[gnumeric] xlsx: fuzzed file fix.

[Morten Welinder <mortenw src gnome org>]

commit 42417d52c654f0ad1eaa4b0f0c73e59ab123eaf7
Author: Morten Welinder <terra gnome org>
Date:   Mon Feb 8 14:52:29 2016 -0500

    xlsx: fuzzed file fix.

 ChangeLog                         |    5 +++++
 NEWS                              |    3 ++-
 plugins/excel/ChangeLog           |    5 +++++
 plugins/excel/xlsx-read-drawing.c |    9 ++++++++-
 src/graph.c                       |    4 ++--
 5 files changed, 22 insertions(+), 4 deletions(-)
---
diff --git a/ChangeLog b/ChangeLog
index 49d9a0e..1a08d97 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2016-02-08  Morten Welinder  <terra gnome org>
+
+       * src/graph.c (gnm_go_data_vector_eval)
+       (gnm_go_data_vector_finalize): Plug leak.
+
 2016-02-06  Morten Welinder <terra gnome org>
 
        * configure.ac: Post-release bump.
diff --git a/NEWS b/NEWS
index f4dffb5..8ac27e1 100644
--- a/NEWS
+++ b/NEWS
@@ -1,7 +1,8 @@
 Gnumeric 1.12.28
 
 Morten:
-       * Fuzzed file fixes.  [#761663]
+       * Fuzzed file fixes.  [#761663] [#761727]
+       * Plug leak.
 
 --------------------------------------------------------------------------
 Gnumeric 1.12.27
diff --git a/plugins/excel/ChangeLog b/plugins/excel/ChangeLog
index d774aad..f327575 100644
--- a/plugins/excel/ChangeLog
+++ b/plugins/excel/ChangeLog
@@ -1,3 +1,8 @@
+2016-02-08  Morten Welinder  <terra gnome org>
+
+       * xlsx-read-drawing.c (xlsx_chart_layout_target): Do proper
+       parsing.  Fixes #761727.
+
 2016-02-07  Morten Welinder  <terra gnome org>
 
        * xlsx-read-drawing.c (xlsx_rpr_latin): Check that null style.
diff --git a/plugins/excel/xlsx-read-drawing.c b/plugins/excel/xlsx-read-drawing.c
index 8b29489..c6e3a60 100644
--- a/plugins/excel/xlsx-read-drawing.c
+++ b/plugins/excel/xlsx-read-drawing.c
@@ -2245,7 +2245,14 @@ static void
 xlsx_chart_layout_target (GsfXMLIn *xin, xmlChar const **attrs)
 {
        XLSXReadState *state = (XLSXReadState *)xin->user_state;
-       state->chart_pos_target = !(attrs[1] && strcmp (attrs[1], "inner"));
+       static const EnumVal choices[] = {
+               { "outer",      FALSE },
+               { "inner",      TRUE },
+               { NULL, 0 }
+       };
+       int choice = FALSE;
+       (void)simple_enum (xin, attrs, choices, &choice);
+       state->chart_pos_target = choice;
 }
 
 static void
diff --git a/src/graph.c b/src/graph.c
index 0775be0..502cee7 100644
--- a/src/graph.c
+++ b/src/graph.c
@@ -493,7 +493,7 @@ gnm_go_data_vector_eval (GnmDependent *dep)
                vec->markup = NULL;
        }
        if (vec->strs) {
-               g_ptr_array_free (vec->strs, FALSE);
+               g_ptr_array_free (vec->strs, TRUE);
                vec->strs = NULL;
        }
        go_data_emit_changed (GO_DATA (vec));
@@ -515,7 +515,7 @@ gnm_go_data_vector_finalize (GObject *obj)
                vec->markup = NULL;
        }
        if (vec->strs) {
-               g_ptr_array_free (vec->strs, FALSE);
+               g_ptr_array_free (vec->strs, TRUE);
                vec->strs = NULL;
        }