gnumeric r17209 - in trunk: . plugins/excel

[mortenw svn gnome org]

Author: mortenw
Date: Sun Mar 15 18:14:34 2009
New Revision: 17209
URL: http://svn.gnome.org/viewvc/gnumeric?rev=17209&view=rev

Log:
2009-03-15  Morten Welinder  <terra gnome org>

	* ms-chart.c (ms_excel_chart_read_NUMBER,
	ms_excel_chart_read_LABEL): Add extra sanity check.  Fixes #575393.



Modified:
   trunk/NEWS
   trunk/plugins/excel/ChangeLog
   trunk/plugins/excel/ms-chart.c

Modified: trunk/NEWS
==============================================================================
--- trunk/NEWS	(original)
+++ trunk/NEWS	Sun Mar 15 18:14:34 2009
@@ -1,6 +1,6 @@
 Gnumeric 1.9.5
 
-Andreas
+Andreas:
 	* Fix style critical on latex export [#574125]
 	* Always print the whole printarea even if it has no
 	  content or style. [#554116] [#572818]
@@ -35,6 +35,7 @@
 	* Make date edit use the date separator of the locale.  [Part of #33229]
 	* Fix xls writing crash.  [Part of #575318]
 	* Fix criticals in xls export for comments without author.
+	* Fix crash while loading broken xls.  [#575393]
 
 Sum1:
 	* Implement OOO probing.  [#574381]

Modified: trunk/plugins/excel/ms-chart.c
==============================================================================
--- trunk/plugins/excel/ms-chart.c	(original)
+++ trunk/plugins/excel/ms-chart.c	Sun Mar 15 18:14:34 2009
@@ -3413,6 +3413,8 @@
 		return;
 
 	if (series->data[state->cur_role].value != NULL) {
+		XL_CHECK_CONDITION (row < (guint)series->data[state->cur_role].num_elements);
+
 		value_release (series->data[state->cur_role].value->vals[0][row]);
 		series->data[state->cur_role].value->vals[0][row] = value_new_float (val);
 	}
@@ -3445,6 +3447,8 @@
 	label = excel_biff_text_2 (state->container.importer, q, 6);
 	if (label != NULL  &&
 	    series->data[state->cur_role].value != NULL) {
+		XL_CHECK_CONDITION (row < (guint)series->data[state->cur_role].num_elements);
+
 		value_release (series->data[state->cur_role].value->vals[0][row]);
 		series->data[state->cur_role].value->vals[0][row] = value_new_string (label);
 	}