WMF record size < 3 is clearly broken

...so we should not attempt to (mis-)interpret such broken input.

Change-Id: I97f4f46fdfc0dfe6f9aff42917d23634b844c7f0

vcl/source/filter/wmf/winwmf.cxx

@@ -1377,13 +1377,19 @@ bool WMFReader::GetPlaceableBound( Rectangle& rPlaceableBound, SvStream* pStm )
         {
             pStm->ReadUInt32( nRSize ).ReadUInt16( nFunction );
 
-            if( pStm->GetError() || ( nRSize < 3 ) || ( nRSize==3 && nFunction==0 ) || pStm->IsEof() )
+            if( pStm->GetError() )
             {
-                if( pStm->IsEof() )
+                bRet = false;
+                break;
+            }
+            else if ( nRSize==3 && nFunction==0 )
+            {
+                break;
+            }
+            else if ( nRSize < 3 || pStm->IsEof() )
             {
                 pStm->SetError( SVSTREAM_FILEFORMAT_ERROR );
                 bRet = false;
-                }
                 break;
             }
             switch( nFunction )