[gnumeric] xlsx: fix ABR.

[Morten Welinder <mortenw src gnome org>]

commit 981524956851b16bb0d46c09942286a610938342
Author: Morten Welinder <terra gnome org>
Date:   Fri May 8 08:37:17 2015 -0400

    xlsx: fix ABR.
    
    This was accessing a global, static array with [-1].  That's valid
    for datasets, but not for series dimensions.
    
    Valgrind was no help here.  It cannot tell one global array from the
    next.

 NEWS                               |    2 +-
 plugins/excel/ChangeLog            |    5 +++++
 plugins/excel/xlsx-write-drawing.c |    2 +-
 3 files changed, 7 insertions(+), 2 deletions(-)
---
diff --git a/NEWS b/NEWS
index ca41f17..0e39f56 100644
--- a/NEWS
+++ b/NEWS
@@ -14,7 +14,7 @@ Morten:
        * Solver code refactoring.
        * Plug leaks.
        * Fuzzed file fixes.  [#748595]  [#748597] [#749031] [#749030]
-         [#749069]
+         [#749069] [#748533]
        * Make solver check linearity of model.
 
 --------------------------------------------------------------------------
diff --git a/plugins/excel/ChangeLog b/plugins/excel/ChangeLog
index 7667c49..a4936a6 100644
--- a/plugins/excel/ChangeLog
+++ b/plugins/excel/ChangeLog
@@ -1,3 +1,8 @@
+2015-05-08  Morten Welinder  <terra gnome org>
+
+       * xlsx-write-drawing.c (xlsx_write_series_dim): GogSeriesDesc does
+       not have a dimension -1, so don't access it.
+
 2015-05-07  Morten Welinder  <terra gnome org>
 
        * ms-excel-write.c (blipinf_new): Handle NULL image.  Fixes
diff --git a/plugins/excel/xlsx-write-drawing.c b/plugins/excel/xlsx-write-drawing.c
index b299bde..0696ee3 100644
--- a/plugins/excel/xlsx-write-drawing.c
+++ b/plugins/excel/xlsx-write-drawing.c
@@ -90,7 +90,7 @@ xlsx_write_series_dim (XLSXWriteState *state, GsfXMLOut *xml, GogSeries const *s
        int dim;
        GOData const *dat;
 
-       for (dim = -1; dim < (int) desc->num_dim; dim++)
+       for (dim = 0; dim < (int) desc->num_dim; dim++)
                if (desc->dim[dim].ms_type == ms_type)
                        break;
        if (dim == (int) desc->num_dim)