From bbe264a19fb82f50d859fc72a47312db0527640f Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 17 Oct 2014 10:03:32 +0100
Subject: coverity#1242724 Untrusted value as argument

Change-Id: I6041d09ef0a4ed4af5f1bf93f31a1eac60be1af7
---
 filter/source/msfilter/msdffimp.cxx | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index fe6538664eff..fdb4898384b5 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -5318,19 +5318,24 @@ SdrObject* SvxMSDffManager::ProcessObj(SvStream& rSt,
         {
             delete pTextImpRec->pWrapPolygon;
             pTextImpRec->pWrapPolygon = NULL;
-            sal_uInt16 nNumElemVert, nNumElemMemVert, nElemSizeVert;
+            sal_uInt16 nNumElemVert(0), nNumElemMemVert(0), nElemSizeVert(0);
             rSt.ReadUInt16( nNumElemVert ).ReadUInt16( nNumElemMemVert ).ReadUInt16( nElemSizeVert );
+            bool bOk = false;
             if (nNumElemVert && ((nElemSizeVert == 8) || (nElemSizeVert == 4)))
+            {
+                bOk = rSt.remainingSize() / nElemSizeVert >= nNumElemVert;
+            }
+            if (bOk)
             {
                 pTextImpRec->pWrapPolygon = new Polygon(nNumElemVert);
                 for (sal_uInt16 i = 0; i < nNumElemVert; ++i)
                 {
-                    sal_Int32 nX, nY;
+                    sal_Int32 nX(0), nY(0);
                     if (nElemSizeVert == 8)
                         rSt.ReadInt32( nX ).ReadInt32( nY );
                     else
                     {
-                        sal_Int16 nSmallX, nSmallY;
+                        sal_Int16 nSmallX(0), nSmallY(0);
                         rSt.ReadInt16( nSmallX ).ReadInt16( nSmallY );
                         nX = nSmallX;
                         nY = nSmallY;
-- 
cgit