diff options
| author | David Tardon <dtardon@redhat.com> | 2017-09-15 18:00:21 +0200 |
|---|---|---|
| committer | David Tardon <dtardon@redhat.com> | 2017-09-15 19:41:43 +0200 |
| commit | 0716f26b967a29dd8b4b843f092ede509c101d7e (patch) | |
| tree | a70412067dfa0db336699675dcdc20e7153371f6 | |
| parent | fdfcdd5ec28ba5e500be0b44d86ac926d2d86213 (diff) | |
cid#1371574 sanitize loop bound
Change-Id: I6cf6ee216bb4d722912164a7f4a7b4099017e887
| -rw-r--r-- | src/lib/CMXParser.cpp | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/lib/CMXParser.cpp b/src/lib/CMXParser.cpp index aa8666f..202287d 100644 --- a/src/lib/CMXParser.cpp +++ b/src/lib/CMXParser.cpp @@ -1672,6 +1672,7 @@ void libcdr::CMXParser::readRclr(librevenge::RVNGInputStream *input) unsigned numRecords = readU16(input, m_bigEndian); CDR_DEBUG_MSG(("CMXParser::readRclr - numRecords %i\n", numRecords)); + sanitizeNumRecords(numRecords, m_precision, 2, 2 + 0, 2, getRemainingLength(input)); for (unsigned j = 1; j <= numRecords; ++j) { CDR_DEBUG_MSG(("Color index %i\n", j)); |