diff --git a/docx.go b/docx.go index 9e96107..185e52d 100644 --- a/docx.go +++ b/docx.go @@ -119,7 +119,7 @@ func getContentTypeDefinition(zf *zip.File) (*contentTypeDefinition, error) { defer f.Close() x := &contentTypeDefinition{} - if err := xml.NewDecoder(f).Decode(x); err != nil { + if err := xml.NewDecoder(io.LimitReader(f, maxBytes)).Decode(x); err != nil { return nil, err } return x, nil diff --git a/docx_test/docx_test.go b/docx_test/docx_test.go index c95a7a7..3b1aa50 100644 --- a/docx_test/docx_test.go +++ b/docx_test/docx_test.go @@ -1,6 +1,7 @@ package docx_test import ( + "encoding/xml" "os" "strings" "testing" @@ -50,3 +51,18 @@ func TestConvertDocxWithUncommonValidStructure(t *testing.T) { t.Errorf("expected %v to contains %v", resp, want) } } + + +func TestConvertDocxDecompressionSizeLimit(t *testing.T) { + f, err := os.Open("./testdata/decompression_size_limit.docx") + if err != nil { + t.Fatalf("got error = %v, want nil", err) + } + _, _, err = docconv.ConvertDocx(f) + if _, ok := err.(*xml.SyntaxError); !ok { + t.Errorf("got error = %T, want *xml.SyntaxError", err) + } + if want := "EOF"; !strings.Contains(err.Error(), want) { + t.Errorf("got error = %v, want %v", err, want) + } +} diff --git a/docx_test/testdata/decompression_size_limit.docx b/docx_test/testdata/decompression_size_limit.docx new file mode 100755 index 0000000..4ea761f Binary files /dev/null and b/docx_test/testdata/decompression_size_limit.docx differ diff --git a/pptx_test/pptx_test.go b/pptx_test/pptx_test.go index 39eea25..696fe5f 100644 --- a/pptx_test/pptx_test.go +++ b/pptx_test/pptx_test.go @@ -1,6 +1,7 @@ package docx_test import ( + "encoding/xml" "os" "strings" "testing" @@ -30,3 +31,17 @@ func TestConvertPptx(t *testing.T) { t.Errorf("expected %v to contain %v", resp, want) } } + +func TestConvertPptxDecompressionSizeLimit(t *testing.T) { + f, err := os.Open("./testdata/decompression_size_limit.pptx") + if err != nil { + t.Fatalf("got error = %v, want nil", err) + } + _, _, err = docconv.ConvertPptx(f) + if _, ok := err.(*xml.SyntaxError); !ok { + t.Errorf("got error = %T, want *xml.SyntaxError", err) + } + if want := "EOF"; !strings.Contains(err.Error(), want) { + t.Errorf("got error = %v, want %v", err, want) + } +} diff --git a/pptx_test/testdata/decompression_size_limit.pptx b/pptx_test/testdata/decompression_size_limit.pptx new file mode 100755 index 0000000..4ea761f Binary files /dev/null and b/pptx_test/testdata/decompression_size_limit.pptx differ