early return on too many points

Change-Id: Iadcef84b47a27bc987d16e4b064ee0d6db59d19a
Reviewed-on: https://gerrit.collaboraoffice.com/c/core/+/992
Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
Tested-by: Jenkins CPCI <releng@collaboraoffice.com>
Signed-off-by: Xisco Fauli <xiscofauli@libreoffice.org>
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/203755
Tested-by: Jenkins

filter/source/graphicfilter/icgm/class4.cxx

@@ -26,6 +26,7 @@
 
 #include <o3tl/float_int_conversion.hxx>
 #include <o3tl/safeint.hxx>
+#include <sal/log.hxx>
 
 #include <memory>
 
@@ -127,6 +128,11 @@ void CGM::ImplDoClass4()
             case 0x01 : /*PolyLine*/
             {
                 sal_uInt32 nPoints = mnElementSize / ImplGetPointSize();
+                if (nPoints > SAL_MAX_UINT16)
+                {
+                    SAL_WARN("filter.icgm", "CGM PolyLine too many points: " << nPoints);
+                    break;
+                }
                 tools::Polygon aPolygon( static_cast<sal_uInt16>(nPoints) );
                 for ( sal_uInt32 i = 0; i < nPoints; i++)
                 {