Out-of-bounds read on a fuzzed .pln file.

Git versions of glib, goffice, gnumeric, libgsf and libxml2.

Test case: http://jutaky.com/fuzzing/gnumeric_case_6844_1122.pln

==4562== Invalid read of size 1
==4562==    at 0x1872ECB1: pln_convert_expr (pln.c:326)
==4562==    by 0x1872FA3B: pln_parse_sheet (pln.c:625)
==4562==    by 0x1872FC17: pln_file_open (pln.c:675)
==4562==    by 0x5451959: go_plugin_loader_module_func_file_open (go-plugin-loader-module.c:282)
==4562==    by 0x5453860: go_plugin_file_opener_open (go-plugin-service.c:685)
==4562==    by 0x54564E1: go_file_opener_open (file.c:417)
==4562==    by 0x4FF1EC2: workbook_view_new_from_input (workbook-view.c:1277)
==4562==    by 0x4FF208C: workbook_view_new_from_uri (workbook-view.c:1337)
==4562==    by 0x4048BB: convert (ssconvert.c:696)
==4562==    by 0x404F87: main (ssconvert.c:860)
==4562==  Address 0x41d8000 is not stack'd, malloc'd or (recently) free'd

--
Juha Kylmänen
Research Assistant, OUSPG

ps. thanks for the credit again!