pyOpenVBA 6.3.3__tar.gz → 6.3.5__tar.gz

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyOpenVBA
-Version: 6.3.3
+Version: 6.3.5
 Summary: Read and write VBA macros and Excel Power Query in pure Python, no dependencies.
 Project-URL: Homepage, https://github.com/WilliamSmithEdward/pyOpenVBA
 Project-URL: Repository, https://github.com/WilliamSmithEdward/pyOpenVBA
@@ -41,6 +41,9 @@ Description-Content-Type: text/markdown
 [![Python versions](https://img.shields.io/pypi/pyversions/pyOpenVBA.svg)](https://pypi.org/project/pyOpenVBA/)
 [![CI](https://github.com/WilliamSmithEdward/pyOpenVBA/actions/workflows/ci.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyOpenVBA/actions/workflows/ci.yml)
 [![Security](https://github.com/WilliamSmithEdward/pyOpenVBA/actions/workflows/security.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyOpenVBA/actions/workflows/security.yml)
+[![Malware scan](https://github.com/WilliamSmithEdward/pyOpenVBA/actions/workflows/malware-scan.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyOpenVBA/actions/workflows/malware-scan.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/WilliamSmithEdward/pyOpenVBA/badge)](https://scorecard.dev/viewer/?uri=github.com/WilliamSmithEdward/pyOpenVBA)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/15116/badge)](https://www.bestpractices.dev/projects/15116)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/WilliamSmithEdward/pyOpenVBA/blob/main/LICENSE.md)
 [![Downloads](https://static.pepy.tech/badge/pyOpenVBA/month)](https://pepy.tech/project/pyOpenVBA)
 
@@ -52,9 +55,9 @@ Works on Windows, macOS and Linux. Python 3.10 or newer.
 
 VBA, four hosts and one API:
 
-* Excel (`.xlsm`, `.xlsb`, `.xlam`, `.xls`)
-* Word (`.docm`, `.dotm`, `.doc`)
-* PowerPoint (`.pptm`, `.potm`, `.ppt`)
+* Excel (`.xlsm`, `.xlsb`, `.xlam`, `.xls`; `.xltm`, `.xlt`, `.xla` read only)
+* Word (`.docm`, `.dotm`, `.doc`; `.dot` read only)
+* PowerPoint (`.pptm`, `.potm`, `.ppt`; `.ppsm`, `.ppam` read only)
 * Access (`.accdb`, `.mdb`)
 
 Power Query, in any Excel package:
@@ -884,6 +887,9 @@ implemented, what is not, and how it was measured is in
 | `.xlsb`   | Binary workbook              | yes |     yes     |    yes     |
 | `.xlam`   | Macro-enabled add-in         | yes |     yes     |    yes     |
 | `.xls`    | Legacy (Excel 97-2003)       | yes |      -      |    no      |
+| `.xltm`   | Macro-enabled template       | read |    yes     |    no      |
+| `.xlt`    | Legacy template              | read |     -      |    no      |
+| `.xla`    | Legacy add-in                | read |     -      |    no      |
 
 A `.xlsx` file has no VBA project by design, and Power Query lives
 outside the project, so it is read and written in every package above.
@@ -895,6 +901,7 @@ outside the project, so it is read and written in every package above.
 | `.docm`   | Macro-enabled document       |  yes |  yes  |    yes     |
 | `.dotm`   | Macro-enabled template       |  yes |  yes  |    no      |
 | `.doc`    | Legacy (Word 97-2003)        |  yes |  yes  |    no      |
+| `.dot`    | Legacy template              |  yes |   no  |    no      |
 
 ### PowerPoint
 
@@ -902,6 +909,8 @@ outside the project, so it is read and written in every package above.
 |-----------|------------------------------|:----:|:-----:|:----------:|
 | `.pptm`   | Macro-enabled presentation   |  yes |  yes  |    yes     |
 | `.potm`   | Macro-enabled template       |  yes |  yes  |    no      |
+| `.ppsm`   | Macro-enabled show           |  yes |   no  |    no      |
+| `.ppam`   | Macro-enabled add-in         |  yes |   no  |    no      |
 | `.ppt`    | Legacy (PowerPoint 97-2003)  |  yes |  yes  |    no      |
 
 ### Files with no VBA project
@@ -1116,7 +1125,8 @@ not in a public issue.
 [SECURITY.md](https://github.com/WilliamSmithEdward/pyOpenVBA/blob/main/SECURITY.md)
 says what to report, which versions get fixes and how the code is
 checked. CodeQL and Semgrep scan every push to main and every pull
-request, and every release carries its security report.
+request, ClamAV and YARA-X scan every file daily as well, and every
+release carries both reports.
 
