From ee1075dc098f6512f34374b72a438c6a1ca534d2 Mon Sep 17 00:00:00 2001
From: MarkBaker <mark@demon-angel.eu>
Date: Tue, 4 Apr 2023 00:03:16 +0200
Subject: [PATCH] Validate that OLE file contains a workbook object (ie. isn't
 a doc or a ppt file)

---
 src/PhpSpreadsheet/Reader/Xls.php           |   7 +++--
 src/PhpSpreadsheet/Shared/OLERead.php       |   2 +-
 tests/PhpSpreadsheetTests/IOFactoryTest.php |  27 ++++++++++++++++++++
 tests/data/Reader/NotASpreadsheetFile.doc   | Bin 0 -> 28160 bytes
 4 files changed, 33 insertions(+), 3 deletions(-)
 create mode 100644 tests/data/Reader/NotASpreadsheetFile.doc

diff --git a/src/PhpSpreadsheet/Reader/Xls.php b/src/PhpSpreadsheet/Reader/Xls.php
index 90bd5db69..816e7698d 100644
--- a/src/PhpSpreadsheet/Reader/Xls.php
+++ b/src/PhpSpreadsheet/Reader/Xls.php
@@ -430,7 +430,7 @@ class Xls extends BaseReader
      */
     public function canRead(string $filename): bool
     {
-        if (!File::testFileNoThrow($filename)) {
+        if (File::testFileNoThrow($filename) === false) {
             return false;
         }
 
@@ -440,6 +440,9 @@ class Xls extends BaseReader
 
             // get excel data
             $ole->read($filename);
+            if ($ole->wrkbook === null) {
+                throw new Exception('The filename ' . $filename . ' is not recognised as a Spreadsheet file');
+            }
 
             return true;
         } catch (PhpSpreadsheetException $e) {
@@ -449,7 +452,7 @@ class Xls extends BaseReader
 
     public function setCodepage(string $codepage): void
     {
-        if (!CodePage::validate($codepage)) {
+        if (CodePage::validate($codepage) === false) {
             throw new PhpSpreadsheetException('Unknown codepage: ' . $codepage);
         }
 
diff --git a/src/PhpSpreadsheet/Shared/OLERead.php b/src/PhpSpreadsheet/Shared/OLERead.php
index 3d952a9c8..fcc963953 100644
--- a/src/PhpSpreadsheet/Shared/OLERead.php
+++ b/src/PhpSpreadsheet/Shared/OLERead.php
@@ -134,7 +134,7 @@ class OLERead
 
         $bbdBlocks = $this->numBigBlockDepotBlocks;
 
-        if ($this->numExtensionBlocks != 0) {
+        if ($this->numExtensionBlocks !== 0) {
             $bbdBlocks = (self::BIG_BLOCK_SIZE - self::BIG_BLOCK_DEPOT_BLOCKS_POS) / 4;
         }
 
diff --git a/tests/PhpSpreadsheetTests/IOFactoryTest.php b/tests/PhpSpreadsheetTests/IOFactoryTest.php
index 19722dc7f..966a12629 100644
--- a/tests/PhpSpreadsheetTests/IOFactoryTest.php
+++ b/tests/PhpSpreadsheetTests/IOFactoryTest.php
@@ -108,6 +108,33 @@ class IOFactoryTest extends TestCase
         ];
     }
 
