From 5e2d089f763963e6ce7d3d183bd1bf7932aeaaaf Mon Sep 17 00:00:00 2001
From: Caolán McNamara <caolanm@redhat.com>
Date: Fri, 17 Oct 2014 16:04:33 +0100
Subject: coverity#1242573 Untrusted loop bound

Change-Id: Id2847c55ccab7272919e76542bc0e0570bc9af12
---
 vcl/source/filter/wmf/winwmf.cxx | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

(limited to 'vcl/source')

diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx
index edd5c6f84426..96d69cf958fe 100644
--- a/vcl/source/filter/wmf/winwmf.cxx
+++ b/vcl/source/filter/wmf/winwmf.cxx
@@ -1475,18 +1475,25 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm )
                 case W_META_POLYPOLYGON:
                 {
                     bool bRecordOk = true;
-                    sal_uInt16 nPoly, nPoints = 0;
-                    pStm->ReadUInt16( nPoly );
-                    for(sal_uInt16 i = 0; i < nPoly; i++ )
+                    sal_uInt16 nPoly(0), nPoints(0);
+                    pStm->ReadUInt16(nPoly);
+                    if (nPoly > pStm->remainingSize() / sizeof(sal_uInt16))
                     {
-                        sal_uInt16 nP = 0;
-                        pStm->ReadUInt16( nP );
-                        if (nP > SAL_MAX_UINT16 - nPoints)
+                        bRecordOk = false;
+                    }
+                    else
+                    {
+                        for(sal_uInt16 i = 0; i < nPoly; i++ )
                         {
-                            bRecordOk = false;
-                            break;
+                            sal_uInt16 nP = 0;
+                            pStm->ReadUInt16( nP );
+                            if (nP > SAL_MAX_UINT16 - nPoints)
+                            {
+                                bRecordOk = false;
+                                break;
+                            }
+                            nPoints += nP;
                         }
-                        nPoints += nP;
                     }
 
                     SAL_WARN_IF(!bRecordOk, "vcl.wmf", "polypolygon record has more polygons than we can handle");
-- 
cgit