diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-01-25 21:05:37 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-01-25 21:05:37 +0000 |
| commit | a046795194f0540b5752887b837bb15d43ddcdda (patch) | |
| tree | 23d0006c8d158b1b73e95ecce45afa5addf6962a /filter | |
| parent | 2987f8d8d6bb005814660a1a10a5eebb74aef312 (diff) | |
coverity#1266496 Untrusted loop bound
Change-Id: Ibab7f84940f6eec75bc3ee914bac59a07689a80c
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/itiff/itiff.cxx | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/filter/source/graphicfilter/itiff/itiff.cxx b/filter/source/graphicfilter/itiff/itiff.cxx index cd56f63af437..edd1aa01fd8e 100644 --- a/filter/source/graphicfilter/itiff/itiff.cxx +++ b/filter/source/graphicfilter/itiff/itiff.cxx @@ -1266,6 +1266,15 @@ bool TIFFReader::ReadTIFF(SvStream & rTIFF, Graphic & rGraphic ) pTIFF->ReadUInt16( nNumTags ); nPos = pTIFF->Tell(); + const size_t nMinRecordSize = 8; + const size_t nMaxRecords = pTIFF->remainingSize() / nMinRecordSize; + if (nNumTags > nMaxRecords) + { + SAL_WARN("filter.tiff", "Parsing error: " << nMaxRecords << + " max possible entries, but " << nNumTags << " claimed, truncating"); + nNumTags = nMaxRecords; + } + // Schleife ueber Tags: for( i = 0; i < nNumTags; i++ ) { |