+    public function testIdentifyInvalid(): void
+    {
+        $file = __DIR__ . '/../data/Reader/NotASpreadsheetFile.doc';
+
+        $this->expectException(ReaderException::class);
+        $this->expectExceptionMessage('Unable to identify a reader for this file');
+        IOFactory::identify($file);
+    }
+
+    public function testCreateInvalid(): void
+    {
+        $file = __DIR__ . '/../data/Reader/NotASpreadsheetFile.doc';
+
+        $this->expectException(ReaderException::class);
+        $this->expectExceptionMessage('Unable to identify a reader for this file');
+        IOFactory::createReaderForFile($file);
+    }
+
+    public function testLoadInvalid(): void
+    {
+        $file = __DIR__ . '/../data/Reader/NotASpreadsheetFile.doc';
+
+        $this->expectException(ReaderException::class);
+        $this->expectExceptionMessage('Unable to identify a reader for this file');
+        IOFactory::load($file);
+    }
+
     public function testFormatAsExpected(): void
     {
         $fileName = 'samples/templates/30template.xls';
diff --git a/tests/data/Reader/NotASpreadsheetFile.doc b/tests/data/Reader/NotASpreadsheetFile.doc
new file mode 100644
index 0000000000000000000000000000000000000000..10bf907ae6679e1166f8dc13096995e0cb4b2cbf
GIT binary patch
literal 28160
zcmeHQ2V4}%((m0REC{j$k)$k$%6UkTD2Ngj2})4RVSyz{a#<DAfr5g13YfESieNZI
z5HX^H3B!pAMa3LXROC?f4Ew5P8O0S&?!I>~d~e&|f2zB>yQ;gowr9GhM=H;$-p<~s
zbB9QTzJx_SiWG=kGd=_2z34QD5G#ly@1sa0Lbe3}qSEkRWP#e8BV+&}Tte#94&fjY
z0wW87O^6<#Jqd~oik!V-_6myo#YI6zlbE(A<o1V-5eU66a=%W9L@J+{t;OjAB~(OD
zNt{NSuPu)M5!Ilp1I0nWWLZ<amMDt<1@e*7`MsbULU8MAP4&J-D|Ao`A(C{bE+I_d
z7Xii47HS0LHg_UqH&h(WCBz@nSD=0eppt>M1FcswpXRqlQEu}<%cCjXZ@LVoUqGT3
z>S+R1XsRzsQ6J_@%8^W?eVPYaPIF#c;&lJMCGW4wZ><fqJlamQzZC?q8IwY*ablzb
z&A$b9!JigguPK|X13RGKGQsc6fujFmpv&cRsU&#;^%WsXr|Eog?*IKt%cUjJ<Ar*b
