Bug 65372 - Not able to open files generated due to uncompressed size over 4GB
Summary: Not able to open files generated due to uncompressed size over 4GB
Status: NEW
Alias: None
Product: POI
Classification: Unclassified
Component: XSSF (show other bugs)
Version: 5.0.x-dev
Hardware: PC
: P2 normal (vote)
Target Milestone: ---
Assignee: POI Developers List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-06-11 11:37 UTC by Gunics Balázs
Modified: 2021-06-11 11:37 UTC (History)
0 users



Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gunics Balázs 2021-06-11 11:37:57 UTC
I'm raising this ticket as we're using Apache POI in our product and some customers are generated very big files. Using Apache POI 4.x these files were corrupted and excel had to repair them. With the 5.0 this is no longer an issue.  (bug: https://bz.apache.org/bugzilla/show_bug.cgi?id=57342 )

When we're trying to open it back using Apache POI, we get the following error:
Caused by: java.io.IOException: Zip bomb detected! The file would exceed the max size of the expanded data in the zip-file.
This may indicates that the file is used to inflate memory usage and thus could pose a security risk.
You can adjust this limit via ZipSecureFile.setMaxEntrySize() if you need to work with files which are very large.
Uncompressed size: 4294969726, Raw/compressed size: 356720128
Limits: MAX_ENTRY_SIZE: 4294967295, Entry: xl/worksheets/sheet1.xml

I built a version that allows the setMaxEntrySize to be greater than ~4GB and was able to increase this value to 14GB and open the file without any problem.

Would it be possible to increase the limit?
https://github.com/apache/poi/blob/trunk/poi-ooxml/src/main/java/org/apache/poi/openxml4j/util/ZipSecureFile.java#L76 

Or can we use a different method to open the files?