diff -urN -x CVS -x unxlngi5.pro -x unxsoli4.pro -x unxsols4.pro -x wntmsci8.pro -x common.pro /so/ws/SRX645/src.m62/svtools/source/filter.vcl/wmf/enhwmf.cxx /so/ws/SRX645/src.m64/svtools/source/filter.vcl/wmf/enhwmf.cxx
--- /so/ws/SRX645/src.m62/svtools/source/filter.vcl/wmf/enhwmf.cxx	Wed Apr 28 12:31:23 2004
+++ /so/ws/SRX645/src.m64/svtools/source/filter.vcl/wmf/enhwmf.cxx	Wed Dec  6 10:53:04 2006
@@ -2,9 +2,9 @@
  *
  *  $RCSfile: enhwmf.cxx,v $
  *
- *  $Revision: 1.19.106.1 $
+ *  $Revision: 1.19.106.2 $
  *
- *  last change: $Author: vg $ $Date: 2004/04/28 10:25:02 $
+ *  last change: $Author: vg $ $Date: 2006/12/06 09:38:52 $
  *
  *  The Contents of this file are made available subject to the terms of
  *  either of the following licenses
@@ -188,6 +188,7 @@
 #define EMR_SETLINKEDUFIS              119
 #define EMR_SETTEXTJUSTIFICATION       120
 
+#define SAL_MAX_UINT32        ((sal_uInt32) 0xFFFFFFFF)
 
 //-----------------------------------------------------------------------------------
 
@@ -385,33 +386,37 @@
 				UINT16*	pnPoints;
 				Point*	pPtAry;
 
-				INT32	i, nPoly, nGesPoints;
+				UINT32	i, nPoly, nGesPoints;
 				pWMF->SeekRel( 0x10 );
 
 				// Anzahl der Polygone:
 				*pWMF >> nPoly >> nGesPoints;
 
-				// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
-				pnPoints = new UINT16[ nPoly ];
-
-				for ( i = 0; i < nPoly; i++ )
+				if (nGesPoints < SAL_MAX_UINT32 / sizeof(Point))
 				{
-					*pWMF >> nPoints;
-					pnPoints[ i ] = (UINT16)nPoints;
-				}
-				// Polygonpunkte holen:
-				pPtAry  = (Point*) new char[ nGesPoints * sizeof(Point) ];
 
-				for ( i = 0; i < nGesPoints; i++ )
-				{
-					*pWMF >> nX32 >> nY32;
-					pPtAry[ i ] = Point( nX32, nY32 );
+					// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
+					pnPoints = new UINT16[ nPoly ];
+	
+					for ( i = 0; i < nPoly; i++ )
+					{
+						*pWMF >> nPoints;
+						pnPoints[ i ] = (UINT16)nPoints;
+					}
+					// Polygonpunkte holen:
+					pPtAry  = (Point*) new char[ nGesPoints * sizeof(Point) ];
+	
+					for ( i = 0; i < nGesPoints; i++ )
+					{
+						*pWMF >> nX32 >> nY32;
+						pPtAry[ i ] = Point( nX32, nY32 );
+					}
+					// PolyPolygon Actions erzeugen
+					PolyPolygon aPolyPoly( (UINT16)nPoly, pnPoints, pPtAry );
+					pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
+					delete[] (char*) pPtAry;
+					delete[] pnPoints;
 				}
-				// PolyPolygon Actions erzeugen
-				PolyPolygon aPolyPoly( (UINT16)nPoly, pnPoints, pPtAry );
-				pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
-				delete[] (char*) pPtAry;
-				delete[] pnPoints;
 			}
 			break;
 
@@ -1137,30 +1142,33 @@
 				UINT16*	pnPoints;
 				Point*	pPtAry;
 
