Version: r16680
OS: Ubuntu Hardy

The upcoming sample is a fuzzed version of chart-tests-excel.xls.

Steps to reproduce:
- Load the upcoming attachment in Gnumeric to trigger a crash


Valgrind output:

==20443== Invalid read of size 4
==20443==    at 0x7E3F30A: xl_chart_import_error_bar (ms-chart.c:3234)
==20443==    by 0x7E406C6: ms_excel_chart_read (ms-chart.c:3609)
==20443==    by 0x7E40C49: ms_excel_chart_read_BOF (ms-chart.c:3726)
==20443==    by 0x7E35977: ms_read_OBJ (ms-obj.c:1276)
==20443==    by 0x7E04BAE: ms_escher_read_ClientData (ms-escher.c:1993)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)
==20443==    by 0x7E02D27: ms_escher_read_SpContainer (ms-escher.c:507)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)
==20443==    by 0x7E047D4: ms_escher_read_SpgrContainer (ms-escher.c:1933)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)
==20443==    by 0x7E047FE: ms_escher_read_DgContainer (ms-escher.c:1938)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)
==20443==  Address 0x57d2e10 is 0 bytes after a block of size 64 alloc'd
==20443==    at 0x4022AB8: malloc (vg_replace_malloc.c:207)
==20443==    by 0x4022BFC: realloc (vg_replace_malloc.c:429)
==20443==    by 0x4CCC904: g_realloc (gmem.c:170)
==20443==    by 0x4C9EAE7: g_ptr_array_maybe_expand (garray.c:414)
==20443==    by 0x4C9EB49: g_ptr_array_add (garray.c:576)
==20443==    by 0x7E3B056: xl_chart_read_series (ms-chart.c:1939)
==20443==    by 0x7E401E7: ms_excel_chart_read (ms-chart.c:3507)
==20443==    by 0x7E40C49: ms_excel_chart_read_BOF (ms-chart.c:3726)
==20443==    by 0x7E35977: ms_read_OBJ (ms-obj.c:1276)
==20443==    by 0x7E04BAE: ms_escher_read_ClientData (ms-escher.c:1993)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)
==20443==    by 0x7E02D27: ms_escher_read_SpContainer (ms-escher.c:507)
==20443== 
==20443== Invalid read of size 4
==20443==    at 0x7E3F33D: xl_chart_import_error_bar (ms-chart.c:3242)
==20443==    by 0x7E406C6: ms_excel_chart_read (ms-chart.c:3609)
==20443==    by 0x7E40C49: ms_excel_chart_read_BOF (ms-chart.c:3726)
==20443==    by 0x7E35977: ms_read_OBJ (ms-obj.c:1276)
==20443==    by 0x7E04BAE: ms_escher_read_ClientData (ms-escher.c:1993)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)
==20443==    by 0x7E02D27: ms_escher_read_SpContainer (ms-escher.c:507)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)
==20443==    by 0x7E047D4: ms_escher_read_SpgrContainer (ms-escher.c:1933)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)
==20443==    by 0x7E047FE: ms_escher_read_DgContainer (ms-escher.c:1938)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)
==20443==  Address 0x40 is not stack'd, malloc'd or (recently) free'd
==20443== 
==20443== Process terminating with default action of signal 11 (SIGSEGV)
==20443==  Access not within mapped region at address 0x40
==20443==    at 0x7E3F33D: xl_chart_import_error_bar (ms-chart.c:3242)
==20443==    by 0x7E406C6: ms_excel_chart_read (ms-chart.c:3609)
==20443==    by 0x7E40C49: ms_excel_chart_read_BOF (ms-chart.c:3726)
==20443==    by 0x7E35977: ms_read_OBJ (ms-obj.c:1276)
==20443==    by 0x7E04BAE: ms_escher_read_ClientData (ms-escher.c:1993)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)
==20443==    by 0x7E02D27: ms_escher_read_SpContainer (ms-escher.c:507)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)
==20443==    by 0x7E047D4: ms_escher_read_SpgrContainer (ms-escher.c:1933)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)
==20443==    by 0x7E047FE: ms_escher_read_DgContainer (ms-escher.c:1938)
==20443==    by 0x7E0516D: ms_escher_read_container (ms-escher.c:2099)


Backtrace:

Program received signal SIGSEGV, Segmentation fault.

+ Trace 201644