more bounds checking

xls/cfb/cfb.go

@@ -289,6 +289,9 @@ func (d *Document) getStreamReader(sid uint32, size uint64) (io.ReadSeeker, erro
 	secSize := int64(1) << int32(d.header.SectorShift)
 	for sid != secEndOfChain && sid != secFree {
 		offs := int64(1+sid) << int64(d.header.SectorShift)
+		if offs > int64(len(d.data)) {
+			return nil, errors.New("ole2: corrupt data format")
+		}
 		slice := d.data[offs : offs+secSize]
 		if size < uint64(len(slice)) {
 			slice = slice[:size]

xls/xls.go

@@ -227,6 +227,9 @@ func (b *WorkBook) loadFromStream2(raw []byte, isDecrypted bool) error {
 			log.Printf("  Processing substream %d/%d (%d records)", ss, len(b.substreams), len(records))
 		}
 		for i, nr := range records {
+			if len(nr.Data) == 0 {
+				continue
+			}
 			//var bb io.Reader = bytes.NewReader(nr.Data)
 
 			switch nr.RecType {

xlsx/sheets.go

@@ -143,7 +143,11 @@ func (s *Sheet) parseSheet() error {
 				currentCell = ax[1] // always an A1 style reference
 				style := ax[2]
 				sid, _ := strconv.ParseInt(style, 10, 64)
-				numFormat = s.d.xfs[sid] // unsigned integer lookup
+				if len(s.d.xfs) > int(sid) {
+					numFormat = s.d.xfs[sid] // unsigned integer lookup
+				} else {
+					numFormat = s.d.xfs[0]
+				}
 				//log.Println("CELL", currentCell, sid, numFormat, currentCellType)
 			case "v":
 				//log.Println("CELL VALUE", ax)

xlsx/workbook.go

@@ -134,7 +134,10 @@ func (d *Document) parseStyles(dec *xml.Decoder) error {
 					// actual referencable cell styles
 					// 1) get base style so we can inherit format properly
 					baseID, _ := strconv.ParseInt(ax[2], 10, 64)
-					numFmtID := baseNumFormats[baseID]
+					numFmtID := "0"
+					if len(baseNumFormats) > int(baseID) {
+						numFmtID = baseNumFormats[baseID]
+					}
 
 					// 2) check if this XF overrides the base format
 					if ax[1] == "1" {