gnumeric r16363 - in trunk: . plugins/excel

[mortenw svn gnome org]

Author: mortenw
Date: Sat Feb  9 00:12:07 2008
New Revision: 16363
URL: http://svn.gnome.org/viewvc/gnumeric?rev=16363&view=rev

Log:
2008-02-08  Morten Welinder  <terra gnome org>

	* ms-chart.c: Sprinkle some length checks.  Fixes #515269 and
	#515275.




Modified:
   trunk/NEWS
   trunk/plugins/excel/ChangeLog
   trunk/plugins/excel/ms-chart.c

Modified: trunk/NEWS
==============================================================================
--- trunk/NEWS	(original)
+++ trunk/NEWS	Sat Feb  9 00:12:07 2008
@@ -23,7 +23,7 @@
 	  [#513317] [#513361] [#513364] [#513551] [#513605] [#513608] [#513790]
 	  [#513787] [#513835] [#513963] [#514229] [#514230] [#514295] [#514435]
 	  [#514436] [#514437] [#514506] [#514510] [#514630] [#514637] [#515155]
-	  [#515269]
+	  [#515269] [#515275]
 	* Fix non-ascii export problem.  [#511135]
 	* Band-aid evaluation problem with broken xls.  [#513559]
 	* Fix circular array formula problem.

Modified: trunk/plugins/excel/ms-chart.c
==============================================================================
--- trunk/plugins/excel/ms-chart.c	(original)
+++ trunk/plugins/excel/ms-chart.c	Sat Feb  9 00:12:07 2008
@@ -901,20 +901,22 @@
 		 XLChartReadState *s, BiffQuery *q)
 {
 	XLChartSeries *series;
-	guint16 const pt_num = GSF_LE_GET_GUINT16 (q->data);
-	guint16 const series_index = GSF_LE_GET_GUINT16 (q->data+2);
-	guint16 const series_index_for_label = GSF_LE_GET_GUINT16 (q->data+4);
+	guint16 pt_num, series_index, series_index_for_label;
+
+	XL_CHECK_CONDITION_VAL (q->length >= 8, TRUE);
+	pt_num = GSF_LE_GET_GUINT16 (q->data);
+	series_index = GSF_LE_GET_GUINT16 (q->data+2);
+	series_index_for_label = GSF_LE_GET_GUINT16 (q->data+4);
 #if 0
 	guint16 const excel4_auto_color = GSF_LE_GET_GUINT16 (q->data+6) & 0x01;
 #endif
 
 	if (pt_num == 0 && series_index == 0 && series_index_for_label == 0xfffd)
 		s->has_extra_dataformat = TRUE;
-	g_return_val_if_fail (series_index < s->series->len, TRUE);
+	XL_CHECK_CONDITION_VAL (s->series && series_index < s->series->len, TRUE);
 
 	series = g_ptr_array_index (s->series, series_index);
-
-	g_return_val_if_fail (series != NULL, TRUE);
+	XL_CHECK_CONDITION_VAL (series != NULL, TRUE);
 
 	if (pt_num == 0xffff) {
 		s->style_element = -1;