diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2015-12-08 14:20:52 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2015-12-08 14:21:36 +0000 |
| commit | 85a2cd37fc60cd53a892b27a18d4b5272988361c (patch) | |
| tree | b3effd97da21fad116f0ebafdb1e8969b5f4883e /lotuswordpro/source/filter/lwptabrack.cxx | |
| parent | 0cdf09089d3c7a790a7c4b20f4cc115d038c75f1 (diff) | |
guard against corrupt m_nNumTabs
Change-Id: I41b8514a127d463ac951e5855f09416fa0456b1b
Diffstat (limited to 'lotuswordpro/source/filter/lwptabrack.cxx')
| -rw-r--r-- | lotuswordpro/source/filter/lwptabrack.cxx | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/lotuswordpro/source/filter/lwptabrack.cxx b/lotuswordpro/source/filter/lwptabrack.cxx index f8317b66a08b..a07fa394bdfa 100644 --- a/lotuswordpro/source/filter/lwptabrack.cxx +++ b/lotuswordpro/source/filter/lwptabrack.cxx @@ -86,11 +86,12 @@ LwpTabRack::LwpTabRack(LwpObjectHeader objHdr, LwpSvStream* pStrm):LwpObject(obj void LwpTabRack::Read() { -// LwpObjectID m_NextID; m_NextID.ReadIndexed(m_pObjStrm); m_nNumTabs = m_pObjStrm->QuickReaduInt16(); - for( int i=0; i<m_nNumTabs; i++ ) + if (m_nNumTabs > MaxTabs) + throw std::out_of_range("corrupt LwpTabRack"); + for (int i=0; i<m_nNumTabs; ++i) { m_aTabs[i].Read(m_pObjStrm); m_pObjStrm->SkipExtra(); |