High, CVSS 7.5crates.ioPublished
Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed input
- Affected
- crates.io calamine >= 0.0.0-0, < 0.38.0
- Fixed in
- 0.38.0· Vendor fix available
- Issue
- The Compound File Binary (OLE2) parser (`src/cfb.rs`), used when reading `.xls` and `.xlsb` workbooks and when extracting VBA projects from `.xlsx`, can panic or allocate without bound on crafted input. Both are reachable through the public reader API (`open_workbook`, `Xls::new`, `Xlsb::new`) on an attacker-supplied file. Impact is denial of service only — no memory unsafety (safe Rust turns the out-of-bounds read into a bounds-checked panic). 1. Reachable panic (out-of-bounds slice index). The directory stream is iterated with `.chunks(128)`, but `Directory::from_slice` reads fixed offsets (`buf[..64]`, `buf[116..120]`, `buf[120..128]`) without checking the chunk length. A directory stream whose length is not a multiple of 128 yields a short final chunk, causing a panic (`range end index 64 out of range for slice of length N`). `SectorSize::Small` 64-byte mini sectors are a second trigger. 2. Unbounded allocation / OOM. The DIFAT loader grows the `difat` vector without…
Recommended action: Upgrade to 0.38.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.