commit dcad3ac445980740b6a39761cdd1f1bd0b3e6e34
author Caolán McNamara <caolanm@redhat.com> Mon Feb 02 10:05:04 2015 +0000
committer Caolán McNamara <caolanm@redhat.com> Mon Feb 02 10:57:19 2015 +0000
tree 6b4c1e82fcd5a4e641bdb0f6bfb27430f7cbcb9b
parent 71b87e381bc8cbab588cf4194c2b290b0531d5b4

coverity#1242624 Untrusted loop bound

Change-Id: Idf52c09828c2bab767e9ff0d07b61befd6bfc64b

filter/source/msfilter/msdffimp.cxx

diff --git a/filter/source/msfilter/msdffimp.cxx b/filter/source/msfilter/msdffimp.cxx
index 77b6b80..656c93f 100644
--- a/filter/source/msfilter/msdffimp.cxx
+++ b/filter/source/msfilter/msdffimp.cxx
@@ -2153,13 +2153,19 @@ void DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
                sal_uInt16 nNumElemMemVert = 0;
                rIn.ReadUInt16( nNumElemVert ).ReadUInt16( nNumElemMemVert ).ReadUInt16( nElemSizeVert );
            }
            if ( nNumElemVert )
            bool bImport = false;
            if (nElemSizeVert == 8 || nElemSizeVert == 4)
            {
                sal_Int32 nX, nY;
                sal_Int16 nTmpA, nTmpB;
                //sanity check that the stream is long enough to fulfill nNumElem * nElemSize;
                bImport = rIn.remainingSize() / nElemSizeVert >= nNumElemVert;
            }
            if (bImport)
            {
                aCoordinates.realloc( nNumElemVert );
                for ( sal_uInt16 i = 0; i < nNumElemVert; i++ )
                for (sal_uInt16 i = 0; i < nNumElemVert; ++i)
                {
                    sal_Int32 nX(0), nY(0);

                    if ( nElemSizeVert == 8 )
                    {
                        rIn.ReadInt32( nX )
@@ -2167,6 +2173,7 @@ void DffPropertyReader::ApplyCustomShapeGeometryAttributes( SvStream& rIn, SfxIt
                    }
                    else
                    {
                        sal_Int16 nTmpA(0), nTmpB(0);
                        rIn.ReadInt16( nTmpA )
                           .ReadInt16( nTmpB );