gnumeric r16376 - in branches/gnumeric-1-8: . plugins/excel

[mortenw svn gnome org]

Author: mortenw
Date: Mon Feb 18 02:32:35 2008
New Revision: 16376
URL: http://svn.gnome.org/viewvc/gnumeric?rev=16376&view=rev

Log:
2008-02-17  Morten Welinder  <terra gnome org>

	* ms-obj.c (ms_read_OBJ): Return error indicator.
	* ms-escher.c (ms_escher_read_ClientData): Handle errors from
	ms_read_OBJ.  Fixes #517106.



Modified:
   branches/gnumeric-1-8/NEWS
   branches/gnumeric-1-8/plugins/excel/ChangeLog
   branches/gnumeric-1-8/plugins/excel/ms-escher.c
   branches/gnumeric-1-8/plugins/excel/ms-obj.c
   branches/gnumeric-1-8/plugins/excel/ms-obj.h

Modified: branches/gnumeric-1-8/NEWS
==============================================================================
--- branches/gnumeric-1-8/NEWS	(original)
+++ branches/gnumeric-1-8/NEWS	Mon Feb 18 02:32:35 2008
@@ -3,6 +3,10 @@
 Hans de Goede:
 	* Fix broken xls issues.  [#505330]
 
+Jean:
+	* Fix corrupted-xls-file problems.  [#514513] [#515343] [#515873]
+	  [#515876]
+
 Morten:
 	* Fix loading of solver constraints.
 	* Fix solver issue.  [#512500]
@@ -10,8 +14,7 @@
 	  [#513317] [#513361] [#513364] [#513551] [#513605] [#513608] [#513790]
 	  [#513787] [#513835] [#513963] [#514229] [#514230] [#514295] [#514435]
 	  [#514436] [#514437] [#514506] [#514510] [#514630] [#514637] [#515155]
-	  [#515269] [#515275] [#515335] [#515336] [#514513] [#515343] [#515873]
-	  [#515876].
+	  [#515269] [#515275] [#515335] [#515336] [#515339] [#517106].
 	* Fix non-ascii export problem.  [#511135]
 	* Band-aid evaluation problem with broken xls.  [#513559]
 	* Fix circular array formula problem.

Modified: branches/gnumeric-1-8/plugins/excel/ms-escher.c
==============================================================================
--- branches/gnumeric-1-8/plugins/excel/ms-escher.c	(original)
+++ branches/gnumeric-1-8/plugins/excel/ms-escher.c	Mon Feb 18 02:32:35 2008
@@ -1986,8 +1986,11 @@
 	g_return_val_if_fail (has_next_record, TRUE);
 
 	/* The object takes responsibility for the attributes */
-	ms_read_OBJ (state->q, state->container, h->attrs);
 	h->release_attrs = FALSE;
+	if (ms_read_OBJ (state->q, state->container, h->attrs)) {
+		h->attrs = NULL;  /* It got deleted.  */
+		return TRUE;
+	}
 
 	return FALSE;
 }

Modified: branches/gnumeric-1-8/plugins/excel/ms-obj.c
==============================================================================
--- branches/gnumeric-1-8/plugins/excel/ms-obj.c	(original)
+++ branches/gnumeric-1-8/plugins/excel/ms-obj.c	Mon Feb 18 02:32:35 2008
@@ -34,6 +34,7 @@
 #include "ms-obj.h"
 #include "ms-chart.h"
 #include "ms-escher.h"
+#include "ms-excel-util.h"
 
 #include <expr.h>
 #include <parse-util.h>
@@ -942,7 +943,7 @@
 #endif
 
 	/* Scan through the pseudo BIFF substream */
-	while (data_len_left > 0 && !hit_end) {
+	while (data_len_left >= 4 && !hit_end) {
 		guint16 const record_type = GSF_LE_GET_GUINT16(data);
 
 		/* All the sub-records seem to have this layout
@@ -953,13 +954,13 @@
 		guint16 len = GSF_LE_GET_GUINT16(data+2);
 
