Merge pull request #4648 from oleibman/issue4647

Drowning in Warning Messages with Corrupt Xls File

Author: oleibman

CHANGELOG.md

@@ -37,6 +37,7 @@ and this project adheres to [Semantic Versioning](https://semver.org). Thia is a
 - Wrapped cells and default row height. [Issue #4584](https://github.com/PHPOffice/PhpSpreadsheet/issues/4584) [PR #4645](https://github.com/PHPOffice/PhpSpreadsheet/pull/4645)
 - For Php8.5, replace one of our two uses of `__wakeup` with `__unserialize`, and eliminate the other. [PR #4639](https://github.com/PHPOffice/PhpSpreadsheet/pull/4639)
 - Use prefix _xlfn for BASE function. [Issue #4638](https://github.com/PHPOffice/PhpSpreadsheet/issues/4638) [PR #4641](https://github.com/PHPOffice/PhpSpreadsheet/pull/4641)
+- Warning messages with corrupt Xls file. [Issue #4647](https://github.com/PHPOffice/PhpSpreadsheet/issues/4647) [PR #4648](https://github.com/PHPOffice/PhpSpreadsheet/pull/4648)
 - Additional support for union and intersection. [PR #4596](https://github.com/PHPOffice/PhpSpreadsheet/pull/4596)
 
 ## 2025-09-03 - 5.1.0

src/PhpSpreadsheet/Reader/XlsBase.php

@@ -368,11 +368,20 @@ protected function decodeCodepage(string $string): string
         return StringHelper::convertEncoding($string, 'UTF-8', $this->codepage);
     }
 
+    protected static function confirmPos(string $data, int $pos): void
+    {
+        if ($pos >= strlen($data)) {
+            throw new PhpSpreadsheetException('File appears to be corrupt'); // @codeCoverageIgnore
+        }
+    }
+
     /**
      * Read 16-bit unsigned integer.
      */
     public static function getUInt2d(string $data, int $pos): int
     {
+        self::confirmPos($data, $pos + 1);
+
         return ord($data[$pos]) | (ord($data[$pos + 1]) << 8);
     }
 
@@ -381,6 +390,8 @@ public static function getUInt2d(string $data, int $pos): int
      */
     public static function getInt2d(string $data, int $pos): int
     {
+        self::confirmPos($data, $pos + 1);
+
         return unpack('s', $data[$pos] . $data[$pos + 1])[1]; // @phpstan-ignore-line
     }
 
@@ -389,6 +400,8 @@ public static function getInt2d(string $data, int $pos): int
      */
     public static function getInt4d(string $data, int $pos): int
     {
+        self::confirmPos($data, $pos + 3);
+
         // FIX: represent numbers correctly on 64-bit system
         // http://sourceforge.net/tracker/index.php?func=detail&aid=1487372&group_id=99160&atid=623334
         // Changed by Andreas Rehm 2006 to ensure correct result of the <<24 block on 32 and 64bit systems