Heap-buffer overread in find_matching_close on a fuzzed .gnumeric file.

Git versions of glib, goffice, gnumeric, libgsf and libxml2.

Test case: http://jutaky.com/fuzzing/gnumeric_case_2303_19763.gnumeric

==23345== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x606600017431 at pc 0x7fd3effd1da8 bp 0x7fff24246c10 sp 0x7fff24246c08
READ of size 1 at 0x606600017431 thread T0
    #0 0x7fd3effd1da7 in find_matching_close /gnumeric/src/parser.y:908
    #1 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #2 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #3 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #4 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #5 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #6 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #7 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #8 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #9 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #10 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #11 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #12 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #13 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #14 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #15 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #16 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #17 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #18 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #19 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #20 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #21 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #22 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #23 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #24 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #25 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #26 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #27 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #28 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #29 0x7fd3effd189e in find_matching_close /gnumeric/src/parser.y:911
    #30 0x7fd3effdb1d0 in gnm_expr_parse_str /gnumeric/src/parser.y:1619
    #31 0x7fd3f03024a3 in handle_delayed_names /gnumeric/src/xml-sax-read.c:2910
    #32 0x7fd3f0305c38 in read_file_common /gnumeric/src/xml-sax-read.c:3362
    #33 0x7fd3f03076a4 in gnm_xml_file_open /gnumeric/src/xml-sax-read.c:3490
    #34 0x7fd3ef0edb30 in go_file_opener_open_real /goffice/goffice/app/file.c:159
    #35 0x7fd3ef0f07cf in go_file_opener_open /goffice/goffice/app/file.c:417
    #36 0x7fd3f0253bc0 in workbook_view_new_from_input /gnumeric/src/workbook-view.c:1281
    #37 0x7fd3f02543af in workbook_view_new_from_uri /gnumeric/src/workbook-view.c:1341
    #38 0x40a6e0 in main /gnumeric/src/main-application.c:322
    #39 0x7fd3ea9d3bc4 in __libc_start_main ??:?
    #40 0x403de8 in _start ??:?
0x606600017431 is located 0 bytes to the right of 4913-byte region [0x606600016100,0x606600017431)

--
Juha Kylmänen
Research Assistant, OUSPG