[gnumeric] protect against some overflows

[Andreas J. Guelzow <guelzow src gnome org>]

commit 5ef4e1b8d32ca617b1fd5c3b381c957f0012a893
Author: Andreas J. Guelzow <aguelzow pyrshep ca>
Date:   Sat Apr 18 11:42:15 2015 -0600

    protect against some overflows
    
    2015-04-18  Andreas J. Guelzow <aguelzow pyrshep ca>
    
        * openoffice-read.c (odf_preparse_row_start): avoid overflow
        (odf_preparse_cell_start): avoid overflow
        (odf_preparse_covered_cell_start): avoid overflow

 plugins/openoffice/ChangeLog         |    6 ++++++
 plugins/openoffice/openoffice-read.c |    7 ++++---
 2 files changed, 10 insertions(+), 3 deletions(-)
---
diff --git a/plugins/openoffice/ChangeLog b/plugins/openoffice/ChangeLog
index f0b08c9..2d604ec 100644
--- a/plugins/openoffice/ChangeLog
+++ b/plugins/openoffice/ChangeLog
@@ -1,3 +1,9 @@
+2015-04-18  Andreas J. Guelzow <aguelzow pyrshep ca>
+
+       * openoffice-read.c (odf_preparse_row_start): avoid overflow
+       (odf_preparse_cell_start): avoid overflow
+       (odf_preparse_covered_cell_start): avoid overflow
+
 2015-04-18  Morten Welinder  <terra gnome org>
 
        * openoffice-read.c (attr_eq_ncase): Delete.
diff --git a/plugins/openoffice/openoffice-read.c b/plugins/openoffice/openoffice-read.c
index 7f15e8c..eab512b 100644
--- a/plugins/openoffice/openoffice-read.c
+++ b/plugins/openoffice/openoffice-read.c
@@ -11546,7 +11546,8 @@ odf_preparse_row_start (GsfXMLIn *xin, xmlChar const **attrs)
        state->row_inc = 1;
 
        for (; attrs != NULL && attrs[0] && attrs[1] ; attrs += 2)
-               if (oo_attr_int_range (xin, attrs, OO_NS_TABLE, "number-rows-repeated", &state->row_inc, 0, 
INT_MAX));
+               if (oo_attr_int_range (xin, attrs, OO_NS_TABLE, "number-rows-repeated", &state->row_inc,
+                                      0, INT_MAX - state->pos.eval.row));
 }
 
 static void
@@ -11565,7 +11566,7 @@ odf_preparse_cell_start (GsfXMLIn *xin, xmlChar const **attrs)
 
        for (; attrs != NULL && attrs[0] && attrs[1] ; attrs += 2)
                if (oo_attr_int_range (xin, attrs, OO_NS_TABLE, "number-columns-repeated",
-                                      &state->col_inc, 0, INT_MAX));
+                                      &state->col_inc, 0, INT_MAX - state->pos.eval.col));
 
        oo_update_data_extent (state, state->col_inc, state->row_inc);
        state->pos.eval.col += state->col_inc;
@@ -11579,7 +11580,7 @@ odf_preparse_covered_cell_start (GsfXMLIn *xin, xmlChar const **attrs)
        state->col_inc = 1;
        for (; attrs != NULL && attrs[0] && attrs[1] ; attrs += 2)
                if (oo_attr_int_range (xin, attrs, OO_NS_TABLE, "number-columns-repeated",
-                                      &state->col_inc, 0, INT_MAX));
+                                      &state->col_inc, 0, INT_MAX - state->pos.eval.col));
        state->pos.eval.col += state->col_inc;
 }