diff options
Diffstat (limited to 'tools/source')
| -rw-r--r-- | tools/source/generic/poly2.cxx | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/tools/source/generic/poly2.cxx b/tools/source/generic/poly2.cxx index 9ed24b1b7484..f6b6f3efc2ce 100644 --- a/tools/source/generic/poly2.cxx +++ b/tools/source/generic/poly2.cxx @@ -578,6 +578,15 @@ SvStream& ReadPolyPolygon( SvStream& rIStream, tools::PolyPolygon& rPolyPoly ) // Read number of polygons rIStream.ReadUInt16( nPolyCount ); + const size_t nMinRecordSize = sizeof(sal_uInt16); + const size_t nMaxRecords = rIStream.remainingSize() / nMinRecordSize; + if (nPolyCount > nMaxRecords) + { + SAL_WARN("vcl.gdi", "Parsing error: " << nMaxRecords << + " max possible entries, but " << nPolyCount << " claimed, truncating"); + nPolyCount = nMaxRecords; + } + if( nPolyCount ) { if ( rPolyPoly.mpImplPolyPolygon->mnRefCount > 1 ) |