[goffice] Don't crash when loading a pixbuf with an invalid size. [#704560]

[Jean Bréfort <jbrefort src gnome org>]

commit 005964b69eed8aabd368536a7944a1b418819ba3
Author: Jean Brefort <jean brefort normalesup org>
Date:   Sat Jul 20 08:15:13 2013 +0200

    Don't crash when loading a pixbuf with an invalid size. [#704560]

 ChangeLog                 |    5 +++++
 NEWS                      |    1 +
 goffice/utils/go-pixbuf.c |    4 ++--
 3 files changed, 8 insertions(+), 2 deletions(-)
---
diff --git a/ChangeLog b/ChangeLog
index 5d1e39e..bf56b67 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2013-07-20  Jean Brefort  <jean brefort normalesup org>
+
+       * goffice/utils/go-pixbuf.c (go_pixbuf_load_data): use g_try_malloc instead
+       of g_malloc to avoid crashes. [#704560]
+
 2013-07-18  Jean Brefort  <jean brefort normalesup org>
 
        reviewed by: <delete if not using a buddy>
diff --git a/NEWS b/NEWS
index bf252d6..fbacc55 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ goffice 0.10.5:
 Jean:
        * Don't crash when loading an EMF image without valid data. [#704311]
        * Fixed text and path items positions. [see #704391]
+       * Don't crash when loading a pixbuf with an invalid size. [#704560]
 
 Morten:
        * Add prescaling to go_linear_regression_leverage.  [#703381]
diff --git a/goffice/utils/go-pixbuf.c b/goffice/utils/go-pixbuf.c
index cef0033..781a5d8 100644
--- a/goffice/utils/go-pixbuf.c
+++ b/goffice/utils/go-pixbuf.c
@@ -111,8 +111,8 @@ go_pixbuf_load_data (GOImage *image, GsfXMLIn *xin)
        expected = image->height * go_pixbuf_get_rowstride (GO_PIXBUF (image));
        if (expected != length)
                g_critical ("Invalid image size, expected %lu bytes, got %lu", expected, length);
-       image->data = g_malloc (expected);
-       g_return_if_fail (image->data !=NULL);
+       image->data = g_try_malloc (expected);
+       g_return_if_fail (image->data != NULL);
        memcpy (image->data, xin->content->str, (length < expected)? length: expected);
        if (length < expected) /* fill with 0 */
                memset (image->data + length, 0, expected - length);