diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2014-10-15 11:10:14 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2014-10-15 16:56:59 +0100 |
| commit | 169433f2945865c49402c43808b114d742a27d0b (patch) | |
| tree | d581ff2e3f2441df6d7dc87b757e7adcc8604504 /sw | |
| parent | 1c118a9536ab7965bb7c3eedd312987ab224385b (diff) | |
coverity#1242817 Untrusted loop bound
Change-Id: I974a80644f70c024f93d081a87204df8cadfa012
Diffstat (limited to 'sw')
| -rw-r--r-- | sw/source/filter/ww8/ww8toolbar.cxx | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sw/source/filter/ww8/ww8toolbar.cxx b/sw/source/filter/ww8/ww8toolbar.cxx index ffb210b63492..35be1a7b65a1 100644 --- a/sw/source/filter/ww8/ww8toolbar.cxx +++ b/sw/source/filter/ww8/ww8toolbar.cxx @@ -1105,6 +1105,8 @@ bool TcgSttbfCore::Read( SvStream& rS ) rS.ReadUInt16( fExtend ).ReadUInt16( cData ).ReadUInt16( cbExtra ); if ( cData ) { + if (cData > rS.remainingSize() / 4) //definitely an invalid record + return false; dataItems = new SBBItem[ cData ]; for ( sal_Int32 index = 0; index < cData; ++index ) { |