Bound flatCols to MaxColumns when flattening worksheet columns

col.go

@@ -545,8 +545,24 @@ func (ws *xlsxWorksheet) setColWidth(minVal, maxVal int, width float64) {
 // flatCols provides a method for the column's operation functions to flatten
 // and check the worksheet columns.
 func flatCols(col xlsxCol, cols []xlsxCol, replacer func(fc, c xlsxCol) xlsxCol) []xlsxCol {
+	// The min and max attributes of a col element are read straight from the
+	// worksheet XML and are not otherwise bounded. A worksheet cannot hold more
+	// than MaxColumns columns, so flattening past that is meaningless, while a
+	// crafted file declaring max="2147483647" would otherwise have this function
+	// allocate one xlsxCol per declared column.
+	clamp := func(c xlsxCol) (int, int) {
+		minVal, maxVal := c.Min, c.Max
+		if minVal < MinColumns {
+			minVal = MinColumns
+		}
+		if maxVal > MaxColumns {
+			maxVal = MaxColumns
+		}
+		return minVal, maxVal
+	}
 	var fc []xlsxCol
-	for i := col.Min; i <= col.Max; i++ {
+	colMin, colMax := clamp(col)
+	for i := colMin; i <= colMax; i++ {
 		var c xlsxCol
 		_ = deepcopy.Copy(&c, col)
 		c.Min, c.Max = i, i
@@ -561,7 +577,8 @@ func flatCols(col xlsxCol, cols []xlsxCol, replacer func(fc, c xlsxCol) xlsxCol)
 		return -1, false
 	}
 	for _, column := range cols {
-		for i := column.Min; i <= column.Max; i++ {
+		columnMin, columnMax := clamp(column)
+		for i := columnMin; i <= columnMax; i++ {
 			if idx, ok := inFlat(i, fc); ok {
 				fc[idx] = replacer(fc[idx], column)
 				continue

col_test.go

@@ -585,3 +585,23 @@ func TestAutoFitColWidth(t *testing.T) {
 	_, err = f.autoFitColWidth("Sheet1", 1, 1, &Font{})
 	assert.Equal(t, err, newInvalidStyleID(1))
 }
+
+func TestFlatColsBounded(t *testing.T) {
+	// A col element's min and max come from the worksheet XML unvalidated. A
+	// crafted file can declare a range far beyond the MaxColumns a worksheet can
+	// actually hold, which previously made flatCols allocate one entry per
+	// declared column.
+	f := NewFile()
+	ws, err := f.workSheetReader("Sheet1")
+	assert.NoError(t, err)
+	ws.Cols = &xlsxCols{Col: []xlsxCol{{Min: 1, Max: 2147483647, Width: float64Ptr(9)}}}
+
+	assert.NoError(t, f.SetColWidth("Sheet1", "A", "A", 12))
+	assert.LessOrEqual(t, len(ws.Cols.Col), MaxColumns)
+
+	// The columns a worksheet can genuinely hold are still flattened.
+	width, err := f.GetColWidth("Sheet1", "A")
+	assert.NoError(t, err)
+	assert.Equal(t, 12.0, width)
+	assert.NoError(t, f.Close())
+}