[gnumeric] xls: fix ABR in writing markup.

[Morten Welinder <mortenw src gnome org>]

commit 5e546b830ca105b113fee663535b4ee1ad92d891
Author: Morten Welinder <terra gnome org>
Date:   Fri Nov 22 18:11:13 2013 -0500

    xls: fix ABR in writing markup.

 plugins/excel/ChangeLog        |    5 +++++
 plugins/excel/ms-excel-write.c |   13 +++++++------
 2 files changed, 12 insertions(+), 6 deletions(-)
---
diff --git a/plugins/excel/ChangeLog b/plugins/excel/ChangeLog
index c25e5d0..1d8fce7 100644
--- a/plugins/excel/ChangeLog
+++ b/plugins/excel/ChangeLog
@@ -1,3 +1,8 @@
+2013-11-22  Morten Welinder  <terra gnome org>
+
+       * ms-excel-write.c (excel_write_RSTRING): Truncate markup at text
+       length.  Fixes #715003.
+
 2013-11-21  Morten Welinder  <terra gnome org>
 
        * ms-obj.c (read_pre_biff8_read_text): Fix fuzzed file problem
diff --git a/plugins/excel/ms-excel-write.c b/plugins/excel/ms-excel-write.c
index 9c1de36..62494e7 100644
--- a/plugins/excel/ms-excel-write.c
+++ b/plugins/excel/ms-excel-write.c
@@ -3433,6 +3433,7 @@ excel_write_RSTRING (ExcelWriteState *ewb, GnmCell const *cell, unsigned xf)
 {
        GArray *txo = g_hash_table_lookup (ewb->cell_markup, cell);
        const char *txt = value_peek_string (cell->value);
+       size_t txtlen = strlen (txt);
        guint8 buf [6];
        unsigned i, n;
 
@@ -3450,22 +3451,22 @@ excel_write_RSTRING (ExcelWriteState *ewb, GnmCell const *cell, unsigned xf)
                GSF_LE_SET_GUINT8 (buf, n);
                ms_biff_put_var_write  (ewb->bp, buf, 1);
                for (i = 0; i < n ; i++) {
-                       gint bpos = g_array_index (txo, gint, i*2);
-                       gint cpos = g_utf8_pointer_to_offset (txt, txt + bpos);
+                       guint bpos = g_array_index (txo, guint, i*2);
+                       gint cpos = g_utf8_pointer_to_offset (txt, txt + MIN (bpos, txtlen));
                        GSF_LE_SET_GUINT8 (buf, cpos);
                        GSF_LE_SET_GUINT8 (buf + 1,
-                               g_array_index (txo, gint, i*2+1));
+                               g_array_index (txo, guint, i*2+1));
                        ms_biff_put_var_write  (ewb->bp, buf, 2);
                }
        } else {
                GSF_LE_SET_GUINT16 (buf, n);
                ms_biff_put_var_write  (ewb->bp, buf, 2);
                for (i = 0; i < n ; i++) {
-                       gint bpos = g_array_index (txo, gint, i*2);
-                       gint cpos = g_utf8_pointer_to_offset (txt, txt + bpos);
+                       guint bpos = g_array_index (txo, guint, i*2);
+                       gint cpos = g_utf8_pointer_to_offset (txt, txt + MIN (bpos, txtlen));
                        GSF_LE_SET_GUINT16 (buf, cpos);
                        GSF_LE_SET_GUINT16 (buf + 2,
-                               g_array_index (txo, gint, i*2+1));
+                               g_array_index (txo, guint, i*2+1));
                        ms_biff_put_var_write  (ewb->bp, buf, 4);
                }
        }