gnumeric r17253 - in trunk: . plugins/excel

[mortenw svn gnome org]

Author: mortenw
Date: Mon Mar 30 00:06:31 2009
New Revision: 17253
URL: http://svn.gnome.org/viewvc/gnumeric?rev=17253&view=rev

Log:
2009-03-29  Morten Welinder  <terra gnome org>

	* ms-chart.c (lineformat): Add sanity check.  Fixes #577208.



Modified:
   trunk/NEWS
   trunk/plugins/excel/ChangeLog
   trunk/plugins/excel/ms-chart.c

Modified: trunk/NEWS
==============================================================================
--- trunk/NEWS	(original)
+++ trunk/NEWS	Mon Mar 30 00:06:31 2009
@@ -7,6 +7,7 @@
 	* Improve XIRR a bit.
 	* Fix Applix loading crash.  [#577145]
 	* Fix Lotus loading crash.  [#577156]
+	* Fix XLS loading crash.  [#577208]
 	* Add sorted sheet list to tab menu.
 
 --------------------------------------------------------------------------

Modified: trunk/plugins/excel/ms-chart.c
==============================================================================
--- trunk/plugins/excel/ms-chart.c	(original)
+++ trunk/plugins/excel/ms-chart.c	Mon Mar 30 00:06:31 2009
@@ -1348,11 +1348,16 @@
 BC_R(lineformat)(XLChartHandler const *handle,
 		 XLChartReadState *s, BiffQuery *q)
 {
-	guint16 const flags = GSF_LE_GET_GUINT16 (q->data+8);
-	guint16 pattern = GSF_LE_GET_GUINT16 (q->data+4);
+	guint16 flags;
+	guint16 pattern;
+
+	XL_CHECK_CONDITION_VAL (q->length >= (BC_R(ver)(s) >= MS_BIFF_V8 ? 12 : 10), FALSE);
+
+	flags = GSF_LE_GET_GUINT16 (q->data + 8);
+	pattern = GSF_LE_GET_GUINT16 (q->data + 4);
 
 	BC_R(get_style) (s);
-	switch (GSF_LE_GET_GINT16 (q->data+6)) {
+	switch (GSF_LE_GET_GINT16 (q->data + 6)) {
 	default :
 	case -1 : s->style->line.width = 0; /* hairline */
 		break;
@@ -1374,7 +1379,7 @@
 	s->style->line.dash_type = xl_pattern_to_line_type (pattern);
 
 	if (BC_R(ver)(s) >= MS_BIFF_V8 && s->currentSeries != NULL) {
-		guint16 const fore = GSF_LE_GET_GUINT16 (q->data+10);
+		guint16 const fore = GSF_LE_GET_GUINT16 (q->data + 10);
 		d (0, g_printerr ("color index == %hd.\n", fore););
 		/* Excel assumes that the color is automatic if it is the same
 		as the automatic one whatever the auto flag value is */