From 7109a4dea588e989b384b0de081fdf6a80e68404 Mon Sep 17 00:00:00 2001
From: konovalovsergey <Sergey.Konovalov@onlyoffice.com>
Date: Fri, 14 Oct 2016 12:52:15 +0300
Subject: [PATCH] crash: vml path with formula reference to nonexistent
 formula.

---
 .../Editor/Drawing/Shapes/BaseShape/Path.h    | 26 +++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/ASCOfficePPTXFile/Editor/Drawing/Shapes/BaseShape/Path.h b/ASCOfficePPTXFile/Editor/Drawing/Shapes/BaseShape/Path.h
index 3f6b918f4..9b014b4f6 100644
--- a/ASCOfficePPTXFile/Editor/Drawing/Shapes/BaseShape/Path.h
+++ b/ASCOfficePPTXFile/Editor/Drawing/Shapes/BaseShape/Path.h
@@ -1354,8 +1354,30 @@ namespace NSPresentationEditor
 				{	
 					switch (eParamType)
 					{
-					case ptFormula: { lValue = pManager.m_arResults[lValue]; break; }
-					case ptAdjust:  { lValue = (*(pManager.m_pAdjustments))[lValue]; break; }
+					case ptFormula:
+					{
+						if (0 <= lValue && lValue < pManager.m_arResults.size())
+						{
+							lValue = pManager.m_arResults[lValue];
+						}
+						else
+						{
+							lValue = 0;
+						}
+						break;
+					}
+					case ptAdjust:
+					{
+						if (0 <= lValue && lValue < pManager.m_pAdjustments->size())
+						{
+							lValue = (*(pManager.m_pAdjustments))[lValue];
+						}
+						else
+						{
+							lValue = 0;
+						}
+						break;
+					}
 					default: break;
 					};
 					if (0 != m_arSlices.size())
-- 
2.30.9