fix a third emf crash

Change-Id: I3b5d0daf05e3272d2afa0da84ff0b1f8d5c965a4
(cherry picked from commit 173fd903)
Reviewed-on: https://gerrit.libreoffice.org/17022Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>

vcl/source/filter/wmf/enhwmf.cxx

@@ -1441,7 +1441,9 @@ bool EnhWMFReader::ReadEnhWMF()
                     DBG_ASSERT( ( nOptions & ( ETO_PDY | ETO_GLYPH_INDEX ) ) == 0, "SJ: ETO_PDY || ETO_GLYPH_INDEX in EMF" );
 
                     Point aPos( ptlReferenceX, ptlReferenceY );
-                    if ( nLen > 0 && nLen < static_cast<sal_Int32>( SAL_MAX_UINT32 / sizeof(sal_Int32) ) )
+                    bool bLenSane = nLen > 0 && nLen < static_cast<sal_Int32>( SAL_MAX_UINT32 / sizeof(sal_Int32) );
+                    bool bOffStringSane = nOffString <= nEndPos - nCurPos;
+                    if (bLenSane && bOffStringSane)
                     {
                         if ( offDx && (( nCurPos + offDx + nLen * 4 ) <= nNextPos ) )
                         {