summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2015-12-08 14:20:52 +0000
committerStephan Bergmann <sbergman@redhat.com>2015-12-08 15:00:55 +0000
commite3ece9c844435432269de62b7c666e6dd93adbf2 (patch)
treed72a17c9ceb0cd0316eed2d415328a064a49a1ab
parent2fe640f407cf2b1c51a2df69880b1abd19d16681 (diff)
guard against corrupt m_nNumTabs
Change-Id: I41b8514a127d463ac951e5855f09416fa0456b1b (cherry picked from commit 85a2cd37fc60cd53a892b27a18d4b5272988361c) (cherry picked from commit 34a03c676e618200292f187f8f96b74f23c962b5) Reviewed-on: https://gerrit.libreoffice.org/20472 Reviewed-by: Björn Michaelsen <bjoern.michaelsen@canonical.com> Reviewed-by: Stephan Bergmann <sbergman@redhat.com> Tested-by: Stephan Bergmann <sbergman@redhat.com>
-rw-r--r--lotuswordpro/source/filter/lwptabrack.cxx5
1 files changed, 3 insertions, 2 deletions
diff --git a/lotuswordpro/source/filter/lwptabrack.cxx b/lotuswordpro/source/filter/lwptabrack.cxx
index 5c3eb446cf24..82957961895b 100644
--- a/lotuswordpro/source/filter/lwptabrack.cxx
+++ b/lotuswordpro/source/filter/lwptabrack.cxx
@@ -86,11 +86,12 @@ LwpTabRack::LwpTabRack(LwpObjectHeader objHdr, LwpSvStream* pStrm):LwpObject(obj
void LwpTabRack::Read()
{
-// LwpObjectID m_NextID;
m_NextID.ReadIndexed(m_pObjStrm);
m_nNumTabs = m_pObjStrm->QuickReaduInt16();
- for( int i=0; i<m_nNumTabs; i++ )
+ if (m_nNumTabs > MaxTabs)
+ throw std::out_of_range("corrupt LwpTabRack");
+ for (int i=0; i<m_nNumTabs; ++i)
{
m_aTabs[i].Read(m_pObjStrm);
m_pObjStrm->SkipExtra();