 ---
 

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/README.md

@@ -4,6 +4,9 @@
 [![Python versions](https://img.shields.io/pypi/pyversions/pyOpenVBA.svg)](https://pypi.org/project/pyOpenVBA/)
 [![CI](https://github.com/WilliamSmithEdward/pyOpenVBA/actions/workflows/ci.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyOpenVBA/actions/workflows/ci.yml)
 [![Security](https://github.com/WilliamSmithEdward/pyOpenVBA/actions/workflows/security.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyOpenVBA/actions/workflows/security.yml)
+[![Malware scan](https://github.com/WilliamSmithEdward/pyOpenVBA/actions/workflows/malware-scan.yml/badge.svg)](https://github.com/WilliamSmithEdward/pyOpenVBA/actions/workflows/malware-scan.yml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/WilliamSmithEdward/pyOpenVBA/badge)](https://scorecard.dev/viewer/?uri=github.com/WilliamSmithEdward/pyOpenVBA)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/15116/badge)](https://www.bestpractices.dev/projects/15116)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/WilliamSmithEdward/pyOpenVBA/blob/main/LICENSE.md)
 [![Downloads](https://static.pepy.tech/badge/pyOpenVBA/month)](https://pepy.tech/project/pyOpenVBA)
 
@@ -15,9 +18,9 @@ Works on Windows, macOS and Linux. Python 3.10 or newer.
 
 VBA, four hosts and one API:
 
-* Excel (`.xlsm`, `.xlsb`, `.xlam`, `.xls`)
-* Word (`.docm`, `.dotm`, `.doc`)
-* PowerPoint (`.pptm`, `.potm`, `.ppt`)
+* Excel (`.xlsm`, `.xlsb`, `.xlam`, `.xls`; `.xltm`, `.xlt`, `.xla` read only)
+* Word (`.docm`, `.dotm`, `.doc`; `.dot` read only)
+* PowerPoint (`.pptm`, `.potm`, `.ppt`; `.ppsm`, `.ppam` read only)
 * Access (`.accdb`, `.mdb`)
 
 Power Query, in any Excel package:
@@ -847,6 +850,9 @@ implemented, what is not, and how it was measured is in
 | `.xlsb`   | Binary workbook              | yes |     yes     |    yes     |
 | `.xlam`   | Macro-enabled add-in         | yes |     yes     |    yes     |
 | `.xls`    | Legacy (Excel 97-2003)       | yes |      -      |    no      |
+| `.xltm`   | Macro-enabled template       | read |    yes     |    no      |
+| `.xlt`    | Legacy template              | read |     -      |    no      |
+| `.xla`    | Legacy add-in                | read |     -      |    no      |
 
 A `.xlsx` file has no VBA project by design, and Power Query lives
 outside the project, so it is read and written in every package above.
@@ -858,6 +864,7 @@ outside the project, so it is read and written in every package above.
 | `.docm`   | Macro-enabled document       |  yes |  yes  |    yes     |
 | `.dotm`   | Macro-enabled template       |  yes |  yes  |    no      |
 | `.doc`    | Legacy (Word 97-2003)        |  yes |  yes  |    no      |
+| `.dot`    | Legacy template              |  yes |   no  |    no      |
 
 ### PowerPoint
 
@@ -865,6 +872,8 @@ outside the project, so it is read and written in every package above.
 |-----------|------------------------------|:----:|:-----:|:----------:|
 | `.pptm`   | Macro-enabled presentation   |  yes |  yes  |    yes     |
 | `.potm`   | Macro-enabled template       |  yes |  yes  |    no      |
+| `.ppsm`   | Macro-enabled show           |  yes |   no  |    no      |
+| `.ppam`   | Macro-enabled add-in         |  yes |   no  |    no      |
 | `.ppt`    | Legacy (PowerPoint 97-2003)  |  yes |  yes  |    no      |
 
 ### Files with no VBA project
@@ -1079,7 +1088,8 @@ not in a public issue.
 [SECURITY.md](https://github.com/WilliamSmithEdward/pyOpenVBA/blob/main/SECURITY.md)
 says what to report, which versions get fixes and how the code is
 checked. CodeQL and Semgrep scan every push to main and every pull
-request, and every release carries its security report.
+request, ClamAV and YARA-X scan every file daily as well, and every
+release carries both reports.
 
