[gnumeric] REPLACEB: Fix copying of bytes after those being replaced.

[Morten Welinder <mortenw src gnome org>]

commit 1e3af7b6c39b5e0bc5d3e26c8269316c3e939789
Author: Morten Welinder <terra gnome org>
Date:   Wed Apr 1 19:16:31 2015 -0400

    REPLACEB: Fix copying of bytes after those being replaced.

 NEWS                          |    1 +
 plugins/fn-string/ChangeLog   |    5 +++++
 plugins/fn-string/functions.c |    5 +++--
 3 files changed, 9 insertions(+), 2 deletions(-)
---
diff --git a/NEWS b/NEWS
index 330566c..39d8e64 100644
--- a/NEWS
+++ b/NEWS
@@ -24,6 +24,7 @@ Morten:
        * Improve xlsx roundtrip of GOStyle.
        * Improve reading of xlsx theme colours.
        * Plug leaks.
+       * Fix REPLACEB problem.  [#747210]
 
 --------------------------------------------------------------------------
 Gnumeric 1.12.21
diff --git a/plugins/fn-string/ChangeLog b/plugins/fn-string/ChangeLog
index d759f9b..1c6e84e 100644
--- a/plugins/fn-string/ChangeLog
+++ b/plugins/fn-string/ChangeLog
@@ -1,3 +1,8 @@
+2015-04-01  Morten Welinder  <terra gnome org>
+
+       * functions.c (gnumeric_replaceb): Copy from the right string.
+       Ensure room for terminating 0.  Fixes #747210.
+
 2015-03-19  Morten Welinder  <terra gnome org>
 
        * functions.c (gnumeric_midb, gnumeric_replaceb): Fix length
diff --git a/plugins/fn-string/functions.c b/plugins/fn-string/functions.c
index 89813cf..dc127df 100644
--- a/plugins/fn-string/functions.c
+++ b/plugins/fn-string/functions.c
@@ -923,13 +923,14 @@ gnumeric_replaceb (GnmFuncEvalInfo *ei, GnmValue const * const *argv)
        if ((ipos > slen) ||
            (ipos + ilen > slen) ||
            ((gunichar)-1 == g_utf8_get_char_validated (old + ipos, -1)) ||
+           ((gunichar)-1 == g_utf8_get_char_validated (old + ipos + ilen, -1)) ||
            !g_utf8_validate (old + ipos, ilen, NULL))
                return value_new_error_VALUE (ei->pos);
        newlen = strlen (new);
-       res = g_malloc (slen - ilen + newlen);
+       res = g_malloc (slen - ilen + newlen + 1);
        memcpy (res, old, ipos);
        memcpy (res + ipos, new, newlen);
-       memcpy (res + ipos + newlen, new + ipos + ilen + 1, slen - ipos - ilen);
+       memcpy (res + ipos + newlen, old + ipos + ilen, slen - ipos - ilen + 1);
        return value_new_string_nocopy (res);
 }