From e4ebd97a9b5dc3a25a142109d2a0dbe41925e431 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Tue, 14 Oct 2014 15:12:05 +0100
Subject: coverity#1242918 Untrusted loop bound

Change-Id: I8575a43a095165a81417f169463aaf2c4ab337e8
---
 lotuswordpro/source/filter/lwpdrawobj.cxx | 5 ++++-
 lotuswordpro/source/filter/lwptools.hxx   | 6 ++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

(limited to 'lotuswordpro')

diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx
index 4be146f0f89c..f357f9d359ae 100644
--- a/lotuswordpro/source/filter/lwpdrawobj.cxx
+++ b/lotuswordpro/source/filter/lwpdrawobj.cxx
@@ -505,7 +505,10 @@ void LwpDrawPolyLine::Read()
     m_pStream->ReadUChar( m_aPolyLineRec.aPenColor.unused );
     m_pStream->ReadUInt16( m_aPolyLineRec.nNumPoints );
 
-    m_pVector= new SdwPoint [m_aPolyLineRec.nNumPoints];
+    if (m_aPolyLineRec.nNumPoints > m_pStream->remainingSize() / 4)
+        throw BadRead();
+
+    m_pVector= new SdwPoint[m_aPolyLineRec.nNumPoints];
 
     for (sal_uInt16 nC = 0; nC < m_aPolyLineRec.nNumPoints; nC++)
     {
diff --git a/lotuswordpro/source/filter/lwptools.hxx b/lotuswordpro/source/filter/lwptools.hxx
index 51680bda1eb2..f240214ed02a 100644
--- a/lotuswordpro/source/filter/lwptools.hxx
+++ b/lotuswordpro/source/filter/lwptools.hxx
@@ -148,6 +148,12 @@ public:
     BadSeek() : std::runtime_error("Lotus Word Pro Bad Seek") { }
 };
 
+class BadRead: public std::runtime_error
+{
+public:
+    BadRead() : std::runtime_error("Lotus Word Pro Bad Read") { }
+};
+
 class BadDecompress : public std::runtime_error
 {
 public:
-- 
cgit