItem::Store(SvStream &rStream, sal_uInt16) const return rStream; } - SfxUShortRangesItem::SfxUShortRangesItem() : _pRanges(0) { } - SfxUShortRangesItem::SfxUShortRangesItem( sal_uInt16 nWID, SvStream &rStream ) : SfxPoolItem( nWID ) { sal_uInt16 nCount(0); - rStream.ReadUInt16( nCount ); + rStream.ReadUInt16(nCount); + const size_t nMaxEntries = rStream.remainingSize() / sizeof(sal_uInt16); + if (nCount > nMaxEntries) + { + nCount = nMaxEntries; + SAL_WARN("svl.items", "SfxUShortRangesItem: truncated Stream"); + } _pRanges = new sal_uInt16[nCount + 1]; for ( sal_uInt16 n = 0; n < nCount; ++n ) rStream.ReadUInt16( _pRanges[n] ); _pRanges[nCount] = 0; } - SfxUShortRangesItem::SfxUShortRangesItem( const SfxUShortRangesItem& rItem ) : SfxPoolItem( rItem ) { @@ -133,7 +136,6 @@ SfxUShortRangesItem::SfxUShortRangesItem( const SfxUShortRangesItem& rItem ) memcpy( _pRanges, rItem._pRanges, sizeof(sal_uInt16) * nCount ); } - SfxUShortRangesItem::~SfxUShortRangesItem() { delete _pRanges; |