commit 92a5c6d2c0d0ec4ec4df689f96065574b83a3657
author Bartosz Kosiorek <gang65@poczta.onet.pl> Mon Apr 03 01:09:10 2017 +0200
committer Bartosz Kosiorek <gang65@poczta.onet.pl> Fri Apr 07 19:56:52 2017 +0000
tree bf5cdc8e3c9c854d15f20dd2c09e84b56ad11c87
parent 5ce387c4812466e6752b434cf0f5a54f98c6a147

Read number of polylines as UInt32 according to documentation

Change-Id: I7ef8c66485044e2543dc8d9a9e589537eb36f70f
Reviewed-on: https://gerrit.libreoffice.org/36025
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Bartosz Kosiorek <gang65@poczta.onet.pl>

vcl/source/filter/wmf/enhwmf.cxx

diff --git a/vcl/source/filter/wmf/enhwmf.cxx b/vcl/source/filter/wmf/enhwmf.cxx
index 0d8a9b0..7508926 100644
--- a/vcl/source/filter/wmf/enhwmf.cxx
+++ b/vcl/source/filter/wmf/enhwmf.cxx
@@ -541,27 +541,27 @@ template <class T>
void EnhWMFReader::ReadAndDrawPolyLine()
{
    sal_uInt32  nPoints;
    sal_Int32   i, nPoly(0), nGesPoints(0);
    pWMF->SeekRel( 0x10 );
    // Number of Polygons:
    pWMF->ReadInt32( nPoly ).ReadInt32( nGesPoints );
    sal_uInt32  i, nNumberOfPolylines( 0 ), nCount( 0 );
    pWMF->SeekRel( 0x10 ); // TODO Skipping Bounds. A 128-bit WMF RectL object (specifies the bounding rectangle in device units.)
    pWMF->ReadUInt32( nNumberOfPolylines );
    pWMF->ReadUInt32( nCount ); // total number of points in all polylines

    // taking the amount of points of each polygon, retrieving the total number of points
    if ( pWMF->good() &&
         ( static_cast< sal_uInt32 >(nPoly) < SAL_MAX_UINT32 / sizeof(sal_uInt16) ) &&
         ( static_cast< sal_uInt32 >( nPoly ) * sizeof(sal_uInt16) ) <= ( nEndPos - pWMF->Tell() )
         ( nNumberOfPolylines < SAL_MAX_UINT32 / sizeof( sal_uInt16 ) ) &&
         ( nNumberOfPolylines * sizeof( sal_uInt16 ) ) <= ( nEndPos - pWMF->Tell() )
       )
    {
        std::unique_ptr<sal_uInt16[]> pnPoints(new sal_uInt16[ nPoly ]);
        for ( i = 0; i < nPoly && pWMF->good(); i++ )
        std::unique_ptr< sal_uInt32[] > pnPolylinePointCount( new sal_uInt32[ nNumberOfPolylines ] );
        for ( i = 0; i < nNumberOfPolylines && pWMF->good(); i++ )
        {
            pWMF->ReadUInt32( nPoints );
            pnPoints[ i ] = (sal_uInt16)nPoints;
            pnPolylinePointCount[ i ] = nPoints;
        }
        // Get polygon points:
        for ( i = 0; ( i < nPoly ) && pWMF->good(); i++ )
        // Get polyline points:
        for ( i = 0; ( i < nNumberOfPolylines ) && pWMF->good(); i++ )
        {
            tools::Polygon aPolygon = ReadPolygon<T>(0, pnPoints[i]);
            tools::Polygon aPolygon = ReadPolygon< T >( 0, pnPolylinePointCount[ i ] );
            pOut->DrawPolyLine( aPolygon, false, bRecordPath );
        }
    }