 ---
 

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pyOpenVBA"
-version = "6.3.3"
+version = "6.3.5"
 description = "Read and write VBA macros and Excel Power Query in pure Python, no dependencies."
 readme = "README.md"
 license = { text = "MIT" }

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/__init__.py

@@ -293,4 +293,4 @@ def push_power_query(
     """
     return _push_queries(src_dir, workbook, out=out, encoding=encoding, remove_missing=remove_missing)
 
-__version__ = "6.3.3"
+__version__ = "6.3.5"

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/__main__.py

@@ -179,12 +179,18 @@ _HOST_BY_SUFFIX: dict[str, type] = {
     ".xlsm": ExcelFile,
     ".xlsb": ExcelFile,
     ".xlam": ExcelFile,
+    ".xltm": ExcelFile,
     ".xls": ExcelFile,
+    ".xlt": ExcelFile,
+    ".xla": ExcelFile,
     ".docm": WordFile,
     ".dotm": WordFile,
     ".doc": WordFile,
+    ".dot": WordFile,
     ".pptm": PowerPointFile,
     ".potm": PowerPointFile,
+    ".ppsm": PowerPointFile,
+    ".ppam": PowerPointFile,
     ".ppt": PowerPointFile,
 }
 

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/_host.py

@@ -91,6 +91,8 @@ class VBAHostFile(ReferenceManager):
     _project_storage: ClassVar[str | None]
     #: The formats add_vba_project gives a project to, each measured against its application.
     _project_formats: ClassVar[frozenset[str]] = frozenset()
+    #: Formats that open and read but do not save: a writer for them has not been measured.
+    _read_only_formats: ClassVar[frozenset[str]] = frozenset()
     #: The package part a zip-based file's project is related from.
     _main_part: ClassVar[str] = ""
 
@@ -533,7 +535,15 @@ class VBAHostFile(ReferenceManager):
 
         A file with no VBA project can hold no edit, since every write
         refuses, so it is written out as it was read.
+
+        Templates and add-ins that share a supported layout (``.xltm``,
+        ``.xlt``, ``.xla``, ``.dot``, ``.ppsm``, ``.ppam``) open read only:
+        saving one raises :class:`~pyopenvba.exceptions.UnsupportedFormatError`.
         """
+        if self._suffix in self._read_only_formats:
+            raise UnsupportedFormatError(
+                f"Saving a {self._suffix} file is not supported; it opens read only."
+            )
         if not self._has_project:
             if dest is not None:
                 Path(dest).write_bytes(self._container_raw)

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/access/_pages.py

@@ -409,6 +409,8 @@ def row_bytes(
     target with ``overflow_target=True``, where the 0x8000 bit marks the
     moved row rather than a deletion."""
     slots = row_slots(page)
+    if not 0 <= slot < len(slots):
+        raise AccessError(f"slot {slot} out of range (0..{len(slots) - 1})")
     entry = slots[slot]
     if entry & ROW_DELETED and not overflow_target:
         return None

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/access/_rows.py

@@ -184,9 +184,13 @@ def encode_text(text: str) -> bytes:
 
 def decode_datetime(raw: bytes) -> _dt.datetime:
     value = struct.unpack("<d", raw)[0]
-    days = int(value)
-    fraction = abs(value - days)
-    return EPOCH + _dt.timedelta(days=days) + _dt.timedelta(days=fraction)
+    try:
+        days = int(value)
+        fraction = abs(value - days)
+        return EPOCH + _dt.timedelta(days=days) + _dt.timedelta(days=fraction)
+    except (OverflowError, ValueError):
+        # Out of the year 1 to 9999, or not a number: a damaged value.
+        raise AccessError(f"date value {value!r} is outside the range a date can hold") from None
 
 
 def encode_datetime(value: _dt.datetime) -> bytes:
@@ -455,11 +459,23 @@ def encode_row(
     return bytes(row)
 
