diff -up gnumeric-1.8.1/plugins/excel/ms-excel-read.c~ gnumeric-1.8.1/plugins/excel/ms-excel-read.c
--- gnumeric-1.8.1/plugins/excel/ms-excel-read.c~	2008-02-02 17:20:05.000000000 +0100
+++ gnumeric-1.8.1/plugins/excel/ms-excel-read.c	2008-02-02 17:20:05.000000000 +0100
@@ -5152,10 +5152,11 @@ excel_read_HLINK (BiffQuery *q, ExcelRea
 		d (1, fprintf (stderr,"# leading ../ %d len 0x%04x\n",
 				 up, len););
 		data += 6;
-		XL_NEED_BYTES (len);
+		XL_NEED_BYTES (len + 16 + 12 + 4);
 		data += len + 16 + 12;
 		len = GSF_LE_GET_GUINT32 (data);
 		data += 6;
+		XL_NEED_BYTES (len);
 
 		path = read_utf16_str (len/2, data);
 		accum = g_string_new (NULL);
@@ -5172,6 +5173,10 @@ excel_read_HLINK (BiffQuery *q, ExcelRea
 		guchar  *path;
 
 		len = GSF_LE_GET_GUINT32 (data);
+		/* FIXME I seriously wonder of len * 2 in the read_utf16_str()
+		   call and thus also here is correct! */
+		XL_NEED_ITEMS (len * 2, 2);
+
 		path = read_utf16_str (len*2, data+4);
 		link = g_object_new (gnm_hlink_external_get_type (), NULL);
 		gnm_hlink_set_target (link, path);