z0+Y5gO=<mfnx=I9)+k+0lG6T2)7I+K{I^Z^q|>cYNj-F$wlke>jnZ=Iag?Or%9kwv
z&q~wd)mpn-<J0Z^v$QpNI5!Um2(<{Y2d|eUYUumiKPz8a{@-DNfm~iRHzrod<#7Yz
z1bkjdd^n#k<c3B>@s<A_?UCyI7h3?H@st1^0lENu=6mzzP2In^6;gG7lLgvqhW8)3
zltg<du;T#)(!VIkeoD*G&-uUqP5Px`{{t-`!ysWH=oW-wLM$@E8TtjYO}Pcfoec`I
zWDNmbGO}ci09^}UW+*ty)B-4F9L42~G)OHVwSd$DQVU2eAhm$h0#XY|Eg-dk)B;iq
zNG%|>fYbs~3;b7EptGC?QG-()2@Dk?4`)8`A0gDXAXy2q_1}OE91!^yCd0nbx6qo5
zzEHQdyuX8=2mPhx;#+Jw-WuK0hBA_M!{Pmy2SAelznG3|8sA>vNALoX90&KS0z3q~
z2FS_4X#zkufDNEOAP^7=m<*T;SPp2d9?CTa9aq8Lj{$#G&i{HnJFwkwz#9M??5PC^
z1pENV0Av9Q0EYpUfF!_eKpg<56b^t3Fb6mRq<Q~3yR<Z~a6$cGPZse7_yNXwFl3@V
z2sZ{04-f*N2pL4k_?IFkP$fLPLIpWU#S#IDCOi@a96UXx7Q$jMh{mQYqDNdkHHnu8
zlak4UILZ~vRFDZG3?~L*k|2<$Lhv0#22mg$gb%VpNCb%?VW1dK5~{;pN!ExVXT(t7
zR0op5Z@Lj;KwNr&0xmRO1{zPG@iJsAP#*B&!p(*(Cm@>%btxTMYGiYOs6`!kl2IK>
z(K?KqbTDWgIxXnX`K*KWNryTq?ULQ14ogZ0>nj~hT8CB(I<!ECzHKm6Z5G^!Gq+xp
zP27l5(|dUioU(EQyM=<~Cc!ue!EU|~7XZSjYa9s&UVj*?7|6xo4;KDSR0NckVlJmd
zhCq!Vkidu1UyiIE>4=lCRh1lJD6*o&5n15ykj*6RK&CO7z-<s60ZN)$W-cdB$>9=j
z&=*hXW>Q`Pa|ZcnRxf%9R0-@S9{=_&j6avSLhG?NZ5wkTSxt%viy@@+pxij7;uk#|
z0J0*$#|W_{_JJItUWKQvMDQ*QL))kloZwOmse_iIKN4cX)MFG8b%qHOe*>tM%hH4M
zlwwWXFZ5f3b={~QO@LTWfHMh(e|&0m#6CZRVIQc9ErUZs1Y6ct8d;^{L{h8pe3)q0
z@kc;_!;$1Tuu0-2HZ3!$>Qi*~=V%HQ#Y0M>CV6gxqm(=cnO17gYD?|@OwvqYvntJW
zCx6!6dNcYnnm6Mw3u@|I_1)i~b7@wLc~%T1qS|b9eaW0ts%&D-X26Uyn$3s{N5cV6
zrUf3e1s+3^C-!{<2Kqj;X<qu;_j`e7eC7LpI2VcKT2OLXO>@!LaxGhu`-k(7uNO;3
z15SX$kr0@#p4?P9ga>N%;Et{ibd+msjF2BA95-ZY96x@HX+m_=_RQ0R%FQ|MjUMll
zAN2HGTj<2@`egQrMJIlmaropaBh8Adg}FoDHF{qd;*!VJj54XVY+UbfPjFCQzPNnl
z+FZ{a^)BBVJ=GmBCg+yz;Od_P=grd5>ch)XS=q3!^nkH#YSO@YtNnAPKa30WE_7U!
zA<)m*bm4b9=4tE6-I6{ewLd$_?}paXd6{<iDqOETVC^pGG~Ds|gSRV<?q=-T*Ux6q
zc28G!a?#<%mumCg_OH-%F+H`n`zzB;-_OfFJECmJTkV3!WBJzSt@Cbj>)ZXPR$ibq
zZ``>su6ECdhaA?=tG!+|BI-cRqQXTpY{s4$bVQ^v{#C!n>KD%>j!FcJh(vHN{lZ>3
zRk@E2gPm;PXN>dYH~~K@-pmxQDe31T%gvQiU(7j}e14|ig>tQ~lg)B6T+KGlBzKGx
