Please describe the problem:
The current SVN version of plugins/excel/ms-formula-read.c, in excel_parse_formula1(), contains two bounds checks preceeding a read from an excel file:

                case FORMULA_PTG_EXPR: {
                        GnmExpr const *expr;
                        XLSharedFormula *sf;
                        GnmCellPos top_left;

                        if (ver >= MS_BIFF_V3) {
                                CHECK_FORMULA_LEN(3);
                                top_left.col = GSF_LE_GET_GUINT16 (cur+2);
                        } else {
                                CHECK_FORMULA_LEN(4);
                                top_left.col = GSF_LE_GET_GUINT8 (cur+2);
                        }
                        top_left.row = GSF_LE_GET_GUINT16 (cur+0);
                        sf = excel_sheet_shared_formula (esheet, &top_left);

... it looks to me as if the values passed to the CHECK_FORMULA_LEN() are reversed; the first case intends to read 2 bytes from offset 2, the second one byte.

Steps to reproduce:
1. check out code
2. open editor
3. read


Actual results:


Expected results:


Does this happen every time?


Other information: