diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-17 16:04:33 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-18 10:45:28 +0100 |
| commit | 5e2d089f763963e6ce7d3d183bd1bf7932aeaaaf (patch) | |
| tree | dd0b3a067d562aa7042331ae0b2daaf8f6792d11 | |
| parent | 5a89092d5fe43638832ea8f86df34f81869337d9 (diff) | |
coverity#1242573 Untrusted loop bound
Change-Id: Id2847c55ccab7272919e76542bc0e0570bc9af12
| -rw-r--r-- | vcl/source/filter/wmf/winwmf.cxx | 25 |
1 files changed, 16 insertions, 9 deletions
diff --git a/vcl/source/filter/wmf/winwmf.cxx b/vcl/source/filter/wmf/winwmf.cxx index edd5c6f84426..96d69cf958fe 100644 --- a/vcl/source/filter/wmf/winwmf.cxx +++ b/vcl/source/filter/wmf/winwmf.cxx @@ -1475,18 +1475,25 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm ) case W_META_POLYPOLYGON: { bool bRecordOk = true; - sal_uInt16 nPoly, nPoints = 0; - pStm->ReadUInt16( nPoly ); - for(sal_uInt16 i = 0; i < nPoly; i++ ) + sal_uInt16 nPoly(0), nPoints(0); + pStm->ReadUInt16(nPoly); + if (nPoly > pStm->remainingSize() / sizeof(sal_uInt16)) { - sal_uInt16 nP = 0; - pStm->ReadUInt16( nP ); - if (nP > SAL_MAX_UINT16 - nPoints) + bRecordOk = false; + } + else + { + for(sal_uInt16 i = 0; i < nPoly; i++ ) { - bRecordOk = false; - break; + sal_uInt16 nP = 0; + pStm->ReadUInt16( nP ); + if (nP > SAL_MAX_UINT16 - nPoints) + { + bRecordOk = false; + break; + } + nPoints += nP; } - nPoints += nP; } SAL_WARN_IF(!bRecordOk, "vcl.wmf", "polypolygon record has more polygons than we can handle"); |