[gnumeric] xls: fuzzed file fix re objects.

[Morten Welinder <mortenw src gnome org>]

commit 745309ccc6fb668fe54dbf920978e0f11696291f
Author: Morten Welinder <terra gnome org>
Date:   Mon Jan 4 09:52:36 2016 -0500

    xls: fuzzed file fix re objects.

 NEWS                    |    4 ++--
 plugins/excel/ChangeLog |    4 ++++
 plugins/excel/ms-obj.c  |    6 +++++-
 3 files changed, 11 insertions(+), 3 deletions(-)
---
diff --git a/NEWS b/NEWS
index bfa3f6a..c9716da 100644
--- a/NEWS
+++ b/NEWS
@@ -8,8 +8,8 @@ Andreas:
 Morten:
        * Teach ssconvert to split sheets into separate .txt files [#694408]
        * Improve test suite.
-       * Fuzzed file fixes.  [#760046]  [#760085]  [#760087]  [#760089]
-         [#760043]  [#760103]  [#760102]
+       * Fuzzed file fixes.  [#760046] [#760085] [#760087] [#760089]
+         [#760043] [#760103] [#760102] [#760101]
 
 --------------------------------------------------------------------------
 Gnumeric 1.12.26
diff --git a/plugins/excel/ChangeLog b/plugins/excel/ChangeLog
index 4c90dba..379ed91 100644
--- a/plugins/excel/ChangeLog
+++ b/plugins/excel/ChangeLog
@@ -1,3 +1,7 @@
+2016-01-04  Morten Welinder  <terra gnome org>
+
+       * ms-obj.c (ms_obj_read_biff8_obj): Fuzzed file fix.  #760101.
+
 2016-01-03  Morten Welinder  <terra gnome org>
 
        * ms-excel-read.c (excel_sheet_new): Always create a new sheet.
diff --git a/plugins/excel/ms-obj.c b/plugins/excel/ms-obj.c
index e87ccb3..f1c9101 100644
--- a/plugins/excel/ms-obj.c
+++ b/plugins/excel/ms-obj.c
@@ -1131,7 +1131,11 @@ ms_obj_read_biff8_obj (BiffQuery *q, MSContainer *c, MSObj *obj)
                        break;
 
                case GR_COMMON_OBJ_DATA : {
-                       guint16 const options = GSF_LE_GET_GUINT16 (data+8);
+                       guint16 options;
+
+                       XL_CHECK_CONDITION_VAL (data_len_left >= 10, TRUE);
+
+                       options = GSF_LE_GET_GUINT16 (data+8);
 
                        /* Multiple objects in 1 record ?? */
                        XL_CHECK_CONDITION_VAL (obj->excel_type == -1, TRUE);