diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-14 15:21:27 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-14 17:09:25 +0100 |
| commit | ac68cab1f1e6991bc95fe482f4d9be1538b827c4 (patch) | |
| tree | 6a6dabe19d9fff90e87bf2a6e40e349a49de7328 /lotuswordpro | |
| parent | da859a7949238e74e5287f1bacc61886b4294858 (diff) | |
coverity#1242739 Untrusted loop bound
and
coverity#1242739 Untrusted loop bound
Change-Id: I2cab9b3c531befc42c1522dd0d4beb59df7ae315
Diffstat (limited to 'lotuswordpro')
| -rw-r--r-- | lotuswordpro/source/filter/lwpdrawobj.cxx | 23 |
1 files changed, 18 insertions, 5 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index 4ae627918441..2ca16adec056 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -1209,10 +1209,14 @@ void LwpDrawTextArt::Read() sal_uInt16 nPointNumber; sal_Int16 nX, nY; m_pStream->ReadUInt16( nPointNumber ); + + size_t nPoints = nPointNumber*3+1; + if (nPoints > m_pStream->remainingSize() / 4) + throw BadRead(); + m_aTextArtRec.aPath[0].n = nPointNumber; - m_aTextArtRec.aPath[0].pPts = new SdwPoint [nPointNumber*3+1]; - sal_uInt16 nPt = 0; - for ( nPt = 0; nPt <= nPointNumber*3; nPt++) + m_aTextArtRec.aPath[0].pPts = new SdwPoint[nPoints]; + for (size_t nPt = 0; nPt < nPoints; ++nPt) { m_pStream->ReadInt16( nX ); m_pStream->ReadInt16( nY ); @@ -1221,9 +1225,14 @@ void LwpDrawTextArt::Read() } m_pStream->ReadUInt16( nPointNumber ); + + nPoints = nPointNumber*3+1; + if (nPoints > m_pStream->remainingSize() / 4) + throw BadRead(); + m_aTextArtRec.aPath[1].n = nPointNumber; - m_aTextArtRec.aPath[1].pPts = new SdwPoint [nPointNumber*3+1]; - for (nPt = 0; nPt <= nPointNumber*3; nPt++) + m_aTextArtRec.aPath[1].pPts = new SdwPoint[nPoints]; + for (size_t nPt = 0; nPt < nPoints; ++nPt) { m_pStream->ReadInt16( nX ); m_pStream->ReadInt16( nY ); @@ -1251,6 +1260,10 @@ void LwpDrawTextArt::Read() - (m_aTextArtRec.aPath[0].n*3 + 1)*4 - (m_aTextArtRec.aPath[1].n*3 + 1)*4; + + if (m_aTextArtRec.nTextLen > m_pStream->remainingSize()) + throw BadRead(); + m_aTextArtRec.pTextString = new sal_uInt8 [m_aTextArtRec.nTextLen]; m_pStream->Read(m_aTextArtRec.pTextString, m_aTextArtRec.nTextLen); m_aTextArtRec.pTextString[m_aTextArtRec.nTextLen-1] = 0; |