summaryrefslogtreecommitdiff
path: root/sw/source
diff options
context:
space:
mode:
authorCaolán McNamara <caolanm@redhat.com>2015-12-12 20:41:31 +0000
committerCaolán McNamara <caolanm@redhat.com>2015-12-12 20:42:17 +0000
commit90ccda6242e9386f1825be9ded7ce66e01493565 (patch)
tree8ff3b6bfd33f34d4fb84fb4379ece6f9ab080e80 /sw/source
parent18952ac1de81b522f5fef36ff922c4a0dc29499d (diff)
coverity#1341876 Untrusted loop bound
Change-Id: I5191a48d3cadc8b9e4c1cc5f4ea99adb0071002f
Diffstat (limited to 'sw/source')
-rw-r--r--sw/source/filter/ww8/ww8scan.cxx11
1 files changed, 9 insertions, 2 deletions
diff --git a/sw/source/filter/ww8/ww8scan.cxx b/sw/source/filter/ww8/ww8scan.cxx
index 144013d72561..842f5570bbcb 100644
--- a/sw/source/filter/ww8/ww8scan.cxx
+++ b/sw/source/filter/ww8/ww8scan.cxx
@@ -6347,8 +6347,8 @@ void MSOPropertyBagStore::Read(SvStream& rStream)
}
MSOProperty::MSOProperty()
- : m_nKey(0),
- m_nValue(0)
+ : m_nKey(0)
+ , m_nValue(0)
{
}
@@ -6369,6 +6369,13 @@ void MSOPropertyBag::Read(SvStream& rStream)
sal_uInt16 cProp(0);
rStream.ReadUInt16(cProp);
rStream.SeekRel(2); // cbUnknown
+ //each MSOProperty is 8 bytes in size
+ size_t nMaxPossibleRecords = rStream.remainingSize() / 8;
+ if (cProp > nMaxPossibleRecords)
+ {
+ SAL_WARN("sw.ww8", cProp << " records claimed, but max possible is " << nMaxPossibleRecords);
+ cProp = nMaxPossibleRecords;
+ }
for (sal_uInt16 i = 0; i < cProp; ++i)
{
MSOProperty aProperty;