From: msv <msv@opencascade.com>
Date: Fri, 22 Jul 2016 09:07:24 +0000 (+0300)
Subject: 0027703: BinTools_ShapeSet stream read bug
X-Git-Tag: V7_1_0_beta~239
X-Git-Url: http://git.dev.opencascade.org/gitweb/?a=commitdiff_plain;h=1aee6c821041d2cbe63b35cb2c53b57454cfb227;p=occt-copy.git

0027703: BinTools_ShapeSet stream read bug

Avoid out of array bounds read/write.
---

diff --git a/src/BinTools/BinTools_ShapeSet.cxx b/src/BinTools/BinTools_ShapeSet.cxx
index 5008ddffc1..5ab0c6b2ba 100644
--- a/src/BinTools/BinTools_ShapeSet.cxx
+++ b/src/BinTools/BinTools_ShapeSet.cxx
@@ -395,8 +395,11 @@ void  BinTools_ShapeSet::Read(Standard_IStream& IS)
     IS.getline(vers,100,'\n');
     // BUC60769 PTV 18.10.2000: remove possible '\r' at the end of the line
     
-    for (Standard_Size lv = (strlen(vers)- 1); lv > 1 && (vers[lv] == '\r' || vers[lv] == '\n') ;lv--) 
-      vers[lv] = '\0';
+    Standard_Size lv = strlen(vers);
+    if (lv > 0) {
+      for (lv--; lv > 0 && (vers[lv] == '\r' || vers[lv] == '\n'); lv--)
+        vers[lv] = '\0';
+    }
     
   } while ( ! IS.fail() && strcmp(vers,Version_1) && strcmp(vers,Version_2) &&
 	   strcmp(vers,Version_3));