diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-14 15:12:05 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-14 17:09:24 +0100 |
| commit | e4ebd97a9b5dc3a25a142109d2a0dbe41925e431 (patch) | |
| tree | 357ba63251c5770107655e7337875ac2a9db9096 /lotuswordpro | |
| parent | 902a3df2daa196e2182b0741f0ec3849d158f42b (diff) | |
coverity#1242918 Untrusted loop bound
Change-Id: I8575a43a095165a81417f169463aaf2c4ab337e8
Diffstat (limited to 'lotuswordpro')
| -rw-r--r-- | lotuswordpro/source/filter/lwpdrawobj.cxx | 5 | ||||
| -rw-r--r-- | lotuswordpro/source/filter/lwptools.hxx | 6 |
2 files changed, 10 insertions, 1 deletions
diff --git a/lotuswordpro/source/filter/lwpdrawobj.cxx b/lotuswordpro/source/filter/lwpdrawobj.cxx index 4be146f0f89c..f357f9d359ae 100644 --- a/lotuswordpro/source/filter/lwpdrawobj.cxx +++ b/lotuswordpro/source/filter/lwpdrawobj.cxx @@ -505,7 +505,10 @@ void LwpDrawPolyLine::Read() m_pStream->ReadUChar( m_aPolyLineRec.aPenColor.unused ); m_pStream->ReadUInt16( m_aPolyLineRec.nNumPoints ); - m_pVector= new SdwPoint [m_aPolyLineRec.nNumPoints]; + if (m_aPolyLineRec.nNumPoints > m_pStream->remainingSize() / 4) + throw BadRead(); + + m_pVector= new SdwPoint[m_aPolyLineRec.nNumPoints]; for (sal_uInt16 nC = 0; nC < m_aPolyLineRec.nNumPoints; nC++) { diff --git a/lotuswordpro/source/filter/lwptools.hxx b/lotuswordpro/source/filter/lwptools.hxx index 51680bda1eb2..f240214ed02a 100644 --- a/lotuswordpro/source/filter/lwptools.hxx +++ b/lotuswordpro/source/filter/lwptools.hxx @@ -148,6 +148,12 @@ public: BadSeek() : std::runtime_error("Lotus Word Pro Bad Seek") { } }; +class BadRead: public std::runtime_error +{ +public: + BadRead() : std::runtime_error("Lotus Word Pro Bad Read") { } +}; + class BadDecompress : public std::runtime_error { public: |