From 206e07e29bbbf7a8b06f47bb7c36f9d051de99dc Mon Sep 17 00:00:00 2001
From: zhangxiaohui <553441439@qq.com>
Date: Wed, 4 May 2022 22:58:18 +0800
Subject: [PATCH] Avoid NULL pointer dereference in coders/wmf.c (#5117)

---
 coders/wmf.c | 37 ++++++++++++++++++++-----------------
 1 file changed, 20 insertions(+), 17 deletions(-)

diff --git a/coders/wmf.c b/coders/wmf.c
index 34286a05c4..7981c84503 100644
--- a/coders/wmf.c
+++ b/coders/wmf.c
@@ -1223,24 +1223,27 @@ static void ipa_draw_polypolygon(wmfAPI * API, wmfPolyPoly_t* polypolygon)
       util_set_brush(API, polypolygon->dc, BrushApplyFill);
 
       DrawPathStart(WmfDrawingWand);
-      for (polygon = 0; polygon < polypolygon->npoly; polygon++)
+      if (polypolygon->pt && polypolygon->count)
         {
-          polyline.dc = polypolygon->dc;
-          polyline.pt = polypolygon->pt[polygon];
-          polyline.count = polypolygon->count[polygon];
-          if ((polyline.count > 2) && polyline.pt)
-            {
-              DrawPathMoveToAbsolute(WmfDrawingWand,
-                                     XC(polyline.pt[0].x),
-                                     YC(polyline.pt[0].y));
-              for (point = 1; point < polyline.count; point++)
-                {
-                  DrawPathLineToAbsolute(WmfDrawingWand,
-                                         XC(polyline.pt[point].x),
-                                         YC(polyline.pt[point].y));
-                }
-              DrawPathClose(WmfDrawingWand);
-            }
+        for (polygon = 0; polygon < polypolygon->npoly; polygon++)
+          {
+            polyline.dc = polypolygon->dc;
+            polyline.pt = polypolygon->pt[polygon];
+            polyline.count = polypolygon->count[polygon];
+            if ((polyline.count > 2) && polyline.pt)
+              {
+                DrawPathMoveToAbsolute(WmfDrawingWand,
+                                       XC(polyline.pt[0].x),
+                                       YC(polyline.pt[0].y));
+                for (point = 1; point < polyline.count; point++)
+                  {
+                    DrawPathLineToAbsolute(WmfDrawingWand,
+                                           XC(polyline.pt[point].x),
+                                           YC(polyline.pt[point].y));
+                  }
+                DrawPathClose(WmfDrawingWand);
+              }
+          }
         }
       DrawPathFinish(WmfDrawingWand);