z!wq$>>ps0c_=KF|es;>H7mZsSKjtrZduQn*uIB2ka^-hj`<)KIGuiP_;_Qk!n{vCd
zM<v9~-8lVv@wfxN=Qs8_YoVLtvD<u^no3&r-~;~oE+OYDI2SzKuUiEfCFW*M9Ct;3
z<$CSgHr^LsY5HHW9iN|`S0O4YH$Ss}@R7tFCJ)?YVr-XsN8As}&NI6ga4;i}zx7h*
z%Hln5t3E(izV7IRsmnE!p@Z`Qcy?77&X4AsHM{!oVt8SE0eXni86U-RF30K4%<L%{
z)waR=jopI^Pv`G{O<dRNIG@P6u;KcZ2ltX~f4QY`d5xFy2$Qw)%JcbWP18#1W|-va
z=3Vp9J7yAf=R}8xPZG2$b}dxDHSlD--^?zTGv@qUT*Iv@{{FJT3zM3$dyOI;7YrEo
z_+sOCcio?U-%XKe*K*^_>=(Vd4QqrVeetQ~X3Z9N!2+9IJHjhg*OpV-@p0nt+Jieo
zo~r6*vYvLZec3K^vEcwuuV)wTnszke4=6G0{mMVfX=FnsIrz#~L%EVDPkWMXaXZT=
z(Jgg!#EPYPZ)Rz*6-Omy=ag#yuy)nDRqGDMH%53LR6irj8(403tH;~UgXWrW2VSky
zf3<%@&1**kKQ-<twHtN0!{1CP>G$D&`)i9;7wwd<pLf+ox!>YmH6ur<yAJPvSJP`E
z^Uy-A^vo2m&iS%>>t^3vng8<&&*EaO%%hEJ8p+qn&!;KvyfUoEhi7~1+s`@erdVvg
z=|Jv~U@w>8<cT8;jt<#n+&G96{ia~>;X&`-Y-w<upOT`l^TR;V+X>gFR8>}ar=99h
zICu0g(b@Z<%p(b7UR0Djmqz6H|9ok(;De6SgI@UoFD}^^kKQ1cb%!%(^~9Z%s;-P$
zrd>t&<2voT{_1uA>N4HmZI|1<7;^bU*#zIshYC|(Odd7fz1<FH?b3ZIJ8W#%M2|Wo
z$A5E8t#s_Qh+)4j|3P`a@xbF=kNt~xpI^PfCiO?Hnn`80+m^-5oVodcle5+R^Etb<
zcDm)yFV^a0c~drt>2EafZbiiW0pV=F8!k(g>|Vb1&~m<=W6WbN_j;NW6T$kpZLoXd
z#m?@dw6rhG?`W>-<uyOO``opg3h&&K|GAXWJMp)Nwbf6H!VYb4O#I<>?Um}ABbRk8
zS+KZr>GZ~nwxR>?FT8tKqJQh)8=LFXRL#8KUmsUG?cIqDF9KA$n|e?DShKBU$GCNg
zqF3Yk9f}LTbtim$**l}-We$gPZ@OxhGdjJ0nKaJlCw+q;&sw8wCk6lgb`4WPLb6ph
zry0uU&x>~G`!FMN^x^4Cf)~V@-Bll`r=#z-Q}#yKk2cy<M&6lq?X-D(;^LI&XWt$@
z>ge|PXz`SGU6-$LSfU{?nYbm&{pwFs-TVyw($q~HU+L-w*V@&nyO`{MzQiDG_QFk#
zDG5GqYr8#JGOL5noJ!MqN6Z2`I@gu(*L*lJc8TAWE!W>1?O%3qR$lT9{eaUyHdea*
zbTy|iJt$IVhDyar_d?qTuIg7*)%tV_I(1-B(ww*oJ%QbhI}P#~p*Lb~<zBqnUoh~v
z>ALA@7V6cZ_X1PyUYheP)2P?Z4GSz%jO!Pz6dq|@H8VADLLJL9aNj$NBg^-j{UVpn
zEnmHKKJh!`y{CLdqj}NY65E_EDPy*Trk)6#UvuZEcBiug!{@y2d|YGQPbB!o`A6;L
ze3p;2G4r^U&fQiUG;Dm$fXUmpK9y<rc-fHnqP5){(+XU6r@HQ*eeR>s;H9^pT9;DK
z-xvusyQa!}j;U2la<$i6bC|_+<Q`pc(KwYU)H-s||EXWfcIM{%ISylUZ`9x7KeyOp
