diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-30 10:51:27 +0000 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-30 14:34:26 +0000 |
| commit | 947875577f5c8a926f5c188a0f977a2713f245b1 (patch) | |
| tree | e61d08f9a1b18faca0491379a17d850b0cbf4d72 /svl | |
| parent | c7b0c02ddd1aecb65ca3c82831a4cc779c9c8767 (diff) | |
coverity#1242956 Untrusted loop bound
Change-Id: I590207eee56bf40fbd9138719bbfd1fd05cbcd28
Diffstat (limited to 'svl')
| -rw-r--r-- | svl/source/items/rngitem.cxx | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/svl/source/items/rngitem.cxx b/svl/source/items/rngitem.cxx index 3c093311cab4..71e278fdf127 100644 --- a/svl/source/items/rngitem.cxx +++ b/svl/source/items/rngitem.cxx @@ -106,25 +106,28 @@ SvStream& SfxRangeItem::Store(SvStream &rStream, sal_uInt16) const return rStream; } - SfxUShortRangesItem::SfxUShortRangesItem() : _pRanges(0) { } - SfxUShortRangesItem::SfxUShortRangesItem( sal_uInt16 nWID, SvStream &rStream ) : SfxPoolItem( nWID ) { sal_uInt16 nCount(0); - rStream.ReadUInt16( nCount ); + rStream.ReadUInt16(nCount); + const size_t nMaxEntries = rStream.remainingSize() / sizeof(sal_uInt16); + if (nCount > nMaxEntries) + { + nCount = nMaxEntries; + SAL_WARN("svl.items", "SfxUShortRangesItem: truncated Stream"); + } _pRanges = new sal_uInt16[nCount + 1]; for ( sal_uInt16 n = 0; n < nCount; ++n ) rStream.ReadUInt16( _pRanges[n] ); _pRanges[nCount] = 0; } - SfxUShortRangesItem::SfxUShortRangesItem( const SfxUShortRangesItem& rItem ) : SfxPoolItem( rItem ) { @@ -133,7 +136,6 @@ SfxUShortRangesItem::SfxUShortRangesItem( const SfxUShortRangesItem& rItem ) memcpy( _pRanges, rItem._pRanges, sizeof(sal_uInt16) * nCount ); } - SfxUShortRangesItem::~SfxUShortRangesItem() { delete _pRanges; |