 
+#: The bytes a fixed-size type's value takes; any other length is a damaged row.
+_SCALAR_SIZES = {
+    TYPE_BYTE: 1, TYPE_INT: 2, TYPE_LONG: 4, TYPE_MONEY: 8, TYPE_FLOAT: 4, TYPE_DOUBLE: 8,
+    TYPE_DATETIME: 8, TYPE_GUID: 16, TYPE_COMPLEX: 4, TYPE_BIGINT: 8,
+}
+
+
 def decode_scalar(column: ColumnDef, raw: bytes) -> object:
     """Decode a non-long-value column.  ``raw`` is the present value."""
     code = column.type_code
     if code == TYPE_BOOLEAN:
         return True
+    size = _SCALAR_SIZES.get(code, 0)
+    if size and len(raw) != size:
+        raise AccessError(
+            f"column {column.name!r} holds {len(raw)} bytes where its type takes {size}; the row is damaged"
+        )
     if code == TYPE_BYTE:
         return raw[0]
     if code == TYPE_INT:

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/access/_tdef.py

@@ -333,10 +333,14 @@ def read_definition_bytes(store: PageStore, page: int) -> tuple[bytes, list[int]
 
 def _read_name(buf: bytes, pos: int) -> tuple[str, int]:
     """A name is prefixed by its length as a word, and stored as UTF-16."""
+    if pos + 2 > len(buf):
+        raise AccessError("name runs past the end of the definition")
     length = struct.unpack_from("<H", buf, pos)[0]
     raw = buf[pos + 2 : pos + 2 + length]
     if len(raw) != length:
         raise AccessError("name runs past the end of the definition")
+    if length % 2:
+        raise AccessError(f"name is {length} bytes, an odd length for UTF-16")
     return raw.decode("utf-16-le"), pos + 2 + length
 
 
@@ -463,6 +467,10 @@ def parse_table_definition(store: PageStore, page: int) -> TableDefinition:
         pos += 2
         if number == INDEX_COLUMN_UNUSED:
             break
+        if pos + 8 > len(buf):
+            raise AccessError(
+                f"table definition at page {page} ends inside its usage-map block"
+            )
         column_usage_maps[number] = (u32(pos), u32(pos + 4))
         pos += 8
 

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/access/database.py

@@ -430,6 +430,22 @@ class Index:
         return encode_key(key_values, self.columns)
 
 
+class Row(dict[str, object]):
+    """A decoded row: every column the table defines, by name.
+
+    A column the definition does not hold is an AccessError, not a bare
+    KeyError: when an engine table lacks one of its own columns, the
+    definition is damaged, and the message should say so (issue #45).
+    """
+
+    def __init__(self, table: str = "") -> None:
+        super().__init__()
+        self.table = table
+
+    def __missing__(self, column: str) -> object:
+        raise AccessError(f"table {self.table!r} has no column {column!r}; its definition is damaged")
+
+
 class Table:
     """A table: its definition plus the rows on its owned pages."""
 
@@ -778,7 +794,7 @@ class Table:
         return rid if ref.kind == LongValueRef.KIND_INLINE else RowId(ref.page, ref.row)
 
     def decode(self, raw: RawRow) -> dict[str, object]:
-        out: dict[str, object] = {}
+        out = Row(self.name)
         for column in self.columns:
             value = raw.values.get(column.number)
             if value is None:

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/cfb.py

@@ -254,6 +254,12 @@ class CFB:
 
         if major_ver not in (3, 4):
             raise CFBError(f"Unsupported CFB major version: {major_ver}")
+        # [MS-CFB] 2.2: 512-byte sectors in version 3, 4096 in version 4, and
+        # 64-byte mini sectors in both.
+        if sector_size_pow != (9 if major_ver == 3 else 12) or mini_sector_size_pow != 6:
+            raise CFBError(
+                f"Unsupported CFB sector sizes: shift {sector_size_pow}, mini shift {mini_sector_size_pow}."
+            )
 
         self.sector_size = 1 << sector_size_pow          # 512 or 4096
         self.mini_sector_size = 1 << mini_sector_size_pow  # 64
@@ -264,11 +270,22 @@ class CFB:
 
