From a819691ecc32586e800566d74ac22b474430d685 Mon Sep 17 00:00:00 2001 From: Andras Timar Date: Sat, 30 May 2015 13:39:14 +0200 Subject: another DrawingML export crash fix Change-Id: I0386b4a768a9ac51cb86ac1c3edb17c41caf821a Reviewed-on: https://gerrit.libreoffice.org/15993 Tested-by: Jenkins Reviewed-by: Andras Timar --- oox/source/export/drawingml.cxx | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'oox') diff --git a/oox/source/export/drawingml.cxx b/oox/source/export/drawingml.cxx index 3887e0eae865..b02e8b1741c4 100644 --- a/oox/source/export/drawingml.cxx +++ b/oox/source/export/drawingml.cxx @@ -2253,6 +2253,18 @@ void DrawingML::WriteCustomGeometry( Reference< XShape > rXShape ) if ( !aPairs.hasElements() || !aSegments.hasElements() ) return; + int nExpectedPairCount = 0; + for( int j = 0; j < aSegments.getLength(); ++j ) + { + nExpectedPairCount += aSegments[j].Count; + } + + if ( nExpectedPairCount > aPairs.getLength() ) + { + SAL_WARN("oox", "Segments need " << nExpectedPairCount << " coordinates, but Coordinates have only " << aPairs.getLength() << " pairs."); + return; + } + mpFS->startElementNS( XML_a, XML_custGeom, FSEND ); mpFS->singleElementNS( XML_a, XML_avLst, FSEND ); mpFS->singleElementNS( XML_a, XML_gdLst, FSEND ); -- cgit