Kaydet (Commit) 83de961e authored tarafından Caolán McNamara's avatar Caolán McNamara

coverity#1244945 Untrusted value as argument

Change-Id: Ic969ea78a53d0a67591dd476bc01fbdce18c7eab
üst 381ea043
...@@ -582,7 +582,7 @@ SvStream& ReadPolyPolygon( SvStream& rIStream, tools::PolyPolygon& rPolyPoly ) ...@@ -582,7 +582,7 @@ SvStream& ReadPolyPolygon( SvStream& rIStream, tools::PolyPolygon& rPolyPoly )
const size_t nMaxRecords = rIStream.remainingSize() / nMinRecordSize; const size_t nMaxRecords = rIStream.remainingSize() / nMinRecordSize;
if (nPolyCount > nMaxRecords) if (nPolyCount > nMaxRecords)
{ {
SAL_WARN("vcl.gdi", "Parsing error: " << nMaxRecords << SAL_WARN("tools", "Parsing error: " << nMaxRecords <<
" max possible entries, but " << nPolyCount << " claimed, truncating"); " max possible entries, but " << nPolyCount << " claimed, truncating");
nPolyCount = nMaxRecords; nPolyCount = nMaxRecords;
} }
...@@ -636,6 +636,15 @@ void PolyPolygon::Read( SvStream& rIStream ) ...@@ -636,6 +636,15 @@ void PolyPolygon::Read( SvStream& rIStream )
// Read number of polygons // Read number of polygons
rIStream.ReadUInt16( nPolyCount ); rIStream.ReadUInt16( nPolyCount );
const size_t nMinRecordSize = sizeof(sal_uInt16);
const size_t nMaxRecords = rIStream.remainingSize() / nMinRecordSize;
if (nPolyCount > nMaxRecords)
{
SAL_WARN("tools", "Parsing error: " << nMaxRecords <<
" max possible entries, but " << nPolyCount << " claimed, truncating");
nPolyCount = nMaxRecords;
}
if( nPolyCount ) if( nPolyCount )
{ {
if ( mpImplPolyPolygon->mnRefCount > 1 ) if ( mpImplPolyPolygon->mnRefCount > 1 )
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment