From 41029bcdd094b516bb4f4926fca18ce60092a013 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 14 Nov 2014 10:19:24 +0000
Subject: coverity#1242865 Untrusted value as argument

Change-Id: Ie7a7a2e7894a204dd55833416b7cbc5b01826e64
---
 basic/source/classes/image.cxx | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to 'basic')

diff --git a/basic/source/classes/image.cxx b/basic/source/classes/image.cxx
index 1543caec5cac..8e52b450a21c 100644
--- a/basic/source/classes/image.cxx
+++ b/basic/source/classes/image.cxx
@@ -202,7 +202,17 @@ bool SbiImage::Load( SvStream& r, sal_uInt32& nVersion )
             case B_LINERANGES:
                 break;
             case B_STRINGPOOL:
+            {
                 if( bBadVer ) break;
+                //assuming an empty string with just the lead 32bit len indicator
+                const size_t nMinStringSize = 4;
+                const size_t nMaxStrings = r.remainingSize() / nMinStringSize;
+                if (nCount > nMaxStrings)
+                {
+                    SAL_WARN("basic", "Parsing error: " << nMaxStrings <<
+                             " max possible entries, but " << nCount << " claimed, truncating");
+                    nCount = nMaxStrings;
+                }
                 MakeStrings( nCount );
                 short i;
                 for( i = 0; i < nStrings && SbiGood( r ); i++ )
@@ -227,6 +237,7 @@ bool SbiImage::Load( SvStream& r, sal_uInt32& nVersion )
                     }
                 }
                 break;
+            }
             case B_MODEND:
                 goto done;
             default:
-- 
cgit