 		/* 1st record must be COMMON_OBJ*/
-		g_return_val_if_fail (obj->excel_type >= 0 ||
+		XL_CHECK_CONDITION_VAL (obj->excel_type >= 0 ||
 				      record_type == GR_COMMON_OBJ_DATA,
 				      TRUE);
 
 		switch (record_type) {
 		case GR_END:
-			g_return_val_if_fail (len == 0, TRUE);
+			XL_CHECK_CONDITION_VAL (len == 0, TRUE);
 			/* ms_obj_dump (data, len, data_len_left, "ObjEnd"); */
 			hit_end = TRUE;
 			break;
@@ -1083,7 +1084,7 @@
 			guint16 const options =GSF_LE_GET_GUINT16 (data+8);
 
 			/* Multiple objects in 1 record ?? */
-			g_return_val_if_fail (obj->excel_type == -1, TRUE);
+			XL_CHECK_CONDITION_VAL (obj->excel_type == -1, TRUE);
 
 			obj->excel_type = GSF_LE_GET_GUINT16(data+4);
 			obj->id = GSF_LE_GET_GUINT16(data+6);
@@ -1164,7 +1165,7 @@
 	}
 
 	/* Catch underflow too */
-	g_return_val_if_fail (data_len_left == 0, TRUE);
+	XL_CHECK_CONDITION_VAL (data_len_left == 0, TRUE);
 
 	/* FIXME : Throw away the IMDATA that may follow.
 	 * I am not sure when the IMDATA does follow, or how to display it,
@@ -1190,9 +1191,11 @@
  * ms_read_OBJ :
  * @q : The biff record to start with.
  * @c : The object's container
- * @attrs : an OPTIONAL hash of object attributes.
+ * @attrs : an optional hash of object attributes.
+ *
+ * This function takes ownership of attrs.
  */
-void
+gboolean
 ms_read_OBJ (BiffQuery *q, MSContainer *c, MSObjAttrBag *attrs)
 {
 	static char const * const object_type_names[] = {
@@ -1227,8 +1230,8 @@
 	MSObj *obj;
 
 	/* no decent docs for this */
-	if  (c->importer->ver <= MS_BIFF_V4)
-		return;
+	if (c->importer->ver <= MS_BIFF_V4)
+		return FALSE;
 
 #ifndef NO_DEBUG_EXCEL
 	if (ms_excel_object_debug > 0)
@@ -1245,7 +1248,7 @@
 			printf ("}; /* OBJ error 1 */\n");
 #endif
 		ms_obj_delete (obj);
-		return;
+		return TRUE;
 	}
 
 	obj->excel_type_name = NULL;
@@ -1268,11 +1271,13 @@
 	if (obj->excel_type == 0x5) {
 		if (ms_excel_chart_read_BOF (q, c, obj->gnum_obj)) {
 			ms_obj_delete (obj);
-			return;
+			return TRUE;
 		}
 	}
 
 	ms_container_add_obj (c, obj);
+
+	return FALSE;
 }
 
 /**********************************************************************/

Modified: branches/gnumeric-1-8/plugins/excel/ms-obj.h
==============================================================================
--- branches/gnumeric-1-8/plugins/excel/ms-obj.h	(original)
+++ branches/gnumeric-1-8/plugins/excel/ms-obj.h	Mon Feb 18 02:32:35 2008
@@ -140,7 +140,7 @@
 	MSObjAttrBag	*attrs;
 };
 MSObj *ms_obj_new    (MSObjAttrBag *ab);
-void   ms_read_OBJ   (BiffQuery *q, MSContainer *c, MSObjAttrBag *ab);
+gboolean ms_read_OBJ   (BiffQuery *q, MSContainer *c, MSObjAttrBag *ab);
 void   ms_obj_delete (MSObj *obj);
 char  *ms_read_TXO   (BiffQuery *q, MSContainer *c, PangoAttrList **markup);