diff options
| author | David Tardon <dtardon@redhat.com> | 2017-09-15 19:41:18 +0200 |
|---|---|---|
| committer | David Tardon <dtardon@redhat.com> | 2017-09-15 19:41:54 +0200 |
| commit | e5301b388190e7562e4cb0984e94e55636029f7d (patch) | |
| tree | 170c0909cbbccf1ef3f0cc8b1b5d96514d5275d4 | |
| parent | 334cdf5093b093564bfc9f402ff46368b33ac091 (diff) | |
cid#1371573 sanitize loop bound
Change-Id: I590e6ef88f0489b8039e096e79b1c47a5edf3111
| -rw-r--r-- | src/lib/CMXParser.cpp | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/lib/CMXParser.cpp b/src/lib/CMXParser.cpp index 8188066..1f6c2d0 100644 --- a/src/lib/CMXParser.cpp +++ b/src/lib/CMXParser.cpp @@ -1979,6 +1979,7 @@ void libcdr::CMXParser::readIxef(librevenge::RVNGInputStream *input) unsigned numRecords = readU16(input, m_bigEndian); CDR_DEBUG_MSG(("CMXParser::readIxef - numRecords %i\n", numRecords)); + sanitizeNumRecords(numRecords, m_precision, 6, 8 - 1, 0, getRemainingLength(input)); for (unsigned j = 1; j <= numRecords; ++j) { int sizeInFile(0); |