Commit 39e872089342bd14935ebd173466bd7c533f7b98 changed Vtiful\Kernel\Excel::__construct() to reject an empty $config['path'].
Previously, an empty string was accepted by the constructor. The change was introduced to prevent an out-of-bounds read in xls_file_path():
if (Z_STRVAL_P(dir_path)[Z_STRLEN_P(dir_path) - 1] == '/') {When the path is empty, subtracting one from the unsigned string length underflows and may read outside the string buffer.
However, xls_file_path() now has a direct length guard:
if (Z_STRLEN_P(dir_path) > 0 &&
Z_STRVAL_P(dir_path)[Z_STRLEN_P(dir_path) - 1] == '/') {Therefore, rejecting the empty string in the constructor is no longer necessary for memory safety and introduces a backward-compatibility break.
Would it be possible to restore compatibility with an empty path? Alternatively, could the empty path be deprecated in the current version and rejected in the next major version?
I have prepared two branches demonstrating both approaches: Compatible, Deprecated
Commit
39e872089342bd14935ebd173466bd7c533f7b98changedVtiful\Kernel\Excel::__construct()to reject an empty$config['path'].Previously, an empty string was accepted by the constructor. The change was introduced to prevent an out-of-bounds read in
xls_file_path():When the path is empty, subtracting one from the unsigned string length underflows and may read outside the string buffer.
However,
xls_file_path()now has a direct length guard:Therefore, rejecting the empty string in the constructor is no longer necessary for memory safety and introduces a backward-compatibility break.
Would it be possible to restore compatibility with an empty path? Alternatively, could the empty path be deprecated in the current version and rejected in the next major version?
I have prepared two branches demonstrating both approaches: Compatible, Deprecated