zmfllm#U3+fxp5=p)b@Y(+t}+3s>L?O%+2Xpr{i))adzGqmzH;T>#=Tw_GZq!s2P*=
z{AA>`pv9xFGI}=jy)4RaoYnr``_vVS-rX*5aELh;Shz1Jx2VUeTGIyGZE*|6_$+vt
zG~>OGkFL++E=rR^dI#4uSlK!*6digI5m<B1cHNn+Kiu2A<YjjGo+lxp<;zqqR%o1U
z*I*raJ5zaD!`1F%d%x0F^_(v7e7U|dS)Xyv(z&DNvbF0I?#@tL*}rb+vfft@m(9_O
z&`!5}E1T(O=JK6)>ZwwHwfU=l^-cIr-Q4QJ=|MG$gS)@%+pdrows*VSni2dC9-2>c
zB1_vR_gIxZ;Z;!5ifvb-Tph#LsrwcVGvGyqF1Z?)k$0}+vdo6z9e;et%^v*Pd3col
z@Ed`@KFS{%#JD8bahO#ipZ-Mo&`5?VXZBP*t4Fiy10MdmcS^BkzfHNrv@gyl;RTOW
zeG{eyOdK<{&!l}OmrU<OEJ#s}u~CTDuDLyr-8nhz{FXp7*Lzz_Z<>sbJRh*R@||;d
z2diI8Zk@QhuT*aDu^Ue6mI0MV9irb9FYJ+WhLfY5DB~LZMkkl!;Nlo>pi{PHMfUw_
z<-~Po77Glnd$_GSGU-A^p|iKq!_HkNmJd5|uEt4yovT$zy}eON`tlpyHZ4nEsApF*
zxmV|fb-t@(Yy+3(6nUMj8<8LPaqF=iDuIimn9rZPAK7A?rT&rQoHq0+pMN-soiN4s
zm+jh|1nuSB3k^SNDqb{swmNpBP>KIEZL{j?p&FK}!s6DQinss0N6D;-)()0hm&_}+
zbK1KM9q+So<YlWJI@+nrhBgKn@OyWO(6qjIs>jyIeMKva%MU1-T&<txesjFFt;Kz-
zqO!0p(=8sv{1RW|vLR!bf_XwrzX6vIx;dNYbyzdvlE%FUR@()yqb}!n`i(W#=~*xL
zvXj3T@4Y6w|ABSc-cBZCx78=#2)a~uA^hgBNUx_Q4<9awwy~Rg|NLCjDK0sc`6(5q
z11dSMgo797D)-#?!3=KKU*FJ`&u47d4LQ1SyYDV>Ll-~AP<P2@xAmr{8Xv_nbB&b7
z*;ClDu^0DoGP~8JRsMX5m2%%&*`}Y7U+pvHd=s{5Dz9`^#QqiQD%68}-Lwebs>8N_
zvTWk&Bhh<m7diQB4w_f(5K=IH_M%wZXC1;ay^MXj8TlKVTC5bb@9w!|ZRPwSZ<F%v
zHl_#OH{7_{`Q-jekH$$evtF)Y%s6IrFo-k#GSOb{yINHA!A@shn3=xjn2&zW@zrx=
zjek0R=607gTfJpYjoP>G=&es(XE1xh2RN-g=0dS%p@oNDU#~9(NIv&{u5AwXZ1xl=
zSyA#i>T^YHc)<MX!K9h_B_&Bd)O?my)siIY5l2#nq!WCW@vFj@t@#6&@b!{~XDj?B
zM3#(!-ao(vD(TY?9;vvK`GWX}*ceAc3sZALE<YwXHY6e@%+YY@kp4aG47u?_UQ7rt
zDmI4iXgHN0Z`iM|vSJ^eeQ=b(hZn~M0WtCRJV(QDp)k(g%q%__9y)pPrm=DS7|08a
z6-4udkQ9WOg$Q_4KyY-FSub;Q8?$I$M2sOfD9pmqFiL1)$Q33)EMx-2g2H+suNU$l
z7BT^1yx?G1;y{U}2+e_fG3QemOPXUzm$9NbRy4<&=2+7l8=7Nd$PJH*h?xLALSo1b
zjg9gUGw7J1SzojsK4N#p4>KX)DxE&TEsG3Ts^JNKG`b3GzIr2%$kpM_I#WjcJt7PP
z>|clh-axvLc6GRWG4}{u$T8~bL^{93?LLr>SCW*JL>lq)H5J0FTMR4?Vb|fZkP-xf
zRS2sNw^LMzOr0^sSE&26UkGVBFo_~n58g0=ONh(6099+^Gk}j>3xGy-hUg(sz#*qm
