another DrawingML export crash fix

Change-Id: I0386b4a768a9ac51cb86ac1c3edb17c41caf821a
Reviewed-on: https://gerrit.libreoffice.org/15993Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Andras Timar <andras.timar@collabora.com>

oox/source/export/drawingml.cxx

@@ -2253,6 +2253,18 @@ void DrawingML::WriteCustomGeometry( Reference< XShape > rXShape )
                 if ( !aPairs.hasElements() || !aSegments.hasElements() )
                     return;
 
+                int nExpectedPairCount = 0;
+                for( int j = 0; j < aSegments.getLength(); ++j )
+                {
+                    nExpectedPairCount += aSegments[j].Count;
+                }
+
+                if ( nExpectedPairCount > aPairs.getLength() )
+                {
+                    SAL_WARN("oox", "Segments need " << nExpectedPairCount << " coordinates, but Coordinates have only " << aPairs.getLength() << " pairs.");
+                    return;
+                }
+
                 mpFS->startElementNS( XML_a, XML_custGeom, FSEND );
                 mpFS->singleElementNS( XML_a, XML_avLst, FSEND );
                 mpFS->singleElementNS( XML_a, XML_gdLst, FSEND );