From 169433f2945865c49402c43808b114d742a27d0b Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Wed, 15 Oct 2014 11:10:14 +0100
Subject: coverity#1242817 Untrusted loop bound

Change-Id: I974a80644f70c024f93d081a87204df8cadfa012
---
 sw/source/filter/ww8/ww8toolbar.cxx | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'sw/source/filter/ww8/ww8toolbar.cxx')

diff --git a/sw/source/filter/ww8/ww8toolbar.cxx b/sw/source/filter/ww8/ww8toolbar.cxx
index ffb210b63492..35be1a7b65a1 100644
--- a/sw/source/filter/ww8/ww8toolbar.cxx
+++ b/sw/source/filter/ww8/ww8toolbar.cxx
@@ -1105,6 +1105,8 @@ bool TcgSttbfCore::Read( SvStream& rS )
     rS.ReadUInt16( fExtend ).ReadUInt16( cData ).ReadUInt16( cbExtra );
     if ( cData )
     {
+        if (cData > rS.remainingSize() / 4) //definitely an invalid record
+            return false;
         dataItems = new SBBItem[ cData ];
         for ( sal_Int32 index = 0; index < cData; ++index )
         {
-- 
cgit