sd/source/filter/html/pubdlg.cxx | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
New commits:
commit 84aec8629e4ded68e7417836b9d73fb801df0c45
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sat Mar 27 21:06:15 2021 +0000
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Sun Mar 28 18:08:43 2021 +0200
cid#1474092 Untrusted loop bound
Change-Id: I0a068e98a1d8d8523f188310025808143a5dbcf4
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113237
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
diff --git a/sd/source/filter/html/pubdlg.cxx b/sd/source/filter/html/pubdlg.cxx
index 5fe558f1dd22..47a904bc098e 100644
--- a/sd/source/filter/html/pubdlg.cxx
+++ b/sd/source/filter/html/pubdlg.cxx
@@ -24,6 +24,7 @@
#include <vcl/image.hxx>
#include <vcl/svapp.hxx>
#include <vcl/weld.hxx>
+#include <sal/log.hxx>
#include <svtools/valueset.hxx>
#include <svtools/colrdlg.hxx>
#include <tools/debug.hxx>
@@ -1444,8 +1445,17 @@ void SdPublishingDlg::Load()
SdIOCompat aIO(*pStream, StreamMode::READ);
- sal_uInt16 nDesigns;
- pStream->ReadUInt16( nDesigns );
+ sal_uInt16 nDesigns(0);
+ pStream->ReadUInt16(nDesigns);
+
+ // there has to at least be a sal_uInt16 header in each design
+ const size_t nMaxRecords = pStream->remainingSize() / sizeof(sal_uInt16);
+ if (nDesigns > nMaxRecords)
+ {
+ SAL_WARN("sd", "Parsing error: " << nMaxRecords <<
+ " max possible entries, but " << nDesigns << " claimed,
truncating");
+ nDesigns = nMaxRecords;
+ }
for( sal_uInt16 nIndex = 0;
pStream->GetError() == ERRCODE_NONE && nIndex < nDesigns;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
