diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-11-14 11:35:00 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-11-14 12:02:51 +0000 |
| commit | 8e6c22d74933c7157e083e97d56106b36a166559 (patch) | |
| tree | a3656ec79c80773deebadbf85f5d116e66f1f426 /filter | |
| parent | 642cf9af84ab6a33b0853753499bab4d96be8f7c (diff) | |
coverity#1209889 Untrusted loop bound
Change-Id: I63039ca0de1dc54b5aa9d048e5110c31bf930bdc
Diffstat (limited to 'filter')
| -rw-r--r-- | filter/source/graphicfilter/icgm/class5.cxx | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/filter/source/graphicfilter/icgm/class5.cxx b/filter/source/graphicfilter/icgm/class5.cxx index a1a9bfb039ba..763971a9f064 100644 --- a/filter/source/graphicfilter/icgm/class5.cxx +++ b/filter/source/graphicfilter/icgm/class5.cxx @@ -461,10 +461,18 @@ void CGM::ImplDoClass5() sal_uInt32 i, nColorFrom = 0; sal_uInt32 nColorTo = 0xffffff; - //FIXME, does this loop actually do anything? + const size_t nRemainingSize = mpEndValidSource - (mpSource + mnParaSize); + const size_t nMaxPossibleRecords = nRemainingSize/pElement->nRealSize; + + if (nNumberOfStages > nMaxPossibleRecords) + { + mbStatus = false; + break; + } + for ( i = 0; i < nNumberOfStages; i++ ) { - ImplGetFloat( pElement->eRealPrecision, pElement->nRealSize ); // -Wall is this needed + ImplGetFloat(pElement->eRealPrecision, pElement->nRealSize); } for ( i = 0; i <= nNumberOfStages; i++ ) |