From 1f6aefcf2dc50a678561c9b3884d973481788821 Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Tue, 28 Oct 2014 10:51:38 +0000
Subject: coverity#1242531 Untrusted loop bound

Change-Id: I94308a517028a62ecf7018f6d7a4e9d37c0f56a6
---
 tools/source/generic/poly.cxx | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'tools')

diff --git a/tools/source/generic/poly.cxx b/tools/source/generic/poly.cxx
index 56b224bf5ef2..dc3f70e59b1e 100644
--- a/tools/source/generic/poly.cxx
+++ b/tools/source/generic/poly.cxx
@@ -1551,6 +1551,12 @@ SvStream& ReadPolygon( SvStream& rIStream, Polygon& rPoly )
 
     {
         // Determine whether we need to write through operators
+        const size_t nMaxRecordsPossible = rIStream.remainingSize() / (2 * sizeof(sal_Int32));
+        if (nPoints > nMaxRecordsPossible)
+        {
+            SAL_WARN("tools", "Polygon claims " << nPoints << " records, but only " << nMaxRecordsPossible << " possible");
+            nPoints = nMaxRecordsPossible;
+        }
 #if (SAL_TYPES_SIZEOFLONG) == 4
 #ifdef OSL_BIGENDIAN
         if ( rIStream.GetNumberFormatInt() == NUMBERFORMAT_INT_BIGENDIAN )
-- 
cgit