From 1ab9e60d884eae96baf42411235a7b5cb0017586 Mon Sep 17 00:00:00 2001
From: NetterSilver <133535268+Silvertree2010@users.noreply.github.com>
Date: Thu, 15 Oct 2026 12:59:36 +0000
Subject: [PATCH] Reject formula number literals too large for f64 as parse
 errors

Found while testing crates/formula/src/lexer.rs:258

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 crates/formula/src/lexer.rs | 3 +++
 crates/formula/src/tests.rs | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/crates/formula/src/lexer.rs b/crates/formula/src/lexer.rs
index 4c41d3609..f85fcde93 100644
--- a/crates/formula/src/lexer.rs
+++ b/crates/formula/src/lexer.rs
@@ -260,6 +260,9 @@ pub fn tokenize_locale(src: &str, locale: crate::FormulaLocale) -> Result<Vec<To
                     .replace(locale.decimal_separator(), ".")
                     .parse()
                     .map_err(|_| LexError { msg: format!("bad number `{text}`"), pos: start })?;
+                if !v.is_finite() {
+                    return Err(LexError { msg: format!("number too large `{text}`"), pos: start });
+                }
                 push(&mut out, Tok::Number(v), j);
                 i = j;
             }
diff --git a/crates/formula/src/tests.rs b/crates/formula/src/tests.rs
index d23eba0e2..3f488bdc7 100644
--- a/crates/formula/src/tests.rs
+++ b/crates/formula/src/tests.rs
@@ -401,3 +401,11 @@ fn formulas_longer_than_excel_allows_are_refused() {
     assert!(text.len() > crate::MAX_FORMULA_LEN);
     assert!(parse(&text).is_ok());
 }
+
+#[test]
+fn number_literal_too_large_for_f64_is_a_parse_error() {
+    for bad in ["1E+400", "-1E+400", "1E+400*A1", "SUM(1E309,1)", "9".repeat(400).as_str()] {
+        assert!(parse(bad).is_err(), "{bad} should fail");
+    }
+    assert!(parse("1E+308").is_ok());
+}