[gnumeric] xls: fix write problem with broken image.

[Morten Welinder <mortenw src gnome org>]

commit 4cb3fd041d0af3b8f59fab4a09011011c6d890ef
Author: Morten Welinder <terra gnome org>
Date:   Thu May 7 12:43:40 2015 -0400

    xls: fix write problem with broken image.

 NEWS                           |    1 +
 plugins/excel/ChangeLog        |    5 +++++
 plugins/excel/ms-excel-write.c |   11 ++++++++---
 3 files changed, 14 insertions(+), 3 deletions(-)
---
diff --git a/NEWS b/NEWS
index f30c52a..ca41f17 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,7 @@ Morten:
        * Solver code refactoring.
        * Plug leaks.
        * Fuzzed file fixes.  [#748595]  [#748597] [#749031] [#749030]
+         [#749069]
        * Make solver check linearity of model.
 
 --------------------------------------------------------------------------
diff --git a/plugins/excel/ChangeLog b/plugins/excel/ChangeLog
index 0bb45ff..7667c49 100644
--- a/plugins/excel/ChangeLog
+++ b/plugins/excel/ChangeLog
@@ -1,3 +1,8 @@
+2015-05-07  Morten Welinder  <terra gnome org>
+
+       * ms-excel-write.c (blipinf_new): Handle NULL image.  Fixes
+       #749069.
+
 2015-05-06  Morten Welinder  <terra gnome org>
 
        * xlsx-read.c (xlsx_file_open): Plug leaks related to fuzzed
diff --git a/plugins/excel/ms-excel-write.c b/plugins/excel/ms-excel-write.c
index acd4f1d..862679e 100644
--- a/plugins/excel/ms-excel-write.c
+++ b/plugins/excel/ms-excel-write.c
@@ -4361,7 +4361,6 @@ blipinf_new (SheetObjectImage *soi)
        BlipInf *blip;
        GOImage *image;
        char const *blip_type;
-       gsize len;
 
        blip = g_new0 (BlipInf, 1);
        blip->uncomp_len = -1;
@@ -4372,8 +4371,14 @@ blipinf_new (SheetObjectImage *soi)
                      "image-type", &blip->type,
                      "image", &image,
                      NULL);
-       blip->bytes.data = (gpointer)go_image_get_data (image, &len);
-       blip->bytes.len = len;
+       if (image) {
+               gsize len;
+               blip->bytes.data = (gpointer)go_image_get_data (image, &len);
+               blip->bytes.len = len;
+       } else {
+               blip->bytes.data = NULL;
+               blip->bytes.len = 0;
+       }
        blip_type = blip->type ? blip->type : "?";
        g_object_unref (image);