From 2767360fa8649c9638ecd7785d7baac7db38d2b3 Mon Sep 17 00:00:00 2001
From: Vadim Zeitlin <vadim@wxwidgets.org>
Date: Wed, 17 Jul 2013 17:27:09 +0000
Subject: [PATCH] Check the number of points in the image map in wxHTML.

Don't crash if an <area> element is incorrect and doesn't have the required
number of coords attributes.

Closes #15348.

git-svn-id: https://svn.wxwidgets.org/svn/wx/wxWidgets/trunk@74569 c3d73ce0-8a6f-49c7-b76d-6d57e0e08775
---
 docs/changes.txt     | 8 ++++++++
 src/html/m_image.cpp | 4 +++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/docs/changes.txt b/docs/changes.txt
index 0eebedff24..7c306a61f8 100644
--- a/docs/changes.txt
+++ b/docs/changes.txt
@@ -557,6 +557,14 @@ Major new features in this release
   was added.
 
 
+3.0: (released 2013-09-??)
+--------------------------
+
+All (GUI):
+
+- Fix crash in wxHTML on mal-formed <area> elements (LukasK).
+
+
 2.9.5: (released 2013-07-15)
 ----------------------------
 
diff --git a/src/html/m_image.cpp b/src/html/m_image.cpp
index bce9c33235..dae30f3b0b 100644
--- a/src/html/m_image.cpp
+++ b/src/html/m_image.cpp
@@ -95,6 +95,7 @@ wxHtmlLinkInfo *wxHtmlImageMapAreaCell::GetLink( int x, int y ) const
     switch (type)
     {
         case RECT:
+            if ( coords.GetCount() == 4 )
             {
                 int l, t, r, b;
 
@@ -106,9 +107,10 @@ wxHtmlLinkInfo *wxHtmlImageMapAreaCell::GetLink( int x, int y ) const
                 {
                     return m_Link;
                 }
-                break;
             }
+            break;
         case CIRCLE:
+            if ( coords.GetCount() == 3 )
             {
                 int l, t, r;
                 double  d;