[gnumeric] Fix crash on corrupted files. [#706075]

[Andreas J. Guelzow <guelzow src gnome org>]

commit 8e021d192a92acf2072167346536f7f09f9c48ef
Author: Andreas J Guelzow <aguelzow pyrshep ca>
Date:   Thu Aug 15 10:57:31 2013 -0600

    Fix crash on corrupted files. [#706075]
    
    2013-08-15  Andreas J. Guelzow <aguelzow pyrshep ca>
    
        * ms-chart.c (BC_R(shtprops)): check whether we have enough data

 NEWS                     |    2 +-
 plugins/excel/ChangeLog  |    4 ++++
 plugins/excel/ms-chart.c |   26 ++++++++++++++------------
 3 files changed, 19 insertions(+), 13 deletions(-)
---
diff --git a/NEWS b/NEWS
index 80da0f7..572bff7 100644
--- a/NEWS
+++ b/NEWS
@@ -9,7 +9,7 @@ Andreas:
        * Improve import to ODF of empty cells with default column styles. [#704563]
        * Speed up loading of some ODF files. [#704422]
        * Fix ODF style import. [#704563]
-       * Fix crash on corrupted files. [#704636] [#705385] [#705421] [#705420]
+       * Fix crash on corrupted files. [#704636] [#705385] [#705421] [#705420] [#706075]
        * Fix ODF import of charts with series consisting of multiple ranges. [#704742]
        * Fix ODF export of charts with series consisting of multiple ranges.
        * Implement input message editing. [Part of #705310]
diff --git a/plugins/excel/ChangeLog b/plugins/excel/ChangeLog
index ff0f97a..b0d3616 100644
--- a/plugins/excel/ChangeLog
+++ b/plugins/excel/ChangeLog
@@ -1,3 +1,7 @@
+2013-08-15  Andreas J. Guelzow <aguelzow pyrshep ca>
+
+       * ms-chart.c (BC_R(shtprops)): check whether we have enough data
+
 2013-08-14  Morten Welinder  <terra gnome org>
 
        * ms-container.c (ms_container_read_markup): Add/reinstate bounds
diff --git a/plugins/excel/ms-chart.c b/plugins/excel/ms-chart.c
index cceb692..7ad04f7 100644
--- a/plugins/excel/ms-chart.c
+++ b/plugins/excel/ms-chart.c
@@ -2097,7 +2097,7 @@ BC_R(shtprops)(XLChartHandler const *handle,
               XLChartReadState *s, BiffQuery *q)
 {
        guint16 const flags = GSF_LE_GET_GUINT16 (q->data);
-       guint8 const tmp = GSF_LE_GET_GUINT16 (q->data+2);
+       guint8 tmp;
        gboolean const manual_format            = (flags&0x01) ? TRUE : FALSE;
        gboolean const only_plot_visible_cells  = (flags&0x02) ? TRUE : FALSE;
        gboolean const dont_size_with_window    = (flags&0x04) ? TRUE : FALSE;
@@ -2105,6 +2105,8 @@ BC_R(shtprops)(XLChartHandler const *handle,
        gboolean ignore_pos_record = FALSE;
        MSChartBlank blanks;
 
+       XL_CHECK_CONDITION_VAL (q->length >= 4, TRUE);
+       tmp = GSF_LE_GET_GUINT16 (q->data+2);
        g_return_val_if_fail (tmp < MS_CHART_BLANK_MAX, TRUE);
        blanks = tmp;
        d (2, g_printerr ("%s;", ms_chart_blank[blanks]););
@@ -2113,17 +2115,17 @@ BC_R(shtprops)(XLChartHandler const *handle,
                ignore_pos_record = (flags&0x10) ? TRUE : FALSE;
 
        d (1, {
-       g_printerr ("%sesize chart with window.\n",
-               dont_size_with_window ? "Don't r": "R");
-
-       if (has_pos_record && !ignore_pos_record)
-               g_printerr ("There should be a POS record around here soon\n");
-
-       if (manual_format)
-               g_printerr ("Manually formated\n");
-       if (only_plot_visible_cells)
-               g_printerr ("Only plot visible (to whom?) cells\n");
-       });
+                       g_printerr ("%sesize chart with window.\n",
+                                   dont_size_with_window ? "Don't r": "R");
+                       
+                       if (has_pos_record && !ignore_pos_record)
+                               g_printerr ("There should be a POS record around here soon\n");
+                       
+                       if (manual_format)
+                               g_printerr ("Manually formated\n");
+                       if (only_plot_visible_cells)
+                               g_printerr ("Only plot visible (to whom?) cells\n");
+               });
        return FALSE;
 }