[1337-L3V1ATH0N]

Affected crate(s)

• calamine (~6.1M recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

• cfb: fix panic and unbounded allocation (OOM) on malformed compound files tafia/calamine#762 — fix PR (bounds the DIFAT loop; skips short directory chunks) with regression tests for both issues.

Severity

Two denial-of-service issues in the CFB/OLE2 parser (src/cfb.rs), reachable via the public reader API (open_workbook / Xls::new / Xlsb::new; also VBA extraction in .xlsx) on crafted input; present in the current release (0.37.0):

1. Out-of-bounds slice-index panic in Directory::from_slice — the directory stream is parsed in .chunks(128) and fixed offsets (buf[..64], buf[116..120], buf[120..128]) are read without checking the chunk is 128 bytes, so a stream length that isn't a multiple of 128 panics (range end index 64 out of range for slice of length N).
2. Unbounded memory allocation (OOM) in the DIFAT loader — a crafted self-referential DIFAT chain grows difat without bound; a ~512-byte file can drive a multi-gigabyte allocation.

Allows remote denial of service (thread panic / process abort, or out-of-memory) for any consumer that parses untrusted spreadsheet files. Safe Rust — no memory unsafety, not RCE.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate — reported upstream via PR sshkeys: lack of cert verification vuln #762 (open, not yet merged/acknowledged). Happy to hold publication until the maintainer confirms; please advise if you'd prefer to wait for upstream sign-off.

[djc]

Please use the pull request template.

[1337-L3V1ATH0N]

Thanks for the review — I've updated the description to follow the PR template (affected crate, upstream link, severity, checklist).

On the last checklist item: the issues are reported upstream in tafia/calamine#762 (open, with a fix + regression tests) but not yet acknowledged or merged by the maintainer. I'm happy to hold publication until they confirm, or proceed per your preference — just let me know.