coverity#1242624 Untrusted loop bound

Change-Id: I277e98156c9a9832d1f5e968e590356d14b91af6

1 files changed, 6 insertions, 0 deletions

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index 656c93fe6243..3e60db1431ff 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -2203,6 +2203,12 @@ void DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
                 sal_uInt16 nElemSizeSeg = 2;
                 rIn.ReadUInt16( nNumElemSeg ).ReadUInt16( nNumElemMemSeg ).ReadUInt16( nElemSizeSeg );
             }
+            sal_Size nMaxEntriesPossible = rIn.remainingSize() / sizeof(sal_uInt16);
+            if (nNumElemSeg > nMaxEntriesPossible)
+            {
+                SAL_WARN("filter.ms", "NumElem list is longer than remaining bytes, ppt or parser is wrong");
+                nNumElemSeg = nMaxEntriesPossible;
+            }
             if ( nNumElemSeg )
             {
                 sal_Int16 nCommand;