Related: fdo#67386 RtfSdrExport: fix crash by respecting size of aVertices

Fix a crash that happened when nSeg was something huge, and we tried to
read uninitialized memory when reading more than nPropSize.

Change-Id: If9fe9e903678794106b10d8eb0dac6050b77d6b7