[gnumeric] Paste: fix problem with inter-process paste and weird sheet sizes.

[Morten Welinder <mortenw src gnome org>]

commit d9cd5fa07a2d8bf1f7eddce3a66a8b01a15c925c
Author: Morten Welinder <terra gnome org>
Date:   Fri Jun 12 18:30:13 2020 -0400

    Paste: fix problem with inter-process paste and weird sheet sizes.

 ChangeLog          |  6 ++++++
 NEWS               |  1 +
 src/xml-sax-read.c | 31 +++++++++++++++++++------------
 3 files changed, 26 insertions(+), 12 deletions(-)
---
diff --git a/ChangeLog b/ChangeLog
index 9af6ade0b..912fbf48f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2020-06-12  Morten Welinder  <terra gnome org>
+
+       * src/xml-sax-read.c (xml_sax_cell): Relax sanity check a bit.
+       (xml_sax_cell_content): Fix sanity check for position.  Only the
+       relative position matters.  Fixes #497.
+
 2020-06-11  Morten Welinder  <terra gnome org>
 
        * src/ssconvert.c (merge_single): Also merge document-level
diff --git a/NEWS b/NEWS
index 98958069f..8f38aed9e 100644
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,7 @@ Morten:
        * Fix load of in-place graph data with extra ()s.  [#492]
        * Fix Ctrl-; cursor position.  [#494]
        * Fix ssconvert --merge-to problem.  [#496]
+       * Fix sheet size paste problem.  [#497]
 
 --------------------------------------------------------------------------
 Gnumeric 1.12.47
diff --git a/src/xml-sax-read.c b/src/xml-sax-read.c
index 24da0a492..5190cc65a 100644
--- a/src/xml-sax-read.c
+++ b/src/xml-sax-read.c
@@ -1946,8 +1946,6 @@ static void
 xml_sax_cell (GsfXMLIn *xin, xmlChar const **attrs)
 {
        XMLSaxParseState *state = (XMLSaxParseState *)xin->user_state;
-       Sheet *sheet = state->sheet;
-
        int row = -1, col = -1;
        int rows = -1, cols = -1;
        int value_type = -1;
@@ -1983,9 +1981,9 @@ xml_sax_cell (GsfXMLIn *xin, xmlChar const **attrs)
        if (value_type == -1)
                value_result = NULL;
 
-       XML_CHECK2 (col >= 0 && col < gnm_sheet_get_max_cols (sheet),
+       XML_CHECK2 (col >= 0 && col <= GNM_MAX_COLS - MAX (1, cols),
                    go_format_unref (value_fmt));
-       XML_CHECK2 (row >= 0 && row < gnm_sheet_get_max_rows (sheet),
+       XML_CHECK2 (row >= 0 && row <= GNM_MAX_ROWS - MAX (1, rows),
                    go_format_unref (value_fmt));
 
        if (cols > 0 || rows > 0) {
@@ -2097,9 +2095,8 @@ xml_sax_cell_content (GsfXMLIn *xin, G_GNUC_UNUSED GsfXMLBlob *blob)
 {
        XMLSaxParseState *state = (XMLSaxParseState *)xin->user_state;
        Sheet *sheet = state->sheet;
-
        gboolean is_new_cell = FALSE, is_post_52_array = FALSE;
-
+       int size_cols, size_rows;
        GnmParsePos pos;
        GnmCell *cell = NULL; /* Regular case */
        GnmCellCopy *cc = NULL; /* Clipboard case */
@@ -2132,17 +2129,28 @@ xml_sax_cell_content (GsfXMLIn *xin, G_GNUC_UNUSED GsfXMLBlob *blob)
        if (seen_contents)
                return;
 
-       XML_CHECK (col >= 0 && col < gnm_sheet_get_max_cols (sheet));
-       XML_CHECK (row >= 0 && row < gnm_sheet_get_max_rows (sheet));
+       is_post_52_array = (array_cols > 0) && (array_rows > 0);
+       size_cols = is_post_52_array ? array_cols : 1;
+       size_rows = is_post_52_array ? array_rows : 1;
 
        maybe_update_progress (xin);
 
        if (cr) {
-               cc = gnm_cell_copy_new (cr,
-                                       col - cr->base.col,
-                                       row - cr->base.row);
+               int x = col - cr->base.col;
+               int y = row - cr->base.row;
+
+               XML_CHECK (x >= 0 &&
+                          x <= gnm_sheet_get_max_cols (sheet) - size_cols);
+               XML_CHECK (y >= 0 &&
+                          y <= gnm_sheet_get_max_rows (sheet) - size_rows);
+               cc = gnm_cell_copy_new (cr, x, y);
                parse_pos_init (&pos, NULL, sheet, col, row);
        } else {
+               XML_CHECK (col >= 0 &&
+                          col <= gnm_sheet_get_max_cols (sheet) - size_cols);
+               XML_CHECK (row >= 0 &&
+                          row <= gnm_sheet_get_max_rows (sheet) - size_rows);
+
                cell = sheet_cell_get (sheet, col, row);
                is_new_cell = (cell == NULL);
                if (is_new_cell) {
@@ -2155,7 +2163,6 @@ xml_sax_cell_content (GsfXMLIn *xin, G_GNUC_UNUSED GsfXMLBlob *blob)
 
        // ----------------------------------------
 
-       is_post_52_array = (array_cols > 0) && (array_rows > 0);
        if (is_post_52_array && has_contents) {
                // Array formula
                g_return_if_fail (content[0] == '=');