Sanity-check loop bounds in SHAPE_LINE_CHAIN::Parse

Coverity CID: 128540
KiCad · May 12, 2016 · a488cb0 · a488cb0
1 parent e782e46
commit a488cb0
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/common/geometry/shape_line_chain.cpp b/common/geometry/shape_line_chain.cpp
@@ -570,6 +570,11 @@ bool SHAPE_LINE_CHAIN::Parse( std::stringstream& aStream )
 
     m_points.clear();
     aStream >> n_pts;
+
+    // Rough sanity check, just make sure the loop bounds aren't absolutely outlandish
+    if( n_pts < 0 || n_pts > aStream.str().size() )
+        return false;
+
     aStream >> m_closed;
 
     for( int i = 0; i < n_pts; i++ )
@@ -581,4 +586,4 @@ bool SHAPE_LINE_CHAIN::Parse( std::stringstream& aStream )
     }
 
     return true;
-}
+}