解析xls的时候 格式保护之后 size过大 内存溢出

[yangjun2011022405]

No description provided.

[sergeilem]

Please attach sample file.

[yangjun2011022405]

对新建的xls表格进行如下操作后 https://jingyan.baidu.com/article/597035521917ee8fc00740d0.html
文件workbook.go中 235行
if phonetic_size > 0 {
var bts []byte
bts = make([]byte, phonetic_size)
err = binary.Read(buf, binary.LittleEndian, bts)
if err == io.EOF {
w.continue_apsb = phonetic_size
}
}
这个phonetic_size 值会非常大 make([]byte, phonetic_size) 会直接崩掉。

[sergeilem]

try this fork: https://github.com/sergeilem/xls

[fengweiqiang]

试试这个分支：https：//github.com/sergeilem/xls

您好，试了您的分支，还是出现了 内存溢出 @sergeilem
d1ee3514608b4fb49456e73d43245bc9.zip

[kingreatwill]

我也遇到类似的问题
oom.zip

[kingreatwill]

解决方案：https://github.com/shakinm/xlsReader

[pcjeff]

when xls files are encrypted, there will be a FilePass token (0x2f)
ref: https://stackoverflow.com/questions/25422599/parse-xls-file-with-protected-protected-workbook

we can stop parsing while reading in this token as a work around solution.

in workbook.go

 44 func (w *WorkBook) Parse(buf io.ReadSeeker) {
 45         b := new(bof)
 46         bof_pre := new(bof)
 47         // buf := bytes.NewReader(bts)
 48         offset := 0
 49         for {
 50                 if err := binary.Read(buf, binary.LittleEndian, b); err == nil {
 51                         // stop parsing if this file is encrypted
 52                         if b.Id == 0x2f { 
 53                                 break
 54                         }
 55                         bof_pre, b, offset = w.parseBof(buf, b, bof_pre, offset)
 56                 } else {
 57                         break
 58                 }
 59         }
 60 }

[rkfg]

@pcjeff thanks for this workaround! I can still open and see the .xls file contents in LibreOffice as well as edit it, but there's a padlock icon on the sheet tab. I'm not sure how exactly it "protects" the sheet. In my case this bug caused a huge allocation crashing my program with OOM in the end. I'd love to have support for encrypted/protected sheets but until then just skipping such files is acceptable.