summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid Tardon <dtardon@redhat.com>2015-12-25 19:46:50 +0100
committerDavid Tardon <dtardon@redhat.com>2015-12-25 19:46:50 +0100
commitb6da4cf3b1146170e72c536849d7288376fbd410 (patch)
tree6206ad6c0bed06140075ebfcbe9eedf43c1cb2f5
parentd3c79d44d07776eac7c2ae93448806e7533d4029 (diff)
coverity#1219668 untrusted loop boundlibcdr-0.1.2
Change-Id: If827834918cd2bd54ead2947b0e0cc68a8299983
-rw-r--r--src/lib/CDRParser.cpp2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/lib/CDRParser.cpp b/src/lib/CDRParser.cpp
index 4f32b3d..aa0baa8 100644
--- a/src/lib/CDRParser.cpp
+++ b/src/lib/CDRParser.cpp
@@ -2734,7 +2734,7 @@ void libcdr::CDRParser::readStlt(librevenge::RVNGInputStream *input, unsigned le
input->seek(12 * static_cast<long>(numSet11s), librevenge::RVNG_SEEK_CUR);
}
std::map<unsigned, CDRStltRecord> styles;
- for (i=0; i<numRecords; ++i)
+ for (i=0; i<numRecords && getRemainingLength(input) >= 32; ++i)
{
CDR_DEBUG_MSG(("CDRParser::readStlt parsing styles\n"));
unsigned num = readU32(input);