Out-of-bounds read on a fuzzed gnumeric2xls conversion.

Git versions of glib, goffice, gnumeric, libgsf and libxml2.

Test case: http://jutaky.com/fuzzing/gnumeric_case_15327_142541.2xls.gnumeric

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff3b6f444 in g_utf8_pointer_to_offset (
    str=0x7fcc20 "To view the combobox:\n--Choose View>Toolbars\n--Select the Control Toolbox\n--Click the Design Mode button\n\nIn Design mode, to change the combobox settings,\n--Select the combobox\n--Click the Properties "..., pos=0x8040a681 <Address 0x8040a681 out of bounds>) at gutf8.c:402
402		s = g_utf8_next_char (s);
(gdb) bt

+ Trace 232484

==12390== Invalid read of size 1
==12390==    at 0x8E67444: g_utf8_pointer_to_offset (gutf8.c:402)
==12390==    by 0x187317F0: excel_write_ClientTextbox (ms-excel-write.c:4259)
==12390==    by 0x18732C64: excel_write_other_v8 (ms-excel-write.c:4572)
==12390==    by 0x18733AD2: excel_write_obj_v8 (ms-excel-write.c:4756)
==12390==    by 0x1873574C: excel_write_objs_v8 (ms-excel-write.c:5333)
==12390==    by 0x18735CB8: excel_write_sheet (ms-excel-write.c:5421)
==12390==    by 0x18738FFD: excel_write_workbook (ms-excel-write.c:6265)
==12390==    by 0x187392F6: excel_write_v8 (ms-excel-write.c:6318)
==12390==    by 0x1870607C: excel_save (boot.c:281)
==12390==    by 0x18706273: excel_biff8_file_save (boot.c:322)
==12390==    by 0x5455DF4: go_plugin_loader_module_func_file_save (go-plugin-loader-module.c:366)
==12390==    by 0x54582B3: go_plugin_file_saver_save (go-plugin-service.c:948)
==12390==  Address 0x184504ad is 0 bytes after a block of size 253 alloc'd

--
Juha Kylmänen
Research Assistant, OUSPG