Index: source/filter.vcl/wmf/enhwmf.cxx
===================================================================
RCS file: /cvs/util/svtools/source/filter.vcl/wmf/enhwmf.cxx,v
retrieving revision 1.30
diff -u -r1.30 enhwmf.cxx
--- source/filter.vcl/wmf/enhwmf.cxx	19 Jun 2006 21:08:08 -0000	1.30
+++ source/filter.vcl/wmf/enhwmf.cxx	29 Sep 2006 07:55:10 -0000
@@ -370,33 +370,37 @@
 				UINT16*	pnPoints;
 				Point*	pPtAry;
 
-				INT32	i, nPoly, nGesPoints;
+				UINT32	i, nPoly, nGesPoints;
 				pWMF->SeekRel( 0x10 );
 
 				// Anzahl der Polygone:
 				*pWMF >> nPoly >> nGesPoints;
 
-				// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
-				pnPoints = new UINT16[ nPoly ];
-
-				for ( i = 0; i < nPoly; i++ )
+				if (nGesPoints < SAL_MAX_UINT32 / sizeof(Point))
 				{
-					*pWMF >> nPoints;
-					pnPoints[ i ] = (UINT16)nPoints;
-				}
-				// Polygonpunkte holen:
-				pPtAry  = (Point*) new char[ nGesPoints * sizeof(Point) ];
 
-				for ( i = 0; i < nGesPoints; i++ )
-				{
-					*pWMF >> nX32 >> nY32;
-					pPtAry[ i ] = Point( nX32, nY32 );
+					// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
+					pnPoints = new UINT16[ nPoly ];
+	
+					for ( i = 0; i < nPoly; i++ )
+					{
+						*pWMF >> nPoints;
+						pnPoints[ i ] = (UINT16)nPoints;
+					}
+					// Polygonpunkte holen:
+					pPtAry  = (Point*) new char[ nGesPoints * sizeof(Point) ];
+	
+					for ( i = 0; i < nGesPoints; i++ )
+					{
+						*pWMF >> nX32 >> nY32;
+						pPtAry[ i ] = Point( nX32, nY32 );
+					}
+					// PolyPolygon Actions erzeugen
+					PolyPolygon aPolyPoly( (UINT16)nPoly, pnPoints, pPtAry );
+					pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
+					delete[] (char*) pPtAry;
+					delete[] pnPoints;
 				}
-				// PolyPolygon Actions erzeugen
-				PolyPolygon aPolyPoly( (UINT16)nPoly, pnPoints, pPtAry );
-				pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
-				delete[] (char*) pPtAry;
-				delete[] pnPoints;
 			}
 			break;
 
@@ -1098,31 +1102,34 @@
 				UINT16*	pnPoints;
 				Point*	pPtAry;
 
-				INT32	i, nPoly, nGesPoints;
+				UINT32	i, nPoly, nGesPoints;
 				pWMF->SeekRel( 0x10 );
 				// Anzahl der Polygone:
 				*pWMF >> nPoly >> nGesPoints;
-				// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
-				pnPoints = new UINT16[ nPoly ];
-				for ( i = 0; i < nPoly; i++ )
-				{
-					*pWMF >> nPoints;
-					pnPoints[ i ] = (UINT16)nPoints;
-				}
-				// Polygonpunkte holen:
-				pPtAry  = (Point*) new char[ nGesPoints * sizeof(Point) ];
-				for ( i = 0; i < nGesPoints; i++ )
+				if (nGesPoints < SAL_MAX_UINT32 / sizeof(Point))
 				{
-					*pWMF >> nX16 >> nY16;
-					pPtAry[ i ] = Point( nX16, nY16 );
+					// Anzahl der Punkte eines jeden Polygons holen, Gesammtzahl der Punkte ermitteln:
+					pnPoints = new UINT16[ nPoly ];
+					for ( i = 0; i < nPoly; i++ )
+					{
+						*pWMF >> nPoints;
+						pnPoints[ i ] = (UINT16)nPoints;
+					}
+					// Polygonpunkte holen:
+					pPtAry  = (Point*) new char[ nGesPoints * sizeof(Point) ];
+					for ( i = 0; i < nGesPoints; i++ )
+					{
+						*pWMF >> nX16 >> nY16;
+						pPtAry[ i ] = Point( nX16, nY16 );
+					}
+	
+					// PolyPolygon Actions erzeugen
+					PolyPolygon aPolyPoly( (UINT16)nPoly, pnPoints, pPtAry );
+					pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
+					delete[] (char*) pPtAry;
+					delete[] pnPoints;
 				}
-
-				// PolyPolygon Actions erzeugen
-				PolyPolygon aPolyPoly( (UINT16)nPoly, pnPoints, pPtAry );
-				pOut->DrawPolyPolygon( aPolyPoly, bRecordPath );
-				delete[] (char*) pPtAry;
-				delete[] pnPoints;
-			};
+			}
 			break;
 
 			case EMR_FILLRGN :
Index: source/filter.vcl/wmf/winwmf.cxx
===================================================================
RCS file: /cvs/util/svtools/source/filter.vcl/wmf/winwmf.cxx,v
retrieving revision 1.29
diff -u -r1.29 winwmf.cxx
--- source/filter.vcl/wmf/winwmf.cxx	19 Jun 2006 21:08:52 -0000	1.29
+++ source/filter.vcl/wmf/winwmf.cxx	29 Sep 2006 07:55:10 -0000
@@ -863,17 +863,21 @@
 										aMemoryStream >> aPt.X()
 													  >> aPt.Y()
 													  >> nStringLen;
-										sal_Unicode* pBuf = aString.AllocBuffer( (sal_uInt16)nStringLen );
-										for ( i = 0; i < nStringLen; i++ )
-											aMemoryStream >> pBuf[ i ];
-										aMemoryStream >> nDXCount;
-										if ( nDXCount )
-											pDXAry = new sal_Int32[ nDXCount ];
-										for  ( i = 0; i < nDXCount; i++ )
-											aMemoryStream >> pDXAry[ i ];
-										aMemoryStream >> nSkipActions;
-										pOut->DrawText( aPt, aString, pDXAry );
-										delete[] pDXAry;
+
+										if (nStringLen < STRING_MAXLEN)
+										{
+											sal_Unicode* pBuf = aString.AllocBuffer( (xub_StrLen)nStringLen );
+											for ( i = 0; i < nStringLen; i++ )
+												aMemoryStream >> pBuf[ i ];
+											aMemoryStream >> nDXCount;
+											if ( nDXCount )
+												pDXAry = new sal_Int32[ nDXCount ];
+											for  ( i = 0; i < nDXCount; i++ )
+												aMemoryStream >> pDXAry[ i ];
+											aMemoryStream >> nSkipActions;
+											pOut->DrawText( aPt, aString, pDXAry );
+											delete[] pDXAry;
+										}
 									}
 								}
 								break;
