diff options
Diffstat (limited to 'lotuswordpro/source/filter/lwpdrawobj.cxx')
| -rw-r--r-- | lotuswordpro/source/filter/lwpdrawobj.cxx | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index 4be146f0f89c..f357f9d359ae 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -505,7 +505,10 @@ void LwpDrawPolyLine::Read() m_pStream->ReadUChar( m_aPolyLineRec.aPenColor.unused ); m_pStream->ReadUInt16( m_aPolyLineRec.nNumPoints ); - m_pVector= new SdwPoint [m_aPolyLineRec.nNumPoints]; + if (m_aPolyLineRec.nNumPoints > m_pStream->remainingSize() / 4) + throw BadRead(); + + m_pVector= new SdwPoint[m_aPolyLineRec.nNumPoints]; for (sal_uInt16 nC = 0; nC < m_aPolyLineRec.nNumPoints; nC++) { |