[gnumeric] Fix Morten's fuzz #627192

[Andreas J. Guelzow <guelzow src gnome org>]

commit 853546a3e6d87b296b0307ae12a11f296c4b0825
Author: Andreas J Guelzow <aguelzow pyrshep ca>
Date:   Tue Aug 17 15:26:00 2010 -0600

    Fix Morten's fuzz #627192
    
    2010-08-17  Andreas J. Guelzow <aguelzow pyrshep ca>
    
    	* openoffice-write.c (oo_attr_pos_int): new
    	(oo_col_start): use oo_attr_pos_int inistead of oo_attr_int for repeat
    	  counts
    	(oo_row_start): ditto
    	(oo_cell_start): ditto
    	(oo_covered_cell_start): ditto

 plugins/openoffice/ChangeLog         |    9 +++++++++
 plugins/openoffice/openoffice-read.c |   23 +++++++++++++++++++----
 2 files changed, 28 insertions(+), 4 deletions(-)
---
diff --git a/plugins/openoffice/ChangeLog b/plugins/openoffice/ChangeLog
index 9c5ade8..952b3b5 100644
--- a/plugins/openoffice/ChangeLog
+++ b/plugins/openoffice/ChangeLog
@@ -1,5 +1,14 @@
 2010-08-17  Andreas J. Guelzow <aguelzow pyrshep ca>
 
+	* openoffice-write.c (oo_attr_pos_int): new
+	(oo_col_start): use oo_attr_pos_int inistead of oo_attr_int for repeat 
+	  counts
+	(oo_row_start): ditto
+	(oo_cell_start): ditto
+	(oo_covered_cell_start): ditto
+
+2010-08-17  Andreas J. Guelzow <aguelzow pyrshep ca>
+
 	* openoffice-write.c (odf_write_axis_ring): strip brackets
 	(odf_write_plot): make sure we export the elements in the correct order.
 
diff --git a/plugins/openoffice/openoffice-read.c b/plugins/openoffice/openoffice-read.c
index 1f4691c..c4630e0 100644
--- a/plugins/openoffice/openoffice-read.c
+++ b/plugins/openoffice/openoffice-read.c
@@ -368,6 +368,21 @@ oo_attr_int (GsfXMLIn *xin, xmlChar const * const *attrs,
 }
 
 static gboolean
+oo_attr_pos_int (GsfXMLIn *xin, xmlChar const * const *attrs,
+	     int ns_id, char const *name, int *res)
+{
+	int tmp;
+	if (!oo_attr_int (xin, attrs, ns_id, name, &tmp))
+		return FALSE;
+	if (tmp < 1)
+		return oo_warning (xin, "Invalid integer '%s', for '%s'",
+				   attrs[1], name);
+	*res = tmp;
+	return TRUE;
+}
+
+
+static gboolean
 oo_attr_float (GsfXMLIn *xin, xmlChar const * const *attrs,
 	       int ns_id, char const *name, gnm_float *res)
 {
@@ -1011,7 +1026,7 @@ oo_col_start (GsfXMLIn *xin, xmlChar const **attrs)
 			style = g_hash_table_lookup (state->styles.cell, attrs[1]);
 		else if (gsf_xml_in_namecmp (xin, CXML2C (attrs[0]), OO_NS_TABLE, "style-name"))
 			col_info = g_hash_table_lookup (state->styles.col, attrs[1]);
-		else if (oo_attr_int (xin, attrs, OO_NS_TABLE, "number-columns-repeated", &repeat_count))
+		else if (oo_attr_pos_int (xin, attrs, OO_NS_TABLE, "number-columns-repeated", &repeat_count))
 			;
 		else if (gsf_xml_in_namecmp (xin, CXML2C (attrs[0]), OO_NS_TABLE, "visibility"))
 			hidden = !attr_eq (attrs[1], "visible");
@@ -1118,7 +1133,7 @@ oo_row_start (GsfXMLIn *xin, xmlChar const **attrs)
 	for (; attrs != NULL && attrs[0] && attrs[1] ; attrs += 2) {
 		if (gsf_xml_in_namecmp (xin, CXML2C (attrs[0]), OO_NS_TABLE, "style-name"))
 			row_info = g_hash_table_lookup (state->styles.row, attrs[1]);
-		else if (oo_attr_int (xin, attrs, OO_NS_TABLE, "number-rows-repeated", &repeat_count))
+		else if (oo_attr_pos_int (xin, attrs, OO_NS_TABLE, "number-rows-repeated", &repeat_count))
 			;
 		else if (gsf_xml_in_namecmp (xin, CXML2C (attrs[0]), OO_NS_TABLE, "visibility"))
 			hidden = !attr_eq (attrs[1], "visible");
@@ -1212,7 +1227,7 @@ oo_cell_start (GsfXMLIn *xin, xmlChar const **attrs)
 	state->col_inc = 1;
 	state->content_is_error = FALSE;
 	for (; attrs != NULL && attrs[0] && attrs[1] ; attrs += 2) {
-		if (oo_attr_int (xin, attrs, OO_NS_TABLE, "number-columns-repeated", &state->col_inc))
+		if (oo_attr_pos_int (xin, attrs, OO_NS_TABLE, "number-columns-repeated", &state->col_inc))
 			;
 		else if (gsf_xml_in_namecmp (xin, CXML2C (attrs[0]), OO_NS_TABLE, "formula")) {
 			OOFormula f_type = FORMULA_OPENFORMULA;
@@ -1540,7 +1555,7 @@ oo_covered_cell_start (GsfXMLIn *xin, xmlChar const **attrs)
 
 	state->col_inc = 1;
 	for (; attrs != NULL && attrs[0] && attrs[1] ; attrs += 2)
-		if (oo_attr_int (xin, attrs, OO_NS_TABLE, "number-columns-repeated", &state->col_inc))
+		if (oo_attr_pos_int (xin, attrs, OO_NS_TABLE, "number-columns-repeated", &state->col_inc))
 			;
 #if 0
 		/* why bother it is covered ? */