Index: plugins/excel/ms-excel-read.c
===================================================================
--- plugins/excel/ms-excel-read.c	(revision 16250)
+++ plugins/excel/ms-excel-read.c	(working copy)
@@ -96,6 +96,26 @@
 
 #define N_BYTES_BETWEEN_PROGRESS_UPDATES   0x1000
 
+#define XL_NEED_BYTES(count) XL_NEED_ITEMS(count,1)
+
+#define XL_NEED_ITEMS(count__,size__)					\
+  do {									\
+	  size_t count_ = (count__);					\
+	  size_t size_ = (size__);					\
+	  size_t left_ = q->length - (data - q->data);			\
+	  if (count_ > G_MAXUINT / size_ ||				\
+	      count_ * size_ > left_) {					\
+		  g_warning ("File is most likely corrupted.\n"		\
+			     "(Requested %d items of size %d, "		\
+                             "but only %d bytes left in record.\n"	\
+			     "The problem occurred in %s.\n",		\
+			     count_, size_, left_,			\
+			     G_STRFUNC);				\
+		return;							\
+	  }								\
+  } while (0)
+
+
 /* #define NO_DEBUG_EXCEL */
 #ifndef NO_DEBUG_EXCEL
 #define d(level, code)	do { if (ms_excel_read_debug > level) { code } } while (0)
@@ -5050,7 +5070,7 @@
 	if ((options & 0x14) == 0x14) {			/* label */
 		len = GSF_LE_GET_GUINT32 (data);
 		data += 4;
-		XL_CHECK_CONDITION (data + len*2 - q->data <= (int)q->length);
+		XL_NEED_ITEMS (len, 2);
 		label = read_utf16_str (len, data);
 		data += len*2;
 		d (1, fprintf (stderr, "label = %s\n", label););
@@ -5059,7 +5079,7 @@
 	if (options & 0x80) {				/* target_base */
 		len = GSF_LE_GET_GUINT32 (data);
 		data += 4;
-		XL_CHECK_CONDITION (len*2 + data - q->data <= (int)q->length);
+		XL_NEED_ITEMS (len, 2);
 		target_base = read_utf16_str (len, data);
 		data += len*2;
 		d (1, fprintf (stderr, "target_base = %s\n", target_base););
@@ -5068,7 +5088,7 @@
 	if (options & 0x8) {				/* 'text mark' */
 		len = GSF_LE_GET_GUINT32 (data);
 		data += 4;
-		XL_CHECK_CONDITION (len*2 + data - q->data <= (int)q->length);
+		XL_NEED_ITEMS (len, 2);
 		mark = read_utf16_str (len, data);
 		data += len*2;
 		d (1, fprintf (stderr, "mark = %s\n", mark););
@@ -5080,7 +5100,7 @@
 		data += sizeof (url_guid);
 		len = GSF_LE_GET_GUINT32 (data);
 		data += 4;
-		XL_CHECK_CONDITION (len + data - q->data <= (int)q->length);
+		XL_NEED_BYTES (len);
 
 		url = read_utf16_str (len/2, data);
 		if (NULL != url && 0 == g_ascii_strncasecmp (url,  "mailto:", 7))
@@ -5101,7 +5121,7 @@
 		d (1, fprintf (stderr,"# leading ../ %d len 0x%04x\n",
 				 up, len););
 		data += 6;
-		XL_CHECK_CONDITION (len + data - q->data <= (int)q->length);
+		XL_NEED_BYTES (len);
 		data += len + 16 + 12;
 		len = GSF_LE_GET_GUINT32 (data);
 		data += 6;
