fix crash on invalid/missing pen

cppcanvas/source/mtfrenderer/emfplus.cxx

@@ -902,7 +902,7 @@ namespace cppcanvas
             } else {
                 rState.isFillColorSet = true;
                 // extract UseBrush
-                EMFPBrush* brush = (EMFPBrush*) aObjects [brushIndexOrColor];
+                EMFPBrush* brush = (EMFPBrush*) aObjects [brushIndexOrColor & 0xff];
                 EMFP_DEBUG (printf ("EMF+\tbrush fill slot: %u (type: %u)\n", (unsigned int)brushIndexOrColor, (unsigned int)brush->GetType ()));
 
                 // give up in case something wrong happened
@@ -1356,8 +1356,13 @@ namespace cppcanvas
                         EMFP_DEBUG (printf ("EMF+\tpen: %u\n", (unsigned int)penIndex));
 
                         EMFPPath* path = (EMFPPath*) aObjects [flags & 0xff];
-                        EMFPPen* pen = (EMFPPen*) aObjects [penIndex];
+                        EMFPPen* pen = (EMFPPen*) aObjects [penIndex & 0xff];
 
+                        SAL_WARN_IF( !pen, "cppcanvas", "EmfPlusRecordTypeDrawPath missing pen" );
+                        SAL_WARN_IF( !path, "cppcanvas", "EmfPlusRecordTypeDrawPath missing path" );
+
+                        if (pen && path)
+                        {
                             rState.isFillColorSet = false;
                             rState.isLineColorSet = true;
                             rState.lineColor = ::vcl::unotools::colorToDoubleSequence (pen->GetColor (),
@@ -1382,6 +1387,7 @@ namespace cppcanvas
 
                                 rFactoryParms.mrCurrActionIndex += pPolyAction->getActionCount()-1;
                             }
+                        }
                         break;
                     }
                 case EmfPlusRecordTypeDrawImagePoints: