[libgsf] OLE2: Property writing issue.

[Morten Welinder <mortenw src gnome org>]

commit 3969997ebdd57dcb4c2e388622503df21cfdb64a
Author: Morten Welinder <terra gnome org>
Date:   Fri Jan 1 15:21:37 2016 -0500

    OLE2: Property writing issue.

 ChangeLog             |    5 +++++
 NEWS                  |    3 +++
 gsf/gsf-msole-utils.c |   18 +++++++++---------
 3 files changed, 17 insertions(+), 9 deletions(-)
---
diff --git a/ChangeLog b/ChangeLog
index cc32945..58e47d8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2016-01-01  Morten Welinder  <terra gnome org>
+
+       * gsf/gsf-msole-utils.c (msole_metadata_write_section): Handle the
+       no-property case sanely.  Fixes #760047.
+
 2015-07-28  Morten Welinder <terra gnome org>
 
        * configure.ac: Post-release bump.
diff --git a/NEWS b/NEWS
index ba66410..ef1c65e 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,8 @@
 libgsf 1.14.35
 
+Morten:
+       * Fix OLE2 property writing issue.  [#760047]
+
 --------------------------------------------------------------------------
 libgsf 1.14.34
 
diff --git a/gsf/gsf-msole-utils.c b/gsf/gsf-msole-utils.c
index d996fe6..4a02074 100644
--- a/gsf/gsf-msole-utils.c
+++ b/gsf/gsf-msole-utils.c
@@ -547,7 +547,7 @@ msole_prop_parse (GsfMSOleMetaDataSection *section,
 
                for (i = 0 ; i < n ; i++) {
                        GValue *v;
-                       const char *data0 = *data;
+                       guint8 const *data0 = *data;
                        d (g_print ("\t[%d] ", i););
                        v = msole_prop_parse (section, type, data, data_end);
                        if (v) {
@@ -1578,14 +1578,16 @@ msole_metadata_write_section (WritePropState *state, gboolean user)
        offsets = g_alloca (sizeof (GsfMSOleMetaDataProp) * count);
 
        /* 0) codepage */
-       offsets[0].id = 1;
-       offsets[0].offset = gsf_output_tell (state->out);
-       GSF_LE_SET_GUINT32 (buf, VT_I2);
-       GSF_LE_SET_GUINT32 (buf+4, state->codepage);
-       gsf_output_write (state->out, 8, buf);
+       if (count >= 1) {
+               offsets[0].id = 1;
+               offsets[0].offset = gsf_output_tell (state->out);
+               GSF_LE_SET_GUINT32 (buf, VT_I2);
+               GSF_LE_SET_GUINT32 (buf+4, state->codepage);
+               gsf_output_write (state->out, 8, buf);
+       }
 
        /* 1) dictionary */
-       if (user) {
+       if (user && count >= 2) {
                offsets[1].id = 0;
                offsets[1].offset = gsf_output_tell (state->out);
                GSF_LE_SET_GUINT32 (buf, g_hash_table_size (state->dict));
@@ -1596,8 +1598,6 @@ msole_metadata_write_section (WritePropState *state, gboolean user)
        } else
                i = 1;
 
-       offsets[i].offset = gsf_output_tell (state->out);
-
        /* 2) props */
        for (; ptr != NULL && i < count ; ptr = ptr->next, i++) {
                offsets[i].offset = gsf_output_tell (state->out);