[goffice] Fuzzed file fix. [#751272]

[Jean Bréfort <jbrefort src gnome org>]

commit d9a1be806284c0094001e8d25d1e6180d3b3cdac
Author: Jean Brefort <jean brefort normalesup org>
Date:   Mon Jun 22 09:42:01 2015 +0200

    Fuzzed file fix. [#751272]

 ChangeLog                      |    5 +++++
 NEWS                           |    2 +-
 plugins/plot_radar/gog-radar.c |    5 +++++
 3 files changed, 11 insertions(+), 1 deletions(-)
---
diff --git a/ChangeLog b/ChangeLog
index 3f4de45..f41bae9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2015-06-22  Jean Brefort  <jean brefort normalesup org>
+
+       * plugins/plot_radar/gog-radar.c (gog_rt_view_render): protect against wrong
+       series element index. [#751272]
+
 2015-06-21  Jean Brefort  <jean brefort normalesup org>
 
        * goffice/graph/gog-axis-color-map.c (color_map_load_from_uri): do not
diff --git a/NEWS b/NEWS
index 09440ef..c3bf7e2 100644
--- a/NEWS
+++ b/NEWS
@@ -2,7 +2,7 @@ goffice 0.10.23:
 
 Jean:
        * Disable metafiles support when there is no screen. [#748493]
-       * Fuzzed file fix.  [#750860] [#751059] [#751256] [#751257]
+       * Fuzzed file fix.  [#750860] [#751059] [#751256] [#751257] [#751272]
 
 Morten:
        * Fix ABR [#749167]
diff --git a/plugins/plot_radar/gog-radar.c b/plugins/plot_radar/gog-radar.c
index 431e265..47db095 100644
--- a/plugins/plot_radar/gog-radar.c
+++ b/plugins/plot_radar/gog-radar.c
@@ -1055,6 +1055,11 @@ gog_rt_view_render (GogView *view, GogViewAllocation const *bbox)
                } else if (overrides) {
                        while (overrides) {
                                count = GOG_SERIES_ELEMENT (overrides->data)->index;
+                               if (count >= series->base.num_elements) {
+                                       g_warning ("Invalid series element index");
+                                       overrides = overrides->next;
+                                       continue;
+                               }
                                gse = GOG_SERIES_ELEMENT (overrides->data);
                                rho = (!is_polar || (go_add_epsilon (r_vals[count] - rho_min) >= 0.0)) ?
                                        r_vals[count] : rho_min;