From 0193c048c1d6c4706bac9f098844812f3b13a9e1 Mon Sep 17 00:00:00 2001
From: Oliver Bolte <obo@openoffice.org>
Date: Wed, 11 Oct 2006 08:24:48 +0000
Subject: [PATCH] INTEGRATION: CWS cmcfixes28 (1.30.18); FILE MERGED 2006/10/02
 14:38:05 cmc 1.30.18.1: #i70042# ignore out of bounds wmf/emf values

---
 svtools/source/filter.vcl/wmf/winwmf.cxx | 30 ++++++++++++++----------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/svtools/source/filter.vcl/wmf/winwmf.cxx b/svtools/source/filter.vcl/wmf/winwmf.cxx
index 3ee51aef8739..7238553e5443 100644
--- a/svtools/source/filter.vcl/wmf/winwmf.cxx
+++ b/svtools/source/filter.vcl/wmf/winwmf.cxx
@@ -4,9 +4,9 @@
  *
  *  $RCSfile: winwmf.cxx,v $
  *
- *  $Revision: 1.30 $
+ *  $Revision: 1.31 $
  *
- *  last change: $Author: obo $ $Date: 2006-09-17 14:55:43 $
+ *  last change: $Author: obo $ $Date: 2006-10-11 09:24:48 $
  *
  *  The Contents of this file are made available subject to
  *  the terms of GNU Lesser General Public License Version 2.1.
@@ -866,17 +866,21 @@ void WMFReader::ReadRecordParams( USHORT nFunc )
                                         aMemoryStream >> aPt.X()
                                                       >> aPt.Y()
                                                       >> nStringLen;
-                                        sal_Unicode* pBuf = aString.AllocBuffer( (sal_uInt16)nStringLen );
-                                        for ( i = 0; i < nStringLen; i++ )
-                                            aMemoryStream >> pBuf[ i ];
-                                        aMemoryStream >> nDXCount;
-                                        if ( nDXCount )
-                                            pDXAry = new sal_Int32[ nDXCount ];
-                                        for  ( i = 0; i < nDXCount; i++ )
-                                            aMemoryStream >> pDXAry[ i ];
-                                        aMemoryStream >> nSkipActions;
-                                        pOut->DrawText( aPt, aString, pDXAry );
-                                        delete[] pDXAry;
+
+                                        if (nStringLen < STRING_MAXLEN)
+                                        {
+                                            sal_Unicode* pBuf = aString.AllocBuffer( (xub_StrLen)nStringLen );
+                                            for ( i = 0; i < nStringLen; i++ )
+                                                aMemoryStream >> pBuf[ i ];
+                                            aMemoryStream >> nDXCount;
+                                            if ( nDXCount )
+                                                pDXAry = new sal_Int32[ nDXCount ];
+                                            for  ( i = 0; i < nDXCount; i++ )
+                                                aMemoryStream >> pDXAry[ i ];
+                                            aMemoryStream >> nSkipActions;
+                                            pOut->DrawText( aPt, aString, pDXAry );
+                                            delete[] pDXAry;
+                                        }
                                     }
                                 }
                                 break;