[gnumeric] xls: fuzzed file fix re shared formulas.

[Morten Welinder <mortenw src gnome org>]

commit 2d85cd88704e85e6402e2744589aded589b94137
Author: Morten Welinder <terra gnome org>
Date:   Mon Jun 29 20:26:13 2015 -0400

    xls: fuzzed file fix re shared formulas.

 ChangeLog                     |    5 +++++
 NEWS                          |    2 +-
 plugins/excel/ChangeLog       |    4 ++++
 plugins/excel/ms-excel-read.c |    2 +-
 src/func.c                    |    7 +++++--
 5 files changed, 16 insertions(+), 4 deletions(-)
---
diff --git a/ChangeLog b/ChangeLog
index da890f7..3e4b2c0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2015-06-29  Morten Welinder  <terra gnome org>
+
+       * src/func.c (function_iterate_argument_values): Improve name
+       handling.  Part of #751660.
+
 2015-06-28  Morten Welinder  <terra gnome org>
 
        * src/value-sheet.c (value_area_get_width, value_area_get_height):
diff --git a/NEWS b/NEWS
index f0eaeba..17fe511 100644
--- a/NEWS
+++ b/NEWS
@@ -30,7 +30,7 @@ Morten:
          [#749424] [#749917] [#749919] [#750043] [#750044] [#750046]
          [#750811] [#750810] [#750857] [#750864] [#750862] [#750858]
          [#751126] [#751254] [#751253] [#750851] [#751258] [#751259]
-         [#751502] [#751390] [#751579] [#751659]
+         [#751502] [#751390] [#751579] [#751659] [#751660]
        * Make solver check linearity of model.
        * Fix xls saving of marker style.  [#749185]
        * Make compilation with clang work again.  [#749138]
diff --git a/plugins/excel/ChangeLog b/plugins/excel/ChangeLog
index e358e62..8e15f01 100644
--- a/plugins/excel/ChangeLog
+++ b/plugins/excel/ChangeLog
@@ -1,5 +1,9 @@
 2015-06-29  Morten Welinder  <terra gnome org>
 
+       * ms-excel-read.c (excel_formula_shared): Handle duplicates in
+       shared formula tables.  This shouldn't happen in proper files.
+       Fixes part of #751660.
+
        * ms-formula-read.c (excel_parse_formula1): Survive bogus array
        constant.  Fixes #751659.
 
diff --git a/plugins/excel/ms-excel-read.c b/plugins/excel/ms-excel-read.c
index 00cf026..db1e2f2 100644
--- a/plugins/excel/ms-excel-read.c
+++ b/plugins/excel/ms-excel-read.c
@@ -2806,7 +2806,7 @@ excel_formula_shared (BiffQuery *q, ExcelReadSheet *esheet, GnmCell *cell)
                dt->c_in.col = GSF_LE_GET_GUINT16 (q->data + 10);
                dt->r_in.row = GSF_LE_GET_GUINT16 (q->data + 12);
                dt->r_in.col = GSF_LE_GET_GUINT16 (q->data + 14);
-               g_hash_table_insert (esheet->tables, &dt->table.start, dt);
+               g_hash_table_replace (esheet->tables, &dt->table.start, dt);
 
                args = gnm_expr_list_append (args, gnm_expr_new_cellref (
                                                                         gnm_cellref_init (&ref, NULL,
diff --git a/src/func.c b/src/func.c
index 2d174ce..d278015 100644
--- a/src/func.c
+++ b/src/func.c
@@ -2317,13 +2317,16 @@ function_iterate_argument_values (GnmEvalPos const      *ep,
                /* need to drill down into names to handle things like
                 * sum(name)  with name := (A:A,B:B) */
                while (GNM_EXPR_GET_OPER (expr) == GNM_EXPR_OP_NAME) {
-                       expr = expr->name.name->texpr->expr;
+                       GnmExprTop const *texpr = expr->name.name->texpr;
+                       expr = texpr ? texpr->expr : NULL;
                        if (expr == NULL) {
                                if (strict)
                                        return value_new_error_REF (ep);
-                               continue;
+                               break;
                        }
                }
+               if (!expr)
+                       continue;
 
                /* Handle sets as a special case */
                if (GNM_EXPR_GET_OPER (expr) == GNM_EXPR_OP_SET) {