[Libreoffice-commits] core.git: Branch 'libreoffice-4-3' - oox/source

[Michael Meeks]

 oox/source/export/vmlexport.cxx |    8 ++++++++
 1 file changed, 8 insertions(+)

New commits:
commit 591e10c106d9672559672f43346cf000f3a734b3
Author: Michael Meeks <michael.meeks at collabora.com>
Date:   Tue Jun 3 22:55:05 2014 +0100

    Be more sensible about checking buffers of VML points we write.
    
    Change-Id: Id3811dbe0cf2510ef6a851804b3886c14eca01b6
    (cherry picked from commit a2d2c7f707838511ede017ed920205b9165a35a2)

diff --git a/oox/source/export/vmlexport.cxx b/oox/source/export/vmlexport.cxx
index 0f3038b..f315766 100644
--- a/oox/source/export/vmlexport.cxx
+++ b/oox/source/export/vmlexport.cxx
@@ -519,6 +519,14 @@ void VMLExport::Commit( EscherPropertyContainer& rProps, const Rectangle& rRect
                                     break;
                                 default:
                                     // See EscherPropertyContainer::CreateCustomShapeProperties, by default nSeg is simply the number of points.
+                                    // FIXME: we miss out a significant amount of complexity from
+                                    // the above method here, and do some rather odd things to match.
+                                    int nElems = aVertices.nPropSize / ( nPointSize * 2);
+                                    if (nSeg > nElems)
+                                    {
+                                        SAL_WARN("oox", "Busted escher export " << nSeg << "vs . " << nElems << " truncating point stream");
+                                        nSeg = nElems;
+                                    }
                                     for (int i = 0; i < nSeg; ++i)
                                     {
                                         sal_Int32 nX = impl_GetPointComponent(pVerticesIt, nPointSize);