diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-07-03 11:17:37 +0100 |
|---|---|---|
| committer | Andras Timar <andras.timar@collabora.com> | 2014-07-04 11:33:54 +0200 |
| commit | 5fb6bf9ea34468b2f5e1424886f4060b96886a1e (patch) | |
| tree | 47383c71718db509b5e4aab84e5bf09485de5b83 | |
| parent | 28d8ceba68e739303b40a1218af3bcea08b18196 (diff) | |
coverity#1222240 Untrusted value as argument
and
coverity#1222239 Untrusted value as argument
(cherry picked from commit 5e043613266113a873c55ad45ab0fb1ae14286e8)
Change-Id: I48bacfd988a34d67ffa542edba7cba1bb9b0b3cc
Reviewed-on: https://gerrit.libreoffice.org/10052
Tested-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
Reviewed-by: Markus Mohrhard <markus.mohrhard@googlemail.com>
| -rw-r--r-- | lotuswordpro/source/filter/tocread.cxx | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/lotuswordpro/source/filter/tocread.cxx b/lotuswordpro/source/filter/tocread.cxx index c27909cf0683..8be2015fd92b 100644 --- a/lotuswordpro/source/filter/tocread.cxx +++ b/lotuswordpro/source/filter/tocread.cxx @@ -67,6 +67,16 @@ CBenTOCReader::ReadLabelAndTOC() if ((Err = ReadLabel(&TOCOffset, &cTOCSize)) != BenErr_OK) return Err; + unsigned long nLength; + if ((Err = cpContainer->GetSize(&nLength)) != BenErr_OK) + return Err; + + if (TOCOffset > nLength) + return BenErr_ReadPastEndOfTOC; + + if (cTOCSize > nLength - TOCOffset) + return BenErr_ReadPastEndOfTOC; + if ((Err = cpContainer->SeekToPosition(TOCOffset)) != BenErr_OK) return Err; |