From 85005715a516d47697e3fcf86f51df35f442648d Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Thu, 6 Nov 2014 13:31:26 +0000
Subject: coverity#1242570 Untrusted value as argument

Change-Id: Ic79bd1931ee291746b6dae138b3181d4baddbe3e
---
 svtools/source/misc/imap.cxx | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

(limited to 'svtools')

diff --git a/svtools/source/misc/imap.cxx b/svtools/source/misc/imap.cxx
index 4eebd55d9638..344372d279de 100644
--- a/svtools/source/misc/imap.cxx
+++ b/svtools/source/misc/imap.cxx
@@ -883,8 +883,18 @@ void ImageMap::ImpWriteImageMap( SvStream& rOStm, const OUString& rBaseURL ) con
 
 void ImageMap::ImpReadImageMap( SvStream& rIStm, size_t nCount, const OUString& rBaseURL )
 {
+    const size_t nMinRecordSize = 12; //circle, three 32bit numbers
+    const size_t nMaxRecords = rIStm.remainingSize() / nMinRecordSize;
+
+    if (nCount > nMaxRecords)
+    {
+        SAL_WARN("svtools.misc", "Parsing error: " << nMaxRecords << " max possible entries, but " <<
+                 nCount << " claimed, truncating");
+        nCount = nMaxRecords;
+    }
+
     // neue Objekte einlesen
-    for ( size_t i = 0; i < nCount; i++ )
+    for (size_t i = 0; i < nCount; ++i)
     {
         sal_uInt16 nType;
 
-- 
cgit