mir/libreoffice
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

coverity#1242865 Untrusted loop bound

Browse Source 
Change-Id: I9332fa9b805e702fb56067efc308aff09310f603
This commit is contained in:
Caolán McNamara
2015-09-01 09:25:54 +01:00
parent 5b8e4f3d67
commit 79f060d451
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
basic/source/classes/image.cxx
View File

@@ -258,8 +258,16 @@ bool SbiImage::Load( SvStream& r, sal_uInt32& nVersion )
{
OUString aTypeName = r.ReadUniOrByteString(eCharSet);
sal_Int16 nTypeMembers;
r.ReadInt16(nTypeMembers);
sal_uInt16 nTypeMembers;
r.ReadUInt16(nTypeMembers);
const size_t nMaxTypeMembers = r.remainingSize() / 8;
if (nTypeMembers > nMaxTypeMembers)
{
SAL_WARN("basic", "Parsing error: " << nMaxTypeMembers <<
" max possible entries, but " << nTypeMembers << " claimed, truncating");
nTypeMembers = nMaxTypeMembers;
}
SbxObject *pType = new SbxObject(aTypeName);
SbxArray *pTypeMembers = pType->GetProperties();