- Reported
-
- Issued
-
- Package
-
calamine
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#dos
#panic
#oom
#cfb
#ole2
#xls
#xlsb
- References
-
- CVSS Score
- 7.5
HIGH
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality Impact
- None
- Integrity Impact
- None
- Availability Impact
- High
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Patched
-
Description
The Compound File Binary (OLE2) parser (src/cfb.rs), used when reading .xls and .xlsb
workbooks and when extracting VBA projects from .xlsx, can panic or allocate without bound
on crafted input. Both are reachable through the public reader API (open_workbook,
Xls::new, Xlsb::new) on an attacker-supplied file. Impact is denial of service only — no
memory unsafety (safe Rust turns the out-of-bounds read into a bounds-checked panic).
-
Reachable panic (out-of-bounds slice index). The directory stream is iterated with
.chunks(128), but Directory::from_slice reads fixed offsets (buf[..64],
buf[116..120], buf[120..128]) without checking the chunk length. A directory stream
whose length is not a multiple of 128 yields a short final chunk, causing a panic
(range end index 64 out of range for slice of length N). SectorSize::Small 64-byte
mini sectors are a second trigger.
-
Unbounded allocation / OOM. The DIFAT loader grows the difat vector without bounding
the number of iterations; a crafted self-referential DIFAT chain drives a multi-gigabyte
allocation from a tiny file (a 512-byte file attempts an allocation of several gigabytes).
A consumer that parses untrusted or user-supplied spreadsheets can be crashed (thread panic,
or process abort under panic=abort) or driven out of memory by a small crafted file.
Fixed in calamine 0.38.0 (commit b8ec4f0); the maintainer confirmed the fix in https://github.com/tafia/calamine/pull/762.
Advisory available under CC0-1.0
license.