Skip to content

This closes a panic on a worksheet with an empty merged cell reference - #2379

Merged
xuri merged 1 commit into
qax-os:masterfrom
arpitjain099:fix-empty-merge-cell-ref
Aug 20, 2026
Merged

This closes a panic on a worksheet with an empty merged cell reference#2379
xuri merged 1 commit into
qax-os:masterfrom
arpitjain099:fix-empty-merge-cell-ref

Conversation

@arpitjain099

Copy link
Copy Markdown
Contributor

Fix for the merged-cell panic reported privately.

mergeCellsParser only populates the cached rectangle when ref != "", so a <mergeCell ref=""/> leaves rect nil, and the cellInRange call immediately after is unconditional and indexes it at four positions.

This skips the entry when the rectangle is empty. checkCellInRangeRef handled the same shape cleanly through its len(rng) != 2 guard before a34c81e replaced it with the cached-rect path.

TestMergeCellsParser gains the empty-ref case alongside the existing nil-cell one. It panics without the change and passes with it. Full go test ./... is green, and gofmt and go vet are clean.

The caching branch in mergeCellsParser is guarded on ref != "", so a
mergeCell element with an empty ref never populates the cached rectangle
and leaves it nil. The cellInRange call on the next line is unguarded and
indexes that slice at four positions, so every non-streaming cell API
panics on the first read after the file opens.

Skip the entry when the rectangle is empty. checkCellInRangeRef used to
return cleanly for this shape through its len(rng) != 2 guard, which was
dropped in a34c81e when the cached-rect path replaced it.

The streaming Rows and GetRows paths are unaffected, and GetMergeCells
already errors cleanly through Rect().

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
@codecov

codecov Bot commented Aug 18, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.62%. Comparing base (46a5eb2) to head (7e1b00c).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #2379   +/-   ##
=======================================
  Coverage   99.62%   99.62%           
=======================================
  Files          32       32           
  Lines       27005    27007    +2     
=======================================
+ Hits        26905    26907    +2     
  Misses         52       52           
  Partials       48       48           
Flag Coverage Δ
unittests 99.62% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@xuri xuri added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Aug 20, 2026

@xuri xuri left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks for your contribution!

@xuri xuri added this to v2.11.1 Aug 20, 2026
@xuri xuri moved this to Security in v2.11.1 Aug 20, 2026
@xuri
xuri merged commit 99903a3 into qax-os:master Aug 20, 2026
21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

Status: Security

Development

Successfully merging this pull request may close these issues.

2 participants