         # Follow DIFAT chain for large files (> 109 FAT sectors)
         if difat_start != _ENDOFCHAIN and num_difat_sectors > 0:
+            # The header's count is only a claim: a file cannot hold more
+            # sectors than its size allows, and a chain that returns to a
+            # sector it has visited would otherwise loop for that count.
+            if num_difat_sectors > max(0, len(self._data) // self.sector_size - 1):
+                raise CFBError(f"The header claims {num_difat_sectors} DIFAT sectors; the file is too short.")
             sector = difat_start
+            seen: set[int] = set()
             for _ in range(num_difat_sectors):
                 if sector in (_ENDOFCHAIN, _FREESECT):
                     break
+                if sector in seen:
+                    raise CFBError(f"The DIFAT chain returns to sector {sector}.")
+                seen.add(sector)
                 sector_data = self._sector(sector)
+                if len(sector_data) < self.sector_size:
+                    raise CFBError(f"DIFAT sector {sector} lies past the end of the file.")
                 entries_per_difat = (self.sector_size // 4) - 1
                 extra = [int(x) for x in struct.unpack_from(f"<{entries_per_difat}I", sector_data)]
                 difat.extend(extra)
@@ -310,7 +327,10 @@ class CFB:
                 self._mini_stream = bytes(ms_raw)
 
     def _sector(self, index: int) -> bytes:
-        offset = _HEADER_SIZE + index * self.sector_size
+        # The header takes the whole first sector: 512 bytes in version 3, and
+        # 512 bytes padded to 4096 in version 4 ([MS-CFB] 2.2), so sector n
+        # starts at (n + 1) * sector_size, not after the 512 header bytes.
+        offset = (index + 1) * self.sector_size
         return self._data[offset: offset + self.sector_size]
 
     def _chain(self, start: int) -> list[int]:

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/excel.py

@@ -6,6 +6,8 @@ Supports:
   - .xlsb  (Binary workbook — ZIP containing xl/vbaProject.bin)
   - .xlam  (Macro-enabled add-in — same ZIP container as .xlsm)
   - .xls   (Legacy BIFF8 — the entire file is a CFB)
+  - .xltm, .xlt, .xla  (templates and the legacy add-in: the .xlsm and
+            .xls containers; read only)
 
 Usage
 -----
@@ -27,8 +29,8 @@ from pyopenvba._host import VBAHostFile
 from pyopenvba._new_project import WORKBOOK_BASE, document_header, excel_code_name_edits, excel_code_names
 from pyopenvba.vba import VBAProject, split_attribute_header
 
-_ZIP_FORMATS = frozenset({".xlsm", ".xlsb", ".xlam"})
-_CFB_FORMATS = frozenset({".xls"})
+_ZIP_FORMATS = frozenset({".xlsm", ".xlsb", ".xlam", ".xltm"})
+_CFB_FORMATS = frozenset({".xls", ".xlt", ".xla"})
 _VBA_ENTRY = "xl/vbaProject.bin"
 
 
@@ -49,6 +51,7 @@ class ExcelFile(VBAHostFile):
     _application = "Excel"
     _project_storage = "_VBA_PROJECT_CUR"
     _project_formats = frozenset({".xlsm"})
+    _read_only_formats = frozenset({".xltm", ".xlt", ".xla"})
     _main_part = "xl/workbook.xml"
 
     # ------------------------------------------------------------------

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/mlang/_parse.py

@@ -219,7 +219,7 @@ def text_value(raw: str) -> str:
                 for piece in body[index + 2 : close].split(","):
                     if piece in _ESCAPES:
                         out.append(_ESCAPES[piece])
-                    elif re.fullmatch(r"[0-9A-Fa-f]{4,8}", piece):
+                    elif re.fullmatch(r"[0-9A-Fa-f]{4,8}", piece) and int(piece, 16) <= 0x10FFFF:
                         out.append(chr(int(piece, 16)))
                     else:
                         out.append(f"#({piece})")
@@ -624,4 +624,10 @@ def parse(source: str) -> Node:
     body = source.strip()
     if not body:
         raise MSyntaxError("an empty formula")
-    return Parser(tokenize(body), body).parse()
+    try:
+        return Parser(tokenize(body), body).parse()
+    except RecursionError:
+        # The parser descends once per nesting level, so a formula nested
+        # past Python's recursion limit, as a hostile workbook can hold, is
+        # refused like any other malformed formula.
+        raise MSyntaxError("the formula nests too deeply to parse") from None

