Kaydet (Commit) 05362fd2 authored tarafından Caolán McNamara's avatar Caolán McNamara

coverity#1242708 Untrusted loop bound

Change-Id: Ic5af417ad38cafa46051789574239996a8845ffb
üst 772a3693
...@@ -272,6 +272,17 @@ XclImpExtName::MOper::MOper(svl::SharedStringPool& rPool, XclImpStream& rStrm) : ...@@ -272,6 +272,17 @@ XclImpExtName::MOper::MOper(svl::SharedStringPool& rPool, XclImpStream& rStrm) :
{ {
SCSIZE nLastCol = rStrm.ReaduInt8(); SCSIZE nLastCol = rStrm.ReaduInt8();
SCSIZE nLastRow = rStrm.ReaduInt16(); SCSIZE nLastRow = rStrm.ReaduInt16();
//assuming worse case scenario of nOp + one byte unistring len
const size_t nMinRecordSize = 2;
const size_t nMaxRows = rStrm.GetRecLeft() / (nMinRecordSize * (nLastCol+1));
if (nLastRow >= nMaxRows)
{
SAL_WARN("sc", "Parsing error: " << nMaxRows <<
" max possible rows, but " << nLastRow << " index claimed, truncating");
nLastRow = nMaxRows-1;
}
mxCached->Resize(nLastCol+1, nLastRow+1); mxCached->Resize(nLastCol+1, nLastRow+1);
for (SCSIZE nRow = 0; nRow <= nLastRow; ++nRow) for (SCSIZE nRow = 0; nRow <= nLastRow; ++nRow)
{ {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment