coverity#1242582 Untrusted loop bound

Change-Id: I72d2c4979b62a025d212ce5ee3b7141c40376fa7

1 files changed, 12 insertions, 4 deletions

diff --git a/filter/source/graphicfilter/ios2met/ios2met.cxx b/filter/source/graphicfilter/ios2met/ios2met.cxx
index a23d0cc59339..abe2eeb762c3 100644
--- a/filter/source/graphicfilter/ios2met/ios2met.cxx
+++ b/filter/source/graphicfilter/ios2met/ios2met.cxx
@@ -1012,6 +1012,8 @@ void OS2METReader::ReadChrStr(bool bGivenPos, bool bMove, bool bExtra, sal_uInt1
         else
             nLen = nOrderLen-4;
     }
+    if (nLen > pOS2MET->remainingSize())
+        throw css::uno::Exception("attempt to read past end of input", 0);
     boost::scoped_array<char> pChr(new char[nLen+1]);
     for (i=0; i<nLen; i++)
         pOS2MET->ReadChar( pChr[i] );
@@ -2752,12 +2754,18 @@ GraphicImport( SvStream & rStream, Graphic & rGraphic, FilterConfigItem* )
     GDIMetaFile     aMTF;
     bool            bRet = false;
 
-    aOS2METReader.ReadOS2MET( rStream, aMTF );
+    try
+    {
+        aOS2METReader.ReadOS2MET( rStream, aMTF );
 
-    if ( !rStream.GetError() )
+        if ( !rStream.GetError() )
+        {
+            rGraphic=Graphic( aMTF );
+            bRet = true;
+        }
+    }
+    catch (const css::uno::Exception&)
     {
-        rGraphic=Graphic( aMTF );
-        bRet = true;
     }
 
     return bRet;