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/powerpoint.py

@@ -4,6 +4,7 @@ PowerPoint file handler.
 Supports:
   - .pptm  (OOXML macro-enabled presentation -- ZIP containing ppt/vbaProject.bin)
   - .potm  (OOXML macro-enabled template -- ZIP containing ppt/vbaProject.bin)
+  - .ppsm, .ppam  (show and add-in -- the .pptm container; read only)
   - .ppt   (Legacy PowerPoint -- a CFB whose 'PowerPoint Document' stream
             embeds the VBA project as a deflated CFB; see
             :mod:`pyopenvba._ppt_container`)
@@ -28,7 +29,7 @@ from pyopenvba._host import VBAHostFile
 from pyopenvba.cfb import CFB
 from pyopenvba.vba import VBAProject
 
-_ZIP_FORMATS = frozenset({".pptm", ".potm"})
+_ZIP_FORMATS = frozenset({".pptm", ".potm", ".ppsm", ".ppam"})
 _CFB_FORMATS = frozenset({".ppt"})
 _VBA_ENTRY = "ppt/vbaProject.bin"
 
@@ -51,6 +52,7 @@ class PowerPointFile(VBAHostFile):
     # A binary presentation embeds its project in a record, found by _vba_cfb_bytes.
     _project_storage = None
     _project_formats = frozenset({".pptm"})
+    _read_only_formats = frozenset({".ppsm", ".ppam"})
     _main_part = "ppt/presentation.xml"
 
     # A new project, as PowerPoint makes one: empty, and not written until

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/powerquery/_metadata.py

@@ -468,7 +468,7 @@ def parse_items(xml: bytes) -> list[Item]:
     """The items a ``LocalPackageMetadataFile`` document lists."""
     try:
         root = ElementTree.fromstring(xml.decode("utf-8-sig"))
-    except ElementTree.ParseError as exc:
+    except (ElementTree.ParseError, UnicodeDecodeError) as exc:
         raise PowerQueryError(f"the metadata XML does not parse: {exc}") from exc
     if root.tag.rsplit("}", 1)[-1] != _ROOT:
         raise PowerQueryError(f"the metadata document is <{root.tag}>, not <{_ROOT}>")

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/powerquery/_package.py

@@ -85,17 +85,28 @@ class Package:
         parts: list[Part] = []
         at = 0
         while raw[at : at + 4] == b"PK\x03\x04":
+            if len(raw) < at + 30:
+                raise PowerQueryError("the package ends inside a part's header")
             (_need, _flags, method, dos_time, dos_date, _crc, csize, usize, nlen, xlen) = struct.unpack_from(
                 "<HHHHHIIIHH", raw, at + 4
             )
-            name = raw[at + 30 : at + 30 + nlen].decode("utf-8")
             body_at = at + 30 + nlen + xlen
+            if len(raw) < body_at + csize:
+                raise PowerQueryError("the package ends inside a part")
+            try:
+                name = raw[at + 30 : at + 30 + nlen].decode("utf-8")
+            except UnicodeDecodeError as exc:
+                raise PowerQueryError(f"a package part's name is not UTF-8: {exc}") from exc
             body = raw[body_at : body_at + csize]
             if method == 0:
                 data = body
             elif method == DEFLATED:
+                # Inflate no more than the size the header states, plus one
+                # byte to tell a longer part, so a small part cannot expand
+                # without limit.
+                inflater = zlib.decompressobj(-15)
                 try:
-                    data = zlib.decompress(body, -15)
+                    data = inflater.decompress(body, usize + 1)
                 except zlib.error as exc:
                     raise PowerQueryError(f"the package part {name!r} does not inflate: {exc}") from exc
             else:

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/vba.py

@@ -892,6 +892,23 @@ class VBAModule:
         )
 
 
+#: Names the VBE will not give a module (VBComponents.Add fails with
+#: 0x800AC3D4), measured in 64-bit Excel 16.0 (issue #40), and refused by a
+#: rename too, which would make the same module.  A
+#: module so named still compiles, but code can never name it: ``Print.Hi``
+#: is a syntax error and ``Me.Hi`` an invalid use of Me.  Line, Width, Name,
+#: Err, Mid, Time, Error, Reset, Beep, Load and Unload are accepted.
+VBE_REFUSED_MODULE_NAMES = frozenset({
+    "circle", "pset", "scale", "print", "seek", "input", "get", "put", "open",
+    "tab", "spc", "debug", "me", "array", "lbound", "date", "stop",
+})
+
+
+def _check_module_name(name: str) -> None:
+    if name.casefold() in VBE_REFUSED_MODULE_NAMES:
+        raise ValueError(f"The VBE refuses {name!r} as a module name.")
+
+
 @dataclass
 class VBAProject:
     """Represents a parsed VBA project."""
@@ -963,8 +980,10 @@ class VBAProject:
         ``Attribute VB_Base`` ensured), so ``.cls`` files exported from
         the VBE are accepted as-is.  See :func:`normalize_class_source`.
 
