gnumeric r17256 - in trunk: . plugins/excel

[mortenw svn gnome org]

Author: mortenw
Date: Mon Mar 30 20:50:06 2009
New Revision: 17256
URL: http://svn.gnome.org/viewvc/gnumeric?rev=17256&view=rev

Log:
2009-03-30  Morten Welinder  <terra gnome org>

	* ms-excel-read.c (excel_read_IMDATA): Add sanity check.  Fixes
	#577348.



Modified:
   trunk/NEWS
   trunk/plugins/excel/ChangeLog
   trunk/plugins/excel/ms-excel-read.c

Modified: trunk/NEWS
==============================================================================
--- trunk/NEWS	(original)
+++ trunk/NEWS	Mon Mar 30 20:50:06 2009
@@ -7,7 +7,8 @@
 	* Improve XIRR a bit.
 	* Fix Applix loading crash.  [#577145]
 	* Fix Lotus loading crash.  [#577156]
-	* Fix XLS loading crashes.  [#577205, #577208, #577259, #577260]
+	* Fix XLS loading crashes.  [#577205] [#577208] [#577259] [#577260]
+	[#577348]
 	* Add sorted sheet list to tab menu.
 
 --------------------------------------------------------------------------

Modified: trunk/plugins/excel/ms-excel-read.c
==============================================================================
--- trunk/plugins/excel/ms-excel-read.c	(original)
+++ trunk/plugins/excel/ms-excel-read.c	Mon Mar 30 20:50:06 2009
@@ -3972,12 +3972,14 @@
 GdkPixbuf *
 excel_read_IMDATA (BiffQuery *q, gboolean keep_image)
 {
-	guint16 op;
-	guint32 image_len = GSF_LE_GET_GUINT32 (q->data + 4);
+	guint32 image_len;
+	GdkPixbuf *pixbuf = NULL;
+	guint16 format;
 
-	GdkPixbuf	*pixbuf = NULL;
+	XL_CHECK_CONDITION_VAL (q->length >= 8, NULL);
 
-	guint16 const format   = GSF_LE_GET_GUINT16 (q->data);
+	format = GSF_LE_GET_GUINT16 (q->data);
+	image_len = GSF_LE_GET_GUINT32 (q->data + 4);
 
 	switch (format) {
 	case 0x2: break;	/* Windows metafile/Mac pict */
@@ -3992,6 +3994,7 @@
 
 	/* Dump formats which weren't handled above to file */
 	if (format != 0x9) {
+		guint16 op;
 		static int count = 0;
 		FILE *f = NULL;
 		char *file_name;