[gnumeric] Fix out of bounds read. [#749121]

[Jean Bréfort <jbrefort src gnome org>]

commit 18acfd3468eca3f5cc285f211040de67ee8ccb41
Author: Jean Brefort <jean brefort normalesup org>
Date:   Sat May 9 07:29:56 2015 +0200

    Fix out of bounds read. [#749121]

 NEWS                       |    1 +
 plugins/excel/ChangeLog    |    4 ++++
 plugins/excel/xlsx-write.c |   11 +++++++----
 3 files changed, 12 insertions(+), 4 deletions(-)
---
diff --git a/NEWS b/NEWS
index 0e39f56..9a1c721 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,7 @@ Andreas:
 
 Jean:
        * Fix xlsx import of plot area manual layout. [#748016]
+       * Fix out of bounds read. [#749121]
 
 Morten:
        * Fix import/export of graph backplane.
diff --git a/plugins/excel/ChangeLog b/plugins/excel/ChangeLog
index a4936a6..29f858b 100644
--- a/plugins/excel/ChangeLog
+++ b/plugins/excel/ChangeLog
@@ -1,3 +1,7 @@
+2015-05-09  Jean Brefort  <jean brefort normalesup org>
+
+       * xlsx-write.c (xlsx_write_font): fix out of bounds read. [#749121]
+
 2015-05-08  Morten Welinder  <terra gnome org>
 
        * xlsx-write-drawing.c (xlsx_write_series_dim): GogSeriesDesc does
diff --git a/plugins/excel/xlsx-write.c b/plugins/excel/xlsx-write.c
index 90ebfc4..da354ed 100644
--- a/plugins/excel/xlsx-write.c
+++ b/plugins/excel/xlsx-write.c
@@ -719,11 +719,14 @@ xlsx_write_font (XLSXWriteState *state, GsfXMLOut *xml, GnmStyle const *style)
                        "singleAccounting",
                        "doubleAccounting"
                };
+               unsigned uline = gnm_style_get_font_uline (style);
 
-               gsf_xml_out_start_element (xml, "u");
-               gsf_xml_out_add_cstr
-                       (xml, "val", types[gnm_style_get_font_uline (style)]);
-               gsf_xml_out_end_element (xml);
+               if (uline < G_N_ELEMENTS (types)) {
+                       gsf_xml_out_start_element (xml, "u");
+                       gsf_xml_out_add_cstr
+                               (xml, "val", types[gnm_style_get_font_uline (style)]);
+                       gsf_xml_out_end_element (xml);
+               }
        }
        if (gnm_style_is_element_set (style, MSTYLE_FONT_COLOR))
                xlsx_write_color_element