[goffice] Fix loading of image with invalid size or data. [#703740]

[Jean Bréfort <jbrefort src gnome org>]

commit 4010944b10b0c09856028417df288b50aa3fe934
Author: Jean Brefort <jean brefort normalesup org>
Date:   Mon Jul 8 08:23:56 2013 +0200

    Fix loading of image with invalid size or data. [#703740]

 ChangeLog                 |    5 +++++
 NEWS                      |    3 +++
 goffice/utils/go-pixbuf.c |   10 ++++++++--
 3 files changed, 16 insertions(+), 2 deletions(-)
---
diff --git a/ChangeLog b/ChangeLog
index f592ea7..e8bce69 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2013-07-08  Jean Brefort  <jean brefort normalesup org>
+
+       * goffice/utils/go-pixbuf.c (go_pixbuf_load_data): fix loading of image with
+       invalid size or data. [#703740]
+
 2013-07-05 Andreas J. Guelzow <aguelzow pyrshep ca>
 
        * goffice/app/go-doc.c (load_image): check for NULL attrs
diff --git a/NEWS b/NEWS
index a14e54b..2d28903 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,9 @@ goffice 0.10.4:
 Andreas
        * Fix crash on corrupted GOImage. [#703670]
 
+Jean
+       * Fix loading of image with invalid size or data. [#703740]
+
 --------------------------------------------------------------------------
 goffice 0.10.3:
 
diff --git a/goffice/utils/go-pixbuf.c b/goffice/utils/go-pixbuf.c
index 0fa97dc..0675249 100644
--- a/goffice/utils/go-pixbuf.c
+++ b/goffice/utils/go-pixbuf.c
@@ -105,9 +105,15 @@ go_pixbuf_load_attr (GOImage *image, xmlChar const *attr_name, xmlChar const *at
 static void
 go_pixbuf_load_data (GOImage *image, GsfXMLIn *xin)
 {
-       int length;
+       size_t length, expected;
        length = gsf_base64_decode_simple (xin->content->str, strlen(xin->content->str));
-       image->data = g_memdup (xin->content->str, length);
+       expected = image->height * go_pixbuf_get_rowstride (GO_PIXBUF (image));
+       if (expected != length)
+               g_critical ("Invalid image size, expected %lu bytes, got %lu", expected, length);
+       image->data = g_malloc (expected);
+       memcpy (image->data, xin->content->str, (length < expected)? length: expected);
+       if (length < expected) /* fill with 0 */
+               memset (image->data + length, 0, expected - length);
 }
 
 static void