gnumeric r17262 - in trunk: . plugins/excel

[mortenw svn gnome org]

Author: mortenw
Date: Tue Mar 31 18:59:24 2009
New Revision: 17262
URL: http://svn.gnome.org/viewvc/gnumeric?rev=17262&view=rev

Log:
2009-03-31  Morten Welinder  <terra gnome org>

	* ms-excel-read.c (excel_read_MERGECELLS): Fix sanity check.
	Fixes #577503.



Modified:
   trunk/NEWS
   trunk/plugins/excel/ChangeLog
   trunk/plugins/excel/ms-excel-read.c

Modified: trunk/NEWS
==============================================================================
--- trunk/NEWS	(original)
+++ trunk/NEWS	Tue Mar 31 18:59:24 2009
@@ -8,7 +8,7 @@
 	* Fix Applix loading crash.  [#577145]
 	* Fix Lotus loading crash.  [#577156]
 	* Fix XLS loading crashes.  [#577205] [#577208] [#577259] [#577260]
-	[#577348] [#577351] [#577399] [#577400]
+	[#577348] [#577351] [#577399] [#577400] [#577503]
 	* Add sorted sheet list to tab menu.
 	* Fix criticals during Lotus load.
 

Modified: trunk/plugins/excel/ms-excel-read.c
==============================================================================
--- trunk/plugins/excel/ms-excel-read.c	(original)
+++ trunk/plugins/excel/ms-excel-read.c	Tue Mar 31 18:59:24 2009
@@ -4477,11 +4477,13 @@
 static void
 excel_read_MERGECELLS (BiffQuery *q, ExcelReadSheet *esheet)
 {
-	int num_merged = GSF_LE_GET_GUINT16 (q->data);
+	int num_merged;
 	guint8 const *data = q->data + 2;
 	GnmRange r;
 	GSList *overlap;
 
+	XL_CHECK_CONDITION (q->length >= 2);
+	num_merged = GSF_LE_GET_GUINT16 (q->data);
 	XL_CHECK_CONDITION (q->length == (unsigned int)(2 + 8 * num_merged));
 
 	while (num_merged-- > 0) {