diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-17 10:06:45 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-17 15:19:56 +0100 |
| commit | cf63ebe0f005513c1e989682459bcd0688eb190b (patch) | |
| tree | 7dc4cc8c4d453c0f85bcb94655633b48c88af850 /filter/source/msfilter | |
| parent | bbe264a19fb82f50d859fc72a47312db0527640f (diff) | |
coverity#1242717 Untrusted loop bound
Change-Id: I983bba075ab9626c90555fa41f9d473ae60fafea
Diffstat (limited to 'filter/source/msfilter')
| -rw-r--r-- | filter/source/msfilter/msdffimp.cxx | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx index fdb4898384b5..8336db723eb2 100644 --- a/filter/source/msfilter/msdffimp.cxx +++ b/filter/source/msfilter/msdffimp.cxx @@ -1066,14 +1066,20 @@ void GetShadeColors( const SvxMSDffManager& rManager, const DffPropertyReader& r sal_uInt32 nPos = rIn.Tell(); if ( rProperties.IsProperty( DFF_Prop_fillShadeColors ) ) { - if ( rProperties.SeekToContent( DFF_Prop_fillShadeColors, rIn ) ) + sal_uInt16 i = 0, nNumElem = 0, nNumElemReserved = 0, nSize = 0; + bool bOk = false; + if (rProperties.SeekToContent(DFF_Prop_fillShadeColors, rIn)) { - sal_uInt16 i = 0, nNumElem = 0, nNumElemReserved = 0, nSize = 0; rIn.ReadUInt16( nNumElem ).ReadUInt16( nNumElemReserved ).ReadUInt16( nSize ); + //sanity check that the stream is long enough to fulfill nNumElem * 2 sal_Int32s + bOk = rIn.remainingSize() / (2*sizeof(sal_Int32)) >= nNumElem; + } + if (bOk) + { for ( ; i < nNumElem; i++ ) { - sal_Int32 nColor; - sal_Int32 nDist; + sal_Int32 nColor(0); + sal_Int32 nDist(0); rIn.ReadInt32( nColor ).ReadInt32( nDist ); rShadeColors.push_back( ShadeColor( rManager.MSO_CLR_ToColor( nColor, DFF_Prop_fillColor ), 1.0 - ( nDist / 65536.0 ) ) ); |