editeng/source/items/numitem.cxx | 6 ++++++
1 file changed, 6 insertions(+)
New commits:
commit e8944ef20974cf44d2e25667c6c34d231d9a66e3
Author: Caolán McNamara <caol...@redhat.com>
AuthorDate: Sat Mar 27 20:53:53 2021 +0000
Commit: Caolán McNamara <caol...@redhat.com>
CommitDate: Sun Mar 28 15:37:12 2021 +0200
cid#1473839 Untrusted loop bound
Change-Id: Iedb13791e19f635117040698e1fc45a5c1c3968d
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/113235
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caol...@redhat.com>
diff --git a/editeng/source/items/numitem.cxx b/editeng/source/items/numitem.cxx
index 5873cfb05781..0c48262f323f 100644
--- a/editeng/source/items/numitem.cxx
+++ b/editeng/source/items/numitem.cxx
@@ -645,6 +645,12 @@ SvxNumRule::SvxNumRule( SvStream &rStream )
rStream.ReadUInt16( nTmp16 ); // NUM_ITEM_VERSION
rStream.ReadUInt16( nLevelCount );
+ if (nLevelCount > SVX_MAX_NUM)
+ {
+ SAL_WARN("editeng", "nLevelCount: " << nLevelCount << " greater than
max of: " << SVX_MAX_NUM);
+ nLevelCount = SVX_MAX_NUM;
+ }
+
// first nFeatureFlags of old Versions
rStream.ReadUInt16( nTmp16 ); nFeatureFlags =
static_cast<SvxNumRuleFlags>(nTmp16);
rStream.ReadUInt16( nTmp16 ); bContinuousNumbering = nTmp16;
_______________________________________________
Libreoffice-commits mailing list
libreoffice-comm...@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/libreoffice-commits
