mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

coverity#1362681 Untrusted loop bound

Browse Source 
and

coverity#1362682 Untrusted loop bound

Change-Id: I97eacad09abed4f91744b36f572761e43a3477fb
This commit is contained in:
Caolán McNamara
2016-06-11 20:53:18 +01:00
parent 51a09942d9
commit 08c9c0a3ae
1 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
lotuswordpro/source/filter/lwpsdwgrouploaderv0102.cxx
View File

@@ -115,12 +115,12 @@ void LwpSdwGroupLoaderV0102::BeginDrawObjects(std::vector< rtl::Reference<XFFram
// topObj, botObj // topObj, botObj
m_pStream->SeekRel(4); m_pStream->SeekRel(4);
//record count //record count
unsigned short nRecCount; unsigned short nRecCount(0);
m_pStream->ReadUInt16(nRecCount); m_pStream->ReadUInt16(nRecCount);
// selCount // selCount
m_pStream->SeekRel(2); m_pStream->SeekRel(2);
//boundrect //boundrect
unsigned short left,top,right,bottom; unsigned short left(0),top(0),right(0),bottom(0);
m_pStream->ReadUInt16(left); m_pStream->ReadUInt16(left);
m_pStream->ReadUInt16(top); m_pStream->ReadUInt16(top);
m_pStream->ReadUInt16(right); m_pStream->ReadUInt16(right);
@@ -222,6 +222,12 @@ void LwpSdwGroupLoaderV0102::BeginDrawObjects(std::vector< rtl::Reference<XFFram
} }
} }
if (nRecCount > m_pStream->remainingSize())
{
SAL_WARN("lwp", "stream too short for claimed no of records");
nRecCount = m_pStream->remainingSize();
}
//load draw object //load draw object
for (unsigned short i = 0; i < nRecCount; i++) for (unsigned short i = 0; i < nRecCount; i++)
{ {
@@ -260,12 +266,12 @@ XFDrawGroup* LwpSdwGroupLoaderV0102::CreateDrawGroupObject()
// topObj, botObj // topObj, botObj
m_pStream->SeekRel(4); m_pStream->SeekRel(4);
//record count //record count
unsigned short nRecCount; unsigned short nRecCount(0);
m_pStream->ReadUInt16(nRecCount); m_pStream->ReadUInt16(nRecCount);
// selCount // selCount
m_pStream->SeekRel(2); m_pStream->SeekRel(2);
//boundrect //boundrect
unsigned short left,top,right,bottom; unsigned short left(0),top(0),right(0),bottom(0);
m_pStream->ReadUInt16(left); m_pStream->ReadUInt16(left);
m_pStream->ReadUInt16(top); m_pStream->ReadUInt16(top);
m_pStream->ReadUInt16(right); m_pStream->ReadUInt16(right);
@@ -275,6 +281,12 @@ XFDrawGroup* LwpSdwGroupLoaderV0102::CreateDrawGroupObject()
XFDrawGroup* pXFDrawGroup = new XFDrawGroup(); XFDrawGroup* pXFDrawGroup = new XFDrawGroup();
if (nRecCount > m_pStream->remainingSize())
{
SAL_WARN("lwp", "stream too short for claimed no of records");
nRecCount = m_pStream->remainingSize();
}
//load draw object //load draw object
for (unsigned short i = 0; i < nRecCount; i++) for (unsigned short i = 0; i < nRecCount; i++)
{ {
@@ -303,7 +315,7 @@ XFDrawGroup* LwpSdwGroupLoaderV0102::CreateDrawGroupObject()
XFFrame* LwpSdwGroupLoaderV0102::CreateDrawObject() XFFrame* LwpSdwGroupLoaderV0102::CreateDrawObject()
{ {
//record type //record type
unsigned char recType; unsigned char recType(0);
m_pStream->ReadUChar(recType); m_pStream->ReadUChar(recType);
LwpDrawObj* pDrawObj = nullptr; LwpDrawObj* pDrawObj = nullptr;