VML import: don't assume both parameters are available while parsing commands

The problematic path was "m,l21600,r,21600l,21600xem@1@0l@3@2nfe", here
"m,l" means an implicit "m0,0l", but only the first zero is in the
coords list. If the second is missing, assume 0 as well.

Change-Id: I03065e34c959103c9caf64271aa3ebbb7ad52726

oox/source/vml/vmlformatting.cxx

@@ -332,7 +332,7 @@ void ConversionHelper::decodeVmlPath( ::std::vector< ::std::vector< Point > >& r
                         rPointLists.push_back( ::std::vector< Point >() );
                         rFlagLists.push_back( ::std::vector< PolygonFlags >() );
                     }
-                    rPointLists.back().push_back( Point( aCoordList[ 0 ], aCoordList[ 1 ] ) );
+                    rPointLists.back().push_back( Point( (aCoordList[ 0 ]), (aCoordList.size() > 1 ? aCoordList[ 1 ] : 0) ) );
                     rFlagLists.back().push_back( PolygonFlags_NORMAL );
                     aCurrentPoint = rPointLists.back().back();
                     break;
@@ -371,7 +371,7 @@ void ConversionHelper::decodeVmlPath( ::std::vector< ::std::vector< Point > >& r
                     break;
 
                 case LINE_ABS: // 2* params -> param count reset
-                    rPointLists.back().push_back( Point( aCoordList[ 0 ], aCoordList[ 1 ] ) );
+                    rPointLists.back().push_back( Point( aCoordList[ 0 ], (aCoordList.size() > 1 ? aCoordList[ 1 ] : 0) ) );
                     rFlagLists.back().push_back( PolygonFlags_NORMAL );
                     aCurrentPoint = rPointLists.back().back();
                     nParamCount = 2;