Sanity-check loop bounds in SHAPE_LINE_CHAIN::Parse

Coverity CID: 128540
2016-05-11 23:28:08 -04:00 · 2016-05-11 23:28:08 -04:00 · a488cb0142
parent e782e463f4
commit a488cb0142
1 changed files with 6 additions and 1 deletions
--- a/common/geometry/shape_line_chain.cpp
+++ b/common/geometry/shape_line_chain.cpp
@ -570,6 +570,11 @@ bool SHAPE_LINE_CHAIN::Parse( std::stringstream& aStream )

    m_points.clear();
    aStream >> n_pts;
+
+    // Rough sanity check, just make sure the loop bounds aren't absolutely outlandish
+    if( n_pts < 0 || n_pts > aStream.str().size() )
+        return false;
+
    aStream >> m_closed;

    for( int i = 0; i < n_pts; i++ )