[GH-ISSUE #442] Bug: workbook_validate_sheet_name buffer-overflow #348

New issue

Closed

opened 2026-05-05 12:11:10 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 12:11:10 -06:00

Owner

Originally created by @ym-xie on GitHub (May 8, 2024).
Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/442

Originally assigned to: @jmcnamara on GitHub.

hello, maybe there exist a bug in workbook_validate_sheet_name.
When sheetname is an empty string (""), the workbook_validate_sheet_name function does not check if the string length is 0, leading to a buffer overflow.The following is the relevant code, the crash occurs at workbook.c:workbook_validate_sheet_name.

#include "xlsxwriter.h"

int main() {

    lxw_workbook  *workbook  = workbook_new("demo.xlsx");
    lxw_worksheet *worksheet = workbook_add_worksheet(workbook, NULL);
    const char* name = "";
    lxw_error le = workbook_validate_sheet_name(workbook, name);
    if (le == LXW_NO_ERROR) {
      lxw_worksheet *worksheet = workbook_add_worksheet(workbook, name);
    }

    return 0;
}

Originally created by @ym-xie on GitHub (May 8, 2024). Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/442 Originally assigned to: @jmcnamara on GitHub. hello, maybe there exist a bug in workbook_validate_sheet_name. When `sheetname` is an empty string (`""`), the `workbook_validate_sheet_name` function does not check if the string length is 0, leading to a buffer overflow.The following is the relevant code, the crash occurs at workbook.c:workbook_validate_sheet_name. ```c #include "xlsxwriter.h" int main() { lxw_workbook *workbook = workbook_new("demo.xlsx"); lxw_worksheet *worksheet = workbook_add_worksheet(workbook, NULL); const char* name = ""; lxw_error le = workbook_validate_sheet_name(workbook, name); if (le == LXW_NO_ERROR) { lxw_worksheet *worksheet = workbook_add_worksheet(workbook, name); } return 0; } ```

gitea-mirror

2026-05-05 12:11:10 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 12:11:14 -06:00

Author

Owner

@jmcnamara commented on GitHub (May 8, 2024):

Thanks for the report. That is omission/bug. I'll add a fix.

@jmcnamara commented on GitHub (May 8, 2024): Thanks for the report. That is omission/bug. I'll add a fix.

gitea-mirror commented

2026-05-05 12:11:15 -06:00

Author

Owner

@jmcnamara commented on GitHub (May 8, 2024):

I've pushed a fix for this to main. There is now a new error code called LXW_ERROR_SHEETNAME_IS_BLANK for this condition.

@jmcnamara commented on GitHub (May 8, 2024): I've pushed a fix for this to main. There is now a new error code called `LXW_ERROR_SHEETNAME_IS_BLANK` for this condition.

gitea-mirror commented

2026-05-05 12:11:17 -06:00

Author

Owner

@ym-xie commented on GitHub (May 9, 2024):

Should verify in advance that name is NULL?

@ym-xie commented on GitHub (May 9, 2024): Should verify in advance that `name` is NULL?

gitea-mirror commented

2026-05-05 12:11:19 -06:00

Author

Owner

@jmcnamara commented on GitHub (May 9, 2024):

Should verify in advance that name is NULL?

My initial thought was that the end user should check for NULL and that workbook_validate_sheet_name() should validate the name and not the string. However, most libxlsxwriter functions check for NULL so I've added a LXW_ERROR_NULL_PARAMETER_IGNORED error as well.

I've force pushed that change to main.

@jmcnamara commented on GitHub (May 9, 2024): > Should verify in advance that `name` is NULL? My initial thought was that the end user should check for NULL and that `workbook_validate_sheet_name()` should validate the name and not the string. However, most libxlsxwriter functions check for `NULL` so I've added a `LXW_ERROR_NULL_PARAMETER_IGNORED` error as well. I've force pushed that change to main.

gitea-mirror referenced this issue

2026-05-05 12:16:40 -06:00

[PR #348] [MERGED] Don't use LDLFAGS when building these .so files #468