z4H3bWO=MW$exx6ZLFrbl!wOV3(2fB7st{|+g9>?|pE-0|oGY0F&;QscYO(tOGa<kp
z7pd>dAh%eu1W(PU8*7mAzMV*=J(o1}F(t9K4kTyf0K&B!NK90GiK1ZuS#2?bIQO4O
zy1^!pw%uIvzF#Ui;E_sg4!zf0Pc6^0h1<w+<K3jI?@3}Us3y72*GbLfd&GV6ebO%U
zcakV4qP7RH4LID`Vhq?%krPQ`P`$*SVn9pKaWMx5nl?UG_ho_&op3Z!fIJxrJ5Cb-
zv1AHdk&8n~2XQGZjsDW)0nOs*TLU_0fG8$YjwLH2%Vf!jOv&w03FI&i4F*aP&>^tn
z77aUG@dS4k`Jj&rdylcy&T$OnTZ0_fft6)28S-*WS@C$`h<^@A7!4p(p-vFgjDnP<
zDW$!goD35~tJ<BZeK_$RwXL|0iY!)OQFZQ5HzH+{Ep~++x+rLM5LK5DS5p)0sS4{)
z)f4Z0hQSUd?z=jRttBH1){;Zra^$wih@ju&50GpC4H!^2_7Zmwd0;6YxC%iAA%@_Z
zFWE_2qz>P$gj408blTM&fi)>Hl>6c@UHsFKAuKeL1h+{QF<=qu2TG?=iZry<0$H+I
zvb)GGGHaF^&U(!P{tzX9jLov!6cvvq7G-!PtKvAZ$$Q+sXgRQ*d@)0z4nD6}FoO7f
zn8)D8kk}e<pBmi)-++7_3~&~d2ppJ3sQU}WPk<|e4q1>DQ?tVtceya!0AOoHA~j4l
z3yPFa3t;x)g8TD;^1<6%<~FM)js9&G_y{w*V$=N5TnUcf?KvCj-wqDvY|CVm@4FXO
zqpOdH3=UAtPXnN@W&rS3xfX!VlLtU=IRL=B#Yq58?Uw*-z+(W;yYB($A#4zaPawuX
z@fDI4P<*^`0t!zt)L9AC=?iJxdB*q9s2BYlZ;iCWO2$#94^J?G>%yDB7ks<yAbe_!
zG7X6pMpJTItB=1M)P-}cPeiaFHa<2~$Q>LS8WGIr4vQ6p0N)8fO1r%i!v6%&JdSpP
z=2P~<c4HdlAe9EG1*8^`T0m+6sRg7KkXk@$0jUL~7LZy%Y5}PQ{w@pr(fXfx`RwJj
zrn;OZD`5R^@-`pW|G0L?buq4C!vVNHj|1R(e+B^8`zZibz>fgjl84<U>I4+-58yg}
z69Cuo+X48E#V!D@`*FVjWmf=NTHiNcJJV}u+-noBojH^aNVZBlgL15gppG-65?sh*
zqlZKYqxh64DjPV`Ahm$h0#XY|Eg-dk)B;iqNG%|>fYbs~3rH;>wZQ)y3*cfGm%+G(
z#`n><j>qLNzOTo>>w)j-@z5ro?ZCA;uG8_|Jg)mOAJ_T#4j<R^8UXxD1-Pcibw9q>
z#y_F}|4}=2CPoh^{BZ+n$&JVDxB!%42($~p2+$SK4S>g*i~*S61L*ev6F^UZDZmVX
z`w^J`0btn_$23A3+GYVfjTZ~2%(%pz`VLh9C++@B&?K@9S`+$^oC10iA&03ee0<z2
zRA!6+GJ-YmlA8GVMXV6;R|A|~`J^A)(H1#uEQA|T5G<N~qbuh8xodmSkG~=O&9qfN
zs?O)a1;Q|}z5u>Tb^{s=-*Mw<N&0JTafv^^>VST<IR0+is-KeB)PGqxTZvlnTYen-
zfuKE<Y7=sVa1s%}9&bGu{{{OSptw)^C42to+G7X$ao)ndV`#mlpL4#$Xp?>hoVvvG
zsBvU4oV<+uT&RsPHJClcn#I>PRs&oA^TJ=zPisftmCl#VE%?6`XTa#Q;0BMqmYln}
z;2WRMx8cDyZg1P3@D+t6*DW@9QZ#%SK|LGz1YjPps2>%^P3e47JJQg*a3bw(Qu?1}
Gfqwvlz*+JD

literal 0
HcmV?d00001