From 05362fd2dbb481b735e8b7e97288d842a6e3ec0b Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Tue, 18 Nov 2014 21:22:10 +0000
Subject: coverity#1242708 Untrusted loop bound

Change-Id: Ic5af417ad38cafa46051789574239996a8845ffb
---
 sc/source/filter/excel/xilink.cxx | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to 'sc/source/filter/excel')

diff --git a/sc/source/filter/excel/xilink.cxx b/sc/source/filter/excel/xilink.cxx
index 52e8a5ae9141..51da063dec35 100644
--- a/sc/source/filter/excel/xilink.cxx
+++ b/sc/source/filter/excel/xilink.cxx
@@ -272,6 +272,17 @@ XclImpExtName::MOper::MOper(svl::SharedStringPool& rPool, XclImpStream& rStrm) :
 {
     SCSIZE nLastCol = rStrm.ReaduInt8();
     SCSIZE nLastRow = rStrm.ReaduInt16();
+
+    //assuming worse case scenario of nOp + one byte unistring len
+    const size_t nMinRecordSize = 2;
+    const size_t nMaxRows = rStrm.GetRecLeft() / (nMinRecordSize * (nLastCol+1));
+    if (nLastRow >= nMaxRows)
+    {
+        SAL_WARN("sc", "Parsing error: " << nMaxRows <<
+                 " max possible rows, but " << nLastRow << " index claimed, truncating");
+        nLastRow = nMaxRows-1;
+    }
+
     mxCached->Resize(nLastCol+1, nLastRow+1);
     for (SCSIZE nRow = 0; nRow <= nLastRow; ++nRow)
     {
-- 
cgit