[gnumeric] avoid some more overflows

[Andreas J. Guelzow <guelzow src gnome org>]

commit d606800892f986c1758f7b15524093390c0fd05e
Author: Andreas J. Guelzow <aguelzow pyrshep ca>
Date:   Sat Apr 18 11:52:27 2015 -0600

    avoid some more overflows
    
    2015-04-18  Andreas J. Guelzow <aguelzow pyrshep ca>
    
        * openoffice-read.c (oo_col_start): avoid overflow
        (oo_row_start): avoid overflow
        (oo_cell_start): avoid overflow
        (oo_covered_cell_start): avoid overflow

 plugins/openoffice/ChangeLog         |    7 +++++++
 plugins/openoffice/openoffice-read.c |   10 ++++++----
 2 files changed, 13 insertions(+), 4 deletions(-)
---
diff --git a/plugins/openoffice/ChangeLog b/plugins/openoffice/ChangeLog
index 2d604ec..5646de0 100644
--- a/plugins/openoffice/ChangeLog
+++ b/plugins/openoffice/ChangeLog
@@ -1,5 +1,12 @@
 2015-04-18  Andreas J. Guelzow <aguelzow pyrshep ca>
 
+       * openoffice-read.c (oo_col_start): avoid overflow
+       (oo_row_start): avoid overflow
+       (oo_cell_start): avoid overflow
+       (oo_covered_cell_start): avoid overflow
+
+2015-04-18  Andreas J. Guelzow <aguelzow pyrshep ca>
+
        * openoffice-read.c (odf_preparse_row_start): avoid overflow
        (odf_preparse_cell_start): avoid overflow
        (odf_preparse_covered_cell_start): avoid overflow
diff --git a/plugins/openoffice/openoffice-read.c b/plugins/openoffice/openoffice-read.c
index eab512b..4ee4cc8 100644
--- a/plugins/openoffice/openoffice-read.c
+++ b/plugins/openoffice/openoffice-read.c
@@ -3605,7 +3605,8 @@ oo_col_start (GsfXMLIn *xin, xmlChar const **attrs)
                        style = odf_style_from_oo_cell_style (xin, oostyle);
                } else if (gsf_xml_in_namecmp (xin, CXML2C (attrs[0]), OO_NS_TABLE, "style-name"))
                        col_info = g_hash_table_lookup (state->styles.col, attrs[1]);
-               else if (oo_attr_int_range (xin, attrs, OO_NS_TABLE, "number-columns-repeated", 
&repeat_count, 0, INT_MAX))
+               else if (oo_attr_int_range (xin, attrs, OO_NS_TABLE, "number-columns-repeated",
+                                           &repeat_count, 0, INT_MAX - state->pos.eval.col))
                        ;
                else if (gsf_xml_in_namecmp (xin, CXML2C (attrs[0]), OO_NS_TABLE, "visibility"))
                        hidden = !attr_eq (attrs[1], "visible");
@@ -3747,7 +3748,8 @@ oo_row_start (GsfXMLIn *xin, xmlChar const **attrs)
                        style = odf_style_from_oo_cell_style (xin, oostyle);
                } else if (gsf_xml_in_namecmp (xin, CXML2C (attrs[0]), OO_NS_TABLE, "style-name"))
                        row_info = g_hash_table_lookup (state->styles.row, attrs[1]);
-               else if (oo_attr_int_range (xin, attrs, OO_NS_TABLE, "number-rows-repeated", &repeat_count, 
0, INT_MAX))
+               else if (oo_attr_int_range (xin, attrs, OO_NS_TABLE, "number-rows-repeated", &repeat_count, 0,
+                                           INT_MAX - state->pos.eval.row))
                        ;
                else if (gsf_xml_in_namecmp (xin, CXML2C (attrs[0]), OO_NS_TABLE, "visibility"))
                        hidden = !attr_eq (attrs[1], "visible");
@@ -3870,7 +3872,7 @@ oo_cell_start (GsfXMLIn *xin, xmlChar const **attrs)
        state->content_is_error = FALSE;
        for (; attrs != NULL && attrs[0] && attrs[1] ; attrs += 2) {
                if (oo_attr_int_range (xin, attrs, OO_NS_TABLE, "number-columns-repeated",
-                                      &state->col_inc, 0, INT_MAX))
+                                      &state->col_inc, 0, INT_MAX - state->pos.eval.col))
                        ;
                else if (gsf_xml_in_namecmp (xin, CXML2C (attrs[0]), OO_GNUM_NS_EXT, "error-value"))
                        /* While the value of this attribute contains the true error value   */
@@ -4354,7 +4356,7 @@ oo_covered_cell_start (GsfXMLIn *xin, xmlChar const **attrs)
        state->col_inc = 1;
        for (; attrs != NULL && attrs[0] && attrs[1] ; attrs += 2)
                if (oo_attr_int_range (xin, attrs, OO_NS_TABLE, "number-columns-repeated",
-                                      &state->col_inc, 0, INT_MAX))
+                                      &state->col_inc, 0, INT_MAX - state->pos.eval.col))
                        ;
 #if 0
                /* why bother it is covered ? */