From 22a722320e5c7c94eacd8aab707c941755b08512 Mon Sep 17 00:00:00 2001
From: Stephan Bergmann <sbergman@redhat.com>
Date: Sat, 2 Feb 2013 18:09:59 +0100
Subject: Missing reading of # members of polystruct

Change-Id: I343a3e6d57e8f9e1a35cdf3b5825f5a6f58fd133
---
 cppuhelper/source/typedescriptionprovider.cxx | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'cppuhelper')

diff --git a/cppuhelper/source/typedescriptionprovider.cxx b/cppuhelper/source/typedescriptionprovider.cxx
index 7946846a7674..35db6724e36b 100644
--- a/cppuhelper/source/typedescriptionprovider.cxx
+++ b/cppuhelper/source/typedescriptionprovider.cxx
@@ -2483,6 +2483,14 @@ css::uno::Any Provider::getByHierarchicalName(rtl::OUString const & aName)
                 for (sal_uInt32 i = 0; i != n; ++i) {
                     params.push_back(file_->readNameLen(off, &off));
                 }
+                n = file_->read32(off + 1);
+                if (n > SAL_MAX_INT32) {
+                    throw css::uno::DeploymentException(
+                        ("broken UNOIDL file: too many members of polymorphic"
+                         " struct type template " + aName),
+                        css::uno::Reference< css::uno::XInterface >());
+                }
+                off += 4;
                 std::vector< PolymorphicStructTypeTemplateDescription::Member >
                     mems;
                 for (sal_uInt32 i = 0; i != n; ++i) {
-- 
cgit