[Libreoffice-commits] core.git: Branch 'libreoffice-5-0' - oox/source

[Andras Timar]

 oox/source/export/drawingml.cxx |   12 ++++++++++++
 1 file changed, 12 insertions(+)

New commits:
commit 078a9feb1b6c0839cc9c9822584e8dfbc6d930bf
Author: Andras Timar <andras.timar at collabora.com>
Date:   Sat May 30 13:39:14 2015 +0200

    another DrawingML export crash fix
    
    Change-Id: I0386b4a768a9ac51cb86ac1c3edb17c41caf821a
    Reviewed-on: https://gerrit.libreoffice.org/15993
    Tested-by: Jenkins <ci at libreoffice.org>
    Reviewed-by: Andras Timar <andras.timar at collabora.com>
    (cherry picked from commit a819691ecc32586e800566d74ac22b474430d685)

diff --git a/oox/source/export/drawingml.cxx b/oox/source/export/drawingml.cxx
index 0becb68..15a8cb7 100644
--- a/oox/source/export/drawingml.cxx
+++ b/oox/source/export/drawingml.cxx
@@ -2253,6 +2253,18 @@ void DrawingML::WriteCustomGeometry( Reference< XShape > rXShape )
                 if ( !aPairs.hasElements() || !aSegments.hasElements() )
                     return;
 
+                int nExpectedPairCount = 0;
+                for( int j = 0; j < aSegments.getLength(); ++j )
+                {
+                    nExpectedPairCount += aSegments[j].Count;
+                }
+
+                if ( nExpectedPairCount > aPairs.getLength() )
+                {
+                    SAL_WARN("oox", "Segments need " << nExpectedPairCount << " coordinates, but Coordinates have only " << aPairs.getLength() << " pairs.");
+                    return;
+                }
+
                 mpFS->startElementNS( XML_a, XML_custGeom, FSEND );
                 mpFS->singleElementNS( XML_a, XML_avLst, FSEND );
                 mpFS->singleElementNS( XML_a, XML_gdLst, FSEND );