From a00df5c384dea542fbb47d7d0d4ae3ca14cc8bd1 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Mon, 26 Jan 2015 10:33:27 +0000
Subject: coverity#1266488 Untrusted loop bound

Change-Id: I41592965590d53fbaa632cf01abed430427a9698
---
 sw/source/filter/ww8/ww8par3.cxx | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'sw/source/filter/ww8')

diff --git a/sw/source/filter/ww8/ww8par3.cxx b/sw/source/filter/ww8/ww8par3.cxx
index a301046ea74d..5c03e1536c4e 100644
--- a/sw/source/filter/ww8/ww8par3.cxx
+++ b/sw/source/filter/ww8/ww8par3.cxx
@@ -2232,6 +2232,14 @@ void WW8FormulaControl::FormulaRead(SwWw8ControlType nWhich,
             "Unknown formfield dropdown list structure. Report to cmc");
         if (!bAllOk)    //Not as expected, don't risk it at all.
             nNoStrings = 0;
+        const size_t nMinRecordSize = sizeof(sal_uInt16);
+        const size_t nMaxRecords = pDataStream->remainingSize() / nMinRecordSize;
+        if (nNoStrings > nMaxRecords)
+        {
+            SAL_WARN("sw.ww8", "Parsing error: " << nMaxRecords <<
+                     " max possible entries, but " << nNoStrings << " claimed, truncating");
+            nNoStrings = nMaxRecords;
+        }
         maListEntries.reserve(nNoStrings);
         for (sal_uInt32 nI = 0; nI < nNoStrings; ++nI)
         {
-- 
cgit