From 62eaee4858397f409da1474c71f1954b8d8e571e Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Thu, 6 Nov 2014 13:43:39 +0000
Subject: coverity#1242693 Untrusted value as argument

and

coverity#1242727 Untrusted value as argument

Change-Id: Ibb212c39f43bcd3f0e0ddf973d1512ed0d7c2fc6
---
 svl/source/filerec/filerec.cxx | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'svl/source')

diff --git a/svl/source/filerec/filerec.cxx b/svl/source/filerec/filerec.cxx
index eb5b8b104945..d8d3a10a387a 100644
--- a/svl/source/filerec/filerec.cxx
+++ b/svl/source/filerec/filerec.cxx
@@ -527,6 +527,13 @@ bool SfxMultiRecordReader::ReadHeader_Impl()
             _pStream->SeekRel( + _nContentSize );
         else
             _pStream->Seek( _nContentSize );
+        const size_t nMaxRecords = _pStream->remainingSize() / sizeof(sal_uInt32);
+        if (_nContentCount > nMaxRecords)
+        {
+            SAL_WARN("svl", "Parsing error: " << nMaxRecords << " max possible entries, but " <<
+                     _nContentCount << " claimed, truncating");
+            _nContentCount = nMaxRecords;
+        }
         _pContentOfs = new sal_uInt32[_nContentCount];
         memset(_pContentOfs, 0, _nContentCount*sizeof(sal_uInt32));
         #if defined(OSL_LITENDIAN)
-- 
cgit