[gnumeric] xls: fuzzed file FMR.

[Morten Welinder <mortenw src gnome org>]

commit bd052416f752af039b0dc653392886862bbcd02f
Author: Morten Welinder <terra gnome org>
Date:   Tue Nov 19 11:22:23 2013 -0500

    xls: fuzzed file FMR.

 NEWS                          |    2 +-
 plugins/excel/ChangeLog       |    4 ++++
 plugins/excel/ms-excel-read.c |    5 ++++-
 3 files changed, 9 insertions(+), 2 deletions(-)
---
diff --git a/NEWS b/NEWS
index 2ce9c31..8728cc0 100644
--- a/NEWS
+++ b/NEWS
@@ -13,7 +13,7 @@ Morten:
        * Improve accuracy of COMBIN, PERMUT, POCHHAMMER, FACT, GAMMA.
        * Improve accuracy of bessel functions with large non-integer alpha.
        * Improve accuracy of ACOTH.
-       * Fix fuzzed file crash.  [#708091] [#712662]
+       * Fix fuzzed file crash.  [#708091] [#712662] [#712685]
        * Restore sheet reordering by drag.
        * Fix BETA on win32.
        * Fix win32 registry initialization.
diff --git a/plugins/excel/ChangeLog b/plugins/excel/ChangeLog
index 87eddd4..8abcf6d 100644
--- a/plugins/excel/ChangeLog
+++ b/plugins/excel/ChangeLog
@@ -1,3 +1,7 @@
+2013-11-19  Morten Welinder  <terra gnome org>
+
+       * ms-excel-read.c (excel_read_MERGECELLS): Fix FMR [#712685]
+
 2013-11-11  Morten Welinder  <terra gnome org>
 
        * ms-excel-write.c (excel_write_ClientTextbox): Fix fuzzed file
diff --git a/plugins/excel/ms-excel-read.c b/plugins/excel/ms-excel-read.c
index 2861690..9e077ac 100644
--- a/plugins/excel/ms-excel-read.c
+++ b/plugins/excel/ms-excel-read.c
@@ -4862,9 +4862,12 @@ excel_read_MERGECELLS (BiffQuery *q, ExcelReadSheet *esheet)
                        GnmRange *r2 = overlap->data;
 
                        /* Unmerge r2, then merge (r U r2) */
+
+                       /* Do this early because the _remove can kill r2.  */
+                       r = range_union (&r, r2);
+
                        gnm_sheet_merge_remove (esheet->sheet, r2,
                                                GO_CMD_CONTEXT (esheet->container.importer->context));
-                       r = range_union (&r, r2);
                        g_slist_free (overlap);
                }
                gnm_sheet_merge_add (esheet->sheet, &r, FALSE,