[gnumeric] xls: fix another string reading problem.

[Morten Welinder <mortenw src gnome org>]

commit 789307c4f6b5a90ea77219827bd48b469e2ca31c
Author: Morten Welinder <terra gnome org>
Date:   Tue May 12 20:12:40 2015 -0400

    xls: fix another string reading problem.

 NEWS                          |    2 +-
 plugins/excel/ChangeLog       |    3 +++
 plugins/excel/ms-excel-read.c |   24 ++++++++++++++----------
 3 files changed, 18 insertions(+), 11 deletions(-)
---
diff --git a/NEWS b/NEWS
index 0bc78b1..5d52d67 100644
--- a/NEWS
+++ b/NEWS
@@ -16,7 +16,7 @@ Morten:
        * Plug leaks.
        * Fuzzed file fixes.  [#748595] [#748597] [#749031] [#749030]
          [#749069] [#748533] [#749118] [#749166] [#749181] [#749184]
-         [#749236] [#749240] [#749234] [#749235] [#749271]
+         [#749236] [#749240] [#749234] [#749235] [#749271] [#749270]
        * Make solver check linearity of model.
        * Fix xls saving of marker style.  [#749185]
 
diff --git a/plugins/excel/ChangeLog b/plugins/excel/ChangeLog
index c2a17ad..59eb04a 100644
--- a/plugins/excel/ChangeLog
+++ b/plugins/excel/ChangeLog
@@ -1,5 +1,8 @@
 2015-05-12  Morten Welinder  <terra gnome org>
 
+       * ms-excel-read.c (excel_read_DV): Stop using
+       excel_get_text_fixme.  Fixes #749270.
+
        * ms-excel-write.c (extract_txomarkup): Handle missing text.
 
 2015-05-11  Morten Welinder  <terra gnome org>
diff --git a/plugins/excel/ms-excel-read.c b/plugins/excel/ms-excel-read.c
index 79ca607..3937808 100644
--- a/plugins/excel/ms-excel-read.c
+++ b/plugins/excel/ms-excel-read.c
@@ -5555,23 +5555,27 @@ excel_read_DV (BiffQuery *q, ExcelReadSheet *esheet)
        data = q->data + 4;
 
        XL_CHECK_CONDITION (data+3 <= end);
-       input_title = excel_get_text_fixme (esheet->container.importer, data + 2,
-                                           GSF_LE_GET_GUINT16 (data), &len, NULL);
+       input_title = excel_get_text (esheet->container.importer, data + 2,
+                                     GSF_LE_GET_GUINT16 (data), &len, NULL,
+                                     end - (data + 2));
        data += len + 2;
 
        XL_CHECK_CONDITION (data+3 <= end);
-       error_title = excel_get_text_fixme (esheet->container.importer, data + 2,
-                                           GSF_LE_GET_GUINT16 (data), &len, NULL);
+       error_title = excel_get_text (esheet->container.importer, data + 2,
+                                     GSF_LE_GET_GUINT16 (data), &len, NULL,
+                                     end - (data + 2));
        data += len + 2;
 
        XL_CHECK_CONDITION (data+3 <= end);
-       input_msg = excel_get_text_fixme (esheet->container.importer, data + 2,
-                                         GSF_LE_GET_GUINT16 (data), &len, NULL);
+       input_msg = excel_get_text (esheet->container.importer, data + 2,
+                                   GSF_LE_GET_GUINT16 (data), &len, NULL,
+                                   end - (data + 2));
        data += len + 2;
 
        XL_CHECK_CONDITION (data+3 <= end);
-       error_msg = excel_get_text_fixme (esheet->container.importer, data + 2,
-                                         GSF_LE_GET_GUINT16 (data), &len, NULL);
+       error_msg = excel_get_text (esheet->container.importer, data + 2,
+                                   GSF_LE_GET_GUINT16 (data), &len, NULL,
+                                   end - (data + 2));
        data += len + 2;
 
        d (1, {
@@ -5581,13 +5585,13 @@ excel_read_DV (BiffQuery *q, ExcelReadSheet *esheet)
                        g_printerr ("Error Msg   : '%s'\n", error_msg);
                });
 
-       XL_CHECK_CONDITION (data+2 <= end);
+       XL_CHECK_CONDITION (data+4 <= end);
        expr1_len = GSF_LE_GET_GUINT16 (data);
        d (5, g_printerr ("Unknown1 = %hx\n", GSF_LE_GET_GUINT16 (data+2)););
        expr1_dat = data  + 4;  /* TODO : What are the missing 2 bytes ? */
        data += expr1_len + 4;
 
-       XL_CHECK_CONDITION (data+2 <= end);
+       XL_CHECK_CONDITION (data+4 <= end);
        expr2_len = GSF_LE_GET_GUINT16 (data);
        d (5, g_printerr ("Unknown2 = %hx\n", GSF_LE_GET_GUINT16 (data+2)););
        expr2_dat = data  + 4;  /* TODO : What are the missing 2 bytes ? */