coverity#1242573 Untrusted loop bound

Change-Id: Ic84e57fbfa2b532409865c4364b91be594d252cf

vcl/source/filter/wmf/winwmf.cxx

@@ -1462,12 +1462,31 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm )
 
                 case W_META_POLYGON:
                 {
-                    sal_uInt16 nPoints;
+                    bool bRecordOk = true;
+
+                    sal_uInt16 nPoints(0);
                     pStm->ReadUInt16( nPoints );
-                    for(sal_uInt16 i = 0; i < nPoints; i++ )
+
+                    if (nPoints > pStm->remainingSize() / (2 * sizeof(sal_uInt16)))
                     {
-                        GetWinExtMax( ReadPoint(), aBound, nMapMode );
-                        bBoundsDetermined = true;
+                        bRecordOk = false;
+                    }
+                    else
+                    {
+                        for(sal_uInt16 i = 0; i < nPoints; i++ )
+                        {
+                            GetWinExtMax( ReadPoint(), aBound, nMapMode );
+                            bBoundsDetermined = true;
+                        }
+                    }
+
+                    SAL_WARN_IF(!bRecordOk, "vcl.wmf", "polyline record claimed more points than the stream can provide");
+
+                    if (!bRecordOk)
+                    {
+                        pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                        bRet = false;
+                        break;
                     }
                 }
                 break;
@@ -1507,12 +1526,21 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm )
                         break;
                     }
 
-                    for (sal_uInt16 i = 0; i < nPoints; i++ )
+                    if (nPoints > pStm->remainingSize() / (2 * sizeof(sal_uInt16)))
                     {
-                        GetWinExtMax( ReadPoint(), aBound, nMapMode );
-                        bBoundsDetermined = true;
+                        bRecordOk = false;
+                    }
+                    else
+                    {
+                        for (sal_uInt16 i = 0; i < nPoints; i++ )
+                        {
+                            GetWinExtMax( ReadPoint(), aBound, nMapMode );
+                            bBoundsDetermined = true;
+                        }
                     }
 
+                    SAL_WARN_IF(!bRecordOk, "vcl.wmf", "polypolygon record claimed more points than the stream can provide");
+
                     bRecordOk &= pStm->good();
 
                     if (!bRecordOk)
@@ -1526,12 +1554,30 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm )
 
                 case W_META_POLYLINE:
                 {
-                    sal_uInt16 nPoints;
-                    pStm->ReadUInt16( nPoints );
-                    for(sal_uInt16 i = 0; i < nPoints; i++ )
+                    bool bRecordOk = true;
+
+                    sal_uInt16 nPoints(0);
+                    pStm->ReadUInt16(nPoints);
+                    if (nPoints > pStm->remainingSize() / (2 * sizeof(sal_uInt16)))
                     {
-                        GetWinExtMax( ReadPoint(), aBound, nMapMode );
-                        bBoundsDetermined = true;
+                        bRecordOk = false;
+                    }
+                    else
+                    {
+                        for (sal_uInt16 i = 0; i < nPoints; ++i)
+                        {
+                            GetWinExtMax( ReadPoint(), aBound, nMapMode );
+                            bBoundsDetermined = true;
+                        }
+                    }
+
+                    SAL_WARN_IF(!bRecordOk, "vcl.wmf", "polyline record claimed more points than the stream can provide");
+
+                    if (!bRecordOk)
+                    {
+                        pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
+                        bRet = false;
+                        break;
                     }
                 }
                 break;