coverity#1266489 Untrusted loop bound

Change-Id: I5903dafb4bb29657a5b6e239cb918e656c381315

sw/source/core/doc/tblafmt.cxx

@@ -1165,8 +1165,17 @@ bool SwTableAutoFmtTbl::Load( SvStream& rStream )
                 rStream.ReadUInt16( nAnz );
 
                 bRet = 0 == rStream.GetError();
-
-                for( sal_uInt16 i = 0; i < nAnz; ++i )
+                if (bRet)
+                {
+                    const size_t nMinRecordSize = sizeof(sal_uInt16);
+                    const size_t nMaxRecords = rStream.remainingSize() / nMinRecordSize;
+                    if (nAnz > nMaxRecords)
+                    {
+                        SAL_WARN("vcl.gdi", "Parsing error: " << nMaxRecords <<
+                                 " max possible entries, but " << nAnz << " claimed, truncating");
+                        nAnz = nMaxRecords;
+                    }
+                    for (sal_uInt16 i = 0; i < nAnz; ++i)
                     {
                         pNew = new SwTableAutoFmt( OUString() );
                         bRet = pNew->Load( rStream, aVersions );
@@ -1181,6 +1190,7 @@ bool SwTableAutoFmtTbl::Load( SvStream& rStream )
                         }
                     }
                 }
+            }
             else
             {
                 bRet = false;