Skip to content

Commit 4ac50cd

Browse files
pppanghu77deepin-bot[bot]
authored andcommitted
fix(excel): fix segfault on xlsx with main content type declared via <Default>
- Wrap the <Default> branch in iterate_files_by_contenttype_expat_callback_element_start (xlsxio_read.c) with #ifndef USE_MINIZIP so the minizip backend skips the zip directory traversal at compile time; previously the traversal ran inside an expat callback while [Content_Types].xml was open for streaming read, reentering the minizip single-state handle and crashing in unzGetCurrentFileInfo (upstream issue #28, unfixed in xlsxio 0.2.36) - Add regression sample tests/file/test_xlsxio_default_crash.xlsx whose [Content_Types].xml declares the main content type via <Default> to cover the former crash path 修复(excel): 修复 main contenttype 经 <Default> 声明的 xlsx 解析段错误 - 在 iterate_files_by_contenttype_expat_callback_element_start 的 <Default> 分支用 #ifndef USE_MINIZIP 包裹,使 minizip 后端编译期跳过 zip 目录遍历;原实现该遍历在 expat 回调内执行,而此时 [Content_Types].xml 已打开流式读取,对同一 unzFile 重入导致 minizip 单状态机冲突,在 unzGetCurrentFileInfo 处段错误(上游 issue #28,xlsxio 0.2.36 未修复) - 新增回归样本 tests/file/test_xlsxio_default_crash.xlsx,其 [Content_Types].xml 将 main contenttype 经 <Default> 声明,覆盖原崩溃路径 Log: 修复 xlsxio 在 minizip 后端下解析 [Content_Types].xml 中经 <Default> 声明的 main contenttype 时,因目录遍历重入已打开文件的流式读取状态而在 unzGetCurrentFileInfo 处段错误的问题,并补充回归样本 Task: https://pms.uniontech.com/task-view-391297.html brechtsanders/xlsxio#28
1 parent 9da2bf5 commit 4ac50cd

2 files changed

Lines changed: 8 additions & 0 deletions

File tree

3rdparty/libs/fileext/excel/xlsxio/xlsxio_read.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -684,6 +684,13 @@ void iterate_files_by_contenttype_expat_callback_element_start (void* callbackda
684684
}
685685
} else if (XML_Char_icmp_ins(name, X("Default")) == 0) {
686686
//by extension
687+
// minizip 后端下:外层 expat_process_zip_file 已 unzOpenCurrentFile 打开
688+
// [Content_Types].xml 并流式读取,此处对同一 unzFile 调用 unzGoToFirstFile /
689+
// unzGetCurrentFileInfo / unzGoToNextFile 会破坏 minizip 单状态机导致段错误
690+
// (上游 issue #28,xlsxio 0.2.36 仍未修复)。合法 xlsx 的 main contenttype 必
691+
// 通过 <Override> 声明,<Default> 扩展名匹配对 xlsxio 无意义,故 minizip 后端
692+
// 直接跳过本分支;libzip 后端基于索引的 zip_get_name 不受影响,逻辑保留。
693+
#ifndef USE_MINIZIP
687694
const XML_Char* contenttype;
688695
const XML_Char* extension;
689696
if ((contenttype = get_expat_attr_by_name(atts, X("ContentType"))) != NULL && XML_Char_icmp(contenttype, data->contenttype) == 0) {
@@ -731,6 +738,7 @@ unzGetGlobalInfo(data->zip, &zipglobalinfo);
731738
#endif
732739
}
733740
}
741+
#endif /* !USE_MINIZIP: 跳过 <Default> 分支,避免 minizip 状态冲突崩溃 */
734742
}
735743
}
736744

602 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)