Fix panic on a row whose cells are not in ascending column order - #2376
Merged
xuri merged 4 commits intoAug 16, 2026
Conversation
checkRow takes lastCol from the last element of the row, then scatters every
cell into the rebuilt slice by that cell's own column reference. Cells are not
guaranteed to be stored in ascending column order, so when an earlier cell
names a higher column than the final element, the write lands past the end.
A row of Z1 followed by C1 gives a length of 3 and a write to index 25:
panic: runtime error: index out of range [25] with length 3
Take the maximum column across the row instead of reading the last element.
Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2376 +/- ##
=======================================
Coverage 99.62% 99.62%
=======================================
Files 32 32
Lines 27004 27005 +1
=======================================
+ Hits 26902 26905 +3
+ Misses 53 52 -1
+ Partials 49 48 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
xuri
added
the
size/M
xuri
requested changes
Aug 15, 2026
xuri
left a comment
xuri
left a comment
Member
There was a problem hiding this comment.
Thanks for your pull request. I've left some comments.
Addresses review feedback. Folds the maximum-column search into the loop that already walks the row's cells to fill in missing r attributes, instead of adding a second pass. That removes the extra CellNameToCoordinates call per cell, so the only added work is two integer comparisons. It also drops the CellNameToCoordinates on the last element, whose error branch was never reachable: the loop above already returns for any cell whose r attribute fails to parse, and the r values it generates are always valid. A full-suite coverage profile on master shows that branch at 0. Test now stores raw sheet XML through f.Pkg rather than a deserialized xlsxWorksheet, matching how the other sheet-parsing tests set up input. Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
xuri
approved these changes
Aug 16, 2026
xuri
left a comment
xuri
left a comment
Member
There was a problem hiding this comment.
Thanks for your contribution. I've made some changes based on your branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the panic reported in GHSA-8mcq-6wmr-jrjv.
checkRowreadslastColfrom the last element of the row and sizes the rebuilt slice from it, then scatters every cell into that slice by the cell's own column reference. Cells are not guaranteed to be stored in ascending column order, so when an earlier cell names a higher column than the final element, the write goes past the end.A row holding
Z1followed byC1hascolCount2 andlastCol3, so the branch is entered, three placeholders are created, andZ1is then written to index 25:This is reachable from the ordinary read APIs, since
checkRowruns on worksheet load, so opening a crafted file and callingGetCellValueis enough.The change takes the maximum column across the row rather than reading the last element. The existing loop above already tracks a running maximum for filling in missing
rattributes, but that value is not used here.Added
TestCheckRowOutOfOrderColumnstorows_test.go. It covers the directcheckRowcall and a read throughGetCellValue. It panics with the message above on the current code and passes with the change.go test ./...is green.