-				INT32	i, nPoly, nGesPoints;
+				UINT32	i, nPoly, nGesPoints;
 				pWMF->SeekRel( 0x10 );
 				// Anzahl der Polygone:
 				*pWMF >> nPoly >> nGesPoints;
-				// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
-				pnPoints = new UINT16[ nPoly ];
-				for ( i = 0; i < nPoly; i++ )
-				{
-					*pWMF >> nPoints;
-					pnPoints[ i ] = (UINT16)nPoints;
-				}
-				// Polygonpunkte holen:
-				pPtAry  = (Point*) new char[ nGesPoints * sizeof(Point) ];
-				for ( i = 0; i < nGesPoints; i++ )
+				if (nGesPoints < SAL_MAX_UINT32 / sizeof(Point))
 				{
-					*pWMF >> nX16 >> nY16;
-					pPtAry[ i ] = Point( nX16, nY16 );
+					// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
+					pnPoints = new UINT16[ nPoly ];
+					for ( i = 0; i < nPoly; i++ )
+					{
+						*pWMF >> nPoints;
+						pnPoints[ i ] = (UINT16)nPoints;
+					}
+					// Polygonpunkte holen:
+					pPtAry  = (Point*) new char[ nGesPoints * sizeof(Point) ];
+					for ( i = 0; i < nGesPoints; i++ )
+					{
+						*pWMF >> nX16 >> nY16;
+						pPtAry[ i ] = Point( nX16, nY16 );
+					}
+	
+					// PolyPolygon Actions erzeugen
+					PolyPolygon aPolyPoly( (UINT16)nPoly, pnPoints, pPtAry );
+					pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
+					delete[] (char*) pPtAry;
+					delete[] pnPoints;
 				}
-
-				// PolyPolygon Actions erzeugen
-				PolyPolygon aPolyPoly( (UINT16)nPoly, pnPoints, pPtAry );
-				pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
-				delete[] (char*) pPtAry;
-				delete[] pnPoints;
 			};
 			break;
 
diff -urN -x CVS -x unxlngi5.pro -x unxsoli4.pro -x unxsols4.pro -x wntmsci8.pro -x common.pro /so/ws/SRX645/src.m62/svtools/source/filter.vcl/wmf/winwmf.cxx /so/ws/SRX645/src.m64/svtools/source/filter.vcl/wmf/winwmf.cxx
--- /so/ws/SRX645/src.m62/svtools/source/filter.vcl/wmf/winwmf.cxx	Wed Apr 28 12:31:23 2004
+++ /so/ws/SRX645/src.m64/svtools/source/filter.vcl/wmf/winwmf.cxx	Wed Dec  6 10:53:04 2006
@@ -2,9 +2,9 @@
  *
  *  $RCSfile: winwmf.cxx,v $
  *
- *  $Revision: 1.20.106.1 $
+ *  $Revision: 1.20.106.2 $
  *
- *  last change: $Author: vg $ $Date: 2004/04/28 10:25:48 $
+ *  last change: $Author: vg $ $Date: 2006/12/06 09:39:05 $
  *
  *  The Contents of this file are made available subject to the terms of
  *  either of the following licenses
@@ -874,17 +874,21 @@
 										aMemoryStream >> aPt.X()
 													  >> aPt.Y()
 													  >> nStringLen;
-										sal_Unicode* pBuf = aString.AllocBuffer( (sal_uInt16)nStringLen );
-										for ( i = 0; i < nStringLen; i++ )
-											aMemoryStream >> pBuf[ i ];
-										aMemoryStream >> nDXCount;
-										if ( nDXCount )
-											pDXAry = new sal_Int32[ nDXCount ];
-										for  ( i = 0; i < nDXCount; i++ )
-											aMemoryStream >> pDXAry[ i ];
-										aMemoryStream >> nSkipActions;
-										pOut->DrawText( aPt, aString, pDXAry );
-										delete[] pDXAry;
+
+										if (nStringLen < STRING_MAXLEN)
+										{
+											sal_Unicode* pBuf = aString.AllocBuffer( (xub_StrLen)nStringLen );
+											for ( i = 0; i < nStringLen; i++ )
+												aMemoryStream >> pBuf[ i ];
+											aMemoryStream >> nDXCount;
+											if ( nDXCount )
+												pDXAry = new sal_Int32[ nDXCount ];
+											for  ( i = 0; i < nDXCount; i++ )
+												aMemoryStream >> pDXAry[ i ];
+											aMemoryStream >> nSkipActions;
+											pOut->DrawText( aPt, aString, pDXAry );
+											delete[] pDXAry;
+										}
 									}
 								}
 								break;