coverity#1242624 Untrusted loop bound

Change-Id: I277e98156c9a9832d1f5e968e590356d14b91af6

coverity#1242624 Untrusted loop bound
Change-Id: I277e98156c9a9832d1f5e968e590356d14b91af6
9327373a · Caolán McNamara · db4414db · 9327373a
Kaydet (Commit) 9327373a authored Şub 04, 2015 tarafından Caolán McNamara
Show whitespace changes
Inline Side-by-side

Showing with 6 additions and 0 deletions

msdffimp.cxx filter/source/msfilter/msdffimp.cxx +6 -0

No files found.
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -2203,6 +2203,12 @@ void DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
                sal_uInt16 nElemSizeSeg = 2;
                rIn.ReadUInt16( nNumElemSeg ).ReadUInt16( nNumElemMemSeg ).ReadUInt16( nElemSizeSeg );
            }
+            sal_Size nMaxEntriesPossible = rIn.remainingSize() / sizeof(sal_uInt16);
+            if (nNumElemSeg > nMaxEntriesPossible)
+            {
+                SAL_WARN("filter.ms", "NumElem list is longer than remaining bytes, ppt or parser is wrong");
+                nNumElemSeg = nMaxEntriesPossible;
+            }
            if ( nNumElemSeg )
            {
                sal_Int16 nCommand;