From 79f060d45122ac108de8482d44af17a82ee1c48d Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Tue, 1 Sep 2015 09:25:54 +0100
Subject: coverity#1242865 Untrusted loop bound

Change-Id: I9332fa9b805e702fb56067efc308aff09310f603
---
 basic/source/classes/image.cxx | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/basic/source/classes/image.cxx b/basic/source/classes/image.cxx
index 3faabae95793..12eff1835c5b 100644
--- a/basic/source/classes/image.cxx
+++ b/basic/source/classes/image.cxx
@@ -258,8 +258,16 @@ bool SbiImage::Load( SvStream& r, sal_uInt32& nVersion )
                 {
                     OUString aTypeName = r.ReadUniOrByteString(eCharSet);
 
-                    sal_Int16 nTypeMembers;
-                    r.ReadInt16(nTypeMembers);
+                    sal_uInt16 nTypeMembers;
+                    r.ReadUInt16(nTypeMembers);
+
+                    const size_t nMaxTypeMembers = r.remainingSize() / 8;
+                    if (nTypeMembers > nMaxTypeMembers)
+                    {
+                        SAL_WARN("basic", "Parsing error: " << nMaxTypeMembers <<
+                                 " max possible entries, but " << nTypeMembers << " claimed, truncating");
+                        nTypeMembers = nMaxTypeMembers;
+                    }
 
                     SbxObject *pType = new SbxObject(aTypeName);
                     SbxArray *pTypeMembers = pType->GetProperties();
-- 
cgit