===================================================================
RCS file: /cvs/gnome/libgsf/gsf/gsf-infile-msole.c,v
retrieving revision 1.73
retrieving revision 1.74
diff -u -r1.73 -r1.74
--- libgsf.orig/gsf/gsf-infile-msole.c	2006/09/06 20:39:46	1.73
+++ libgsf/gsf/gsf-infile-msole.c	2006/09/24 01:55:24	1.74
@@ -595,6 +595,13 @@
 			last = num_bat;
 		} else if (num_metabat > 0) {
 			metabat_block = metabat[last];
+			if (num_bat < last) {
+				/* ::num_bat and ::num_metabat are
+				 * inconsistent.  There are too many metabats
+				 * for the bat count in the header. */
+				ptr = NULL;
+				break;
+			}
 			num_bat -= last;
 		}