diff options
| author | Stephan Bergmann <sbergman@redhat.com> | 2013-02-02 18:09:59 +0100 |
|---|---|---|
| committer | Stephan Bergmann <sbergman@redhat.com> | 2013-02-02 18:09:59 +0100 |
| commit | 22a722320e5c7c94eacd8aab707c941755b08512 (patch) | |
| tree | 260b5aecb01c532a7f3c99256d26c2fe4d026ea8 /cppuhelper | |
| parent | 06b8f15c8dd23504b8e087451ee5c82eb74edd81 (diff) | |
Missing reading of # members of polystruct
Change-Id: I343a3e6d57e8f9e1a35cdf3b5825f5a6f58fd133
Diffstat (limited to 'cppuhelper')
| -rw-r--r-- | cppuhelper/source/typedescriptionprovider.cxx | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/cppuhelper/source/typedescriptionprovider.cxx b/cppuhelper/source/typedescriptionprovider.cxx index 7946846a7674..35db6724e36b 100644 --- a/cppuhelper/source/typedescriptionprovider.cxx +++ b/cppuhelper/source/typedescriptionprovider.cxx @@ -2483,6 +2483,14 @@ css::uno::Any Provider::getByHierarchicalName(rtl::OUString const & aName) for (sal_uInt32 i = 0; i != n; ++i) { params.push_back(file_->readNameLen(off, &off)); } + n = file_->read32(off + 1); + if (n > SAL_MAX_INT32) { + throw css::uno::DeploymentException( + ("broken UNOIDL file: too many members of polymorphic" + " struct type template " + aName), + css::uno::Reference< css::uno::XInterface >()); + } + off += 4; std::vector< PolymorphicStructTypeTemplateDescription::Member > mems; for (sal_uInt32 i = 0; i != n; ++i) { |