Null pointer crash in gog_moving_avg_update on a fuzzed gnumeric file.

Git versions of glib, goffice, gnumeric, libgsf and libxml2.

Test case: http://jutaky.com/fuzzing/gnumeric_case_13192_2829.gnumeric

Program received signal SIGSEGV, Segmentation fault.
0x00007fffe54d2b55 in gog_moving_avg_update (obj=0x8b76c0) at gog-moving-avg.c:143
143			if (!go_finite (x_vals[i]) || !go_finite (y_vals[i])) {
(gdb) bt

+ Trace 232522

==16597== Invalid read of size 8
==16597==    at 0x26BD8B55: gog_moving_avg_update (gog-moving-avg.c:143)
==16597==    by 0x587FD38: gog_object_update (gog-object.c:1596)
==16597==    by 0x587FC22: gog_object_update (gog-object.c:1589)
==16597==    by 0x587FC22: gog_object_update (gog-object.c:1589)
==16597==    by 0x587FC22: gog_object_update (gog-object.c:1589)
==16597==    by 0x587FC22: gog_object_update (gog-object.c:1589)
==16597==    by 0x5890253: cb_graph_idle (gog-graph.c:848)
==16597==    by 0x93875BE: g_idle_dispatch (gmain.c:5250)
==16597==    by 0x9384DC2: g_main_dispatch (gmain.c:3065)
==16597==    by 0x9385B19: g_main_context_dispatch (gmain.c:3641)
==16597==    by 0x9385D0B: g_main_context_iterate (gmain.c:3712)
==16597==    by 0x9385DCF: g_main_context_iteration (gmain.c:3773)
==16597==  Address 0x0 is not stack'd, malloc'd or (recently) free'd

--
Juha Kylmänen
Research Assistant, OUSPG