Cap the number of VML path commands parsed from a path attribute (#3951)

Fixes #3683

Co-authored-by: Claude Haiku 5.5 <noreply@anthropic.com>

crates/docx/src/read/freeform.rs

@@ -256,6 +256,10 @@ fn vml_commands(path: &str) -> Vec<(String, Vec<f64>)> {
     };
     while let Some(c) = chars.next() {
         if c.is_ascii_alphabetic() {
+            // Cap the commands too, so a path of bare letters can't build a million entries.
+            if out.len() >= MAX_VML_PARAMS {
+                break;
+            }
             if !has_num {
                 push(&mut out, 0.0);
             }
@@ -361,6 +365,13 @@ mod tests {
         crate::xml::parse(xml.as_bytes()).expect("parse spPr")
     }
 
+    #[test]
+    fn a_vml_path_of_bare_letters_builds_a_bounded_command_list() {
+        let path = "x".repeat(MAX_VML_PATH);
+        let n = vml_commands(&path).len();
+        assert!(n <= MAX_VML_PARAMS, "{n} commands");
+    }
+
     #[test]
     fn a_bezier_segment_with_many_points_is_bounded() {
         // One cubicBezTo stuffed with 50 000 points must not make de Casteljau quadratic: the