-        Raises ``ValueError`` if a module with that name already exists.
+        Raises ``ValueError`` if a module with that name already exists, or
+        if the VBE refuses the name (see :data:`VBE_REFUSED_MODULE_NAMES`).
         """
+        _check_module_name(name)
         needle = name.casefold()
         if any(m.name.casefold() == needle for m in self.modules):
             raise ValueError(f"Module already exists: {name!r}")
@@ -1030,6 +1049,7 @@ class VBAProject:
         module = self.get_module(old_name)
         if module.name == new_name:
             return module
+        _check_module_name(new_name)
         needle = new_name.casefold()
         if needle != module.name.casefold() and any(
             m.name.casefold() == needle for m in self.modules

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/src/pyopenvba/word.py

@@ -5,6 +5,7 @@ Supports:
   - .docm  (OOXML macro-enabled document -- ZIP containing word/vbaProject.bin)
   - .dotm  (OOXML macro-enabled template -- ZIP containing word/vbaProject.bin)
   - .doc   (Legacy Word -- the entire file is a CFB)
+  - .dot   (Legacy template -- the .doc container; read only)
 
 Usage
 -----
@@ -25,7 +26,7 @@ from pathlib import Path
 from pyopenvba._host import VBAHostFile
 
 _ZIP_FORMATS = frozenset({".docm", ".dotm"})
-_CFB_FORMATS = frozenset({".doc"})
+_CFB_FORMATS = frozenset({".doc", ".dot"})
 _VBA_ENTRY = "word/vbaProject.bin"
 
 
@@ -46,6 +47,7 @@ class WordFile(VBAHostFile):
     _application = "Word"
     _project_storage = "Macros"
     _project_formats = frozenset({".docm"})
+    _read_only_formats = frozenset({".dot"})
     _main_part = "word/document.xml"
 
     # A new project, as Word makes one: ThisDocument, from the Normal

{pyopenvba-6.3.3 → pyopenvba-6.3.5}/tests/fuzz_corpus/README.md

@@ -19,11 +19,29 @@ crash, is treated as a fuzz regression.
 | `dir/` | `pyopenvba.vba._parse_dir_stream()` | `VBAProjectError`, `UnicodeDecodeError`, `IndexError`, `struct.error` |
 | `project/` | `pyopenvba.vba.parse_project_stream()` | `VBAProjectError`, `UnicodeDecodeError` |
 | `projectwm/` | `pyopenvba.vba.parse_projectwm()` | `VBAProjectError`, `UnicodeDecodeError` |
+| `mashup/` | `pyopenvba.powerquery._mashup.Mashup.parse()` | `PowerQueryError` |
+| `mformula/` | `pyopenvba.mlang._parse.parse()` | `MSyntaxError` |
 
 Each input file is **raw bytes** (extension is informational only;
 `.bin` by convention). Filenames should describe the seed, e.g.
 `empty.bin`, `truncated_header.bin`, `regression_2026_05_xxxx.bin`.
 
+## Coverage-guided fuzzing
+
+[`fuzz/fuzz_parsers.py`](../../fuzz/fuzz_parsers.py) runs each target under
+Atheris, seeded from its directory here, with the same acceptable
+exceptions. The Fuzz workflow runs every target daily and on each change to
+the parsers. To run one yourself on Linux with Python 3.12 or later:
+
+```
+python -m pip install --require-hashes -r .github/requirements/fuzz.txt
+python -m pip install --no-deps --no-build-isolation -e .
+python fuzz/fuzz_parsers.py decompress -max_total_time=60 tests/fuzz_corpus/decompress
+```
+
+A finding is written to a `crash-*` file. Minimise it, add it here as a
+regression seed, and fix the parser.
+
 ## Adding a new seed
 
 When a fuzz run discovers a new failure mode, drop the offending bytes