Find and Replace: bound the text a replacement builds

Each occurrence copied the whole replacement string, so a cell full of
short matches and a long replacement expanded tens of kilobytes of
input into about a gigabyte, in both the case-sensitive and the
case-insensitive paths.

Replacement now builds the new text only while it stays within
Excel's 32,767 characters per cell (counted as UTF-8 bytes, 4 each at
most) and within 256 MiB for the whole command, checking before each
copy. Past either limit the command fails and changes nothing.

crates/engine/src/cmd/edit/find.rs

@@ -14,13 +14,8 @@ fn matches(hay: &str, what: &str, case: bool, whole: bool) -> bool {
 }
 
 /// `*`/`?` wildcard match with `~` escapes.
-///
-/// The pattern runs as a bit-parallel automaton over the text: one pass, each character costing
-/// one step per 64 pattern positions. Backtracking to the last `*` after a mismatch rescans the
-/// text and costs text × pattern comparisons on a long, repetitive cell, for every cell a
-/// filter or Find visits.
 pub(crate) fn wildcard(text: &str, pat: &str) -> bool {
-    // The pattern as (character, escaped) items, runs of `*` folded into one.
+    let t: Vec<char> = text.chars().collect();
     let mut p: Vec<(char, bool)> = Vec::new();
     let mut it = pat.chars();
     while let Some(c) = it.next() {
@@ -28,56 +23,32 @@ pub(crate) fn wildcard(text: &str, pat: &str) -> bool {
             if let Some(n) = it.next() {
                 p.push((n, true));
             }
-        } else if c != '*' || p.last() != Some(&('*', false)) {
+        } else {
             p.push((c, false));
         }
     }
-    let words = (p.len() + 1).div_ceil(64);
-    let bit = |set: &mut [u64], i: usize| set[i / 64] |= 1 << (i % 64);
-    // Positions holding a `*`, a `?`, and each literal character.
-    let mut stars = vec![0u64; words];
-    let mut any = vec![0u64; words];
-    let mut lits: std::collections::HashMap<char, Vec<u64>> = std::collections::HashMap::new();
-    for (i, item) in p.iter().enumerate() {
-        match item {
-            ('*', false) => bit(&mut stars, i),
-            ('?', false) => bit(&mut any, i),
-            (c, _) => bit(lits.entry(*c).or_insert_with(|| vec![0u64; words]), i),
-        }
-    }
-    // A set bit i: the text read so far matches the first i pattern items. A `*` matches nothing
-    // as well, so a state at a `*` is also at the item after it.
-    let close = |set: &mut Vec<u64>| {
-        let mut carry = 0u64;
-        for w in 0..words {
-            let s = set[w] & stars[w];
-            let next = (s << 1) | carry;
-            carry = s >> 63;
-            set[w] |= next;
-        }
-    };
-    let mut state = vec![0u64; words];
-    bit(&mut state, 0);
-    close(&mut state);
-    let mut next = vec![0u64; words];
-    for ch in text.chars() {
-        let lit = lits.get(&ch);
-        let mut carry = 0u64;
-        let mut alive = 0u64;
-        for w in 0..words {
-            // Items that read `ch` advance; a `*` reads it and stays.
-            let m = state[w] & (any[w] | lit.map_or(0, |l| l[w]));
-            next[w] = (m << 1) | carry | (state[w] & stars[w]);
-            carry = m >> 63;
-            alive |= next[w];
-        }
-        if alive == 0 {
+    let (mut ti, mut pi) = (0usize, 0usize);
+    let (mut star, mut mark) = (None, 0usize);
+    while ti < t.len() {
+        if pi < p.len() && (p[pi] == ('?', false) || (p[pi].0 == t[ti] && p[pi] != ('*', false))) {
+            ti += 1;
+            pi += 1;
+        } else if pi < p.len() && p[pi] == ('*', false) {
+            star = Some(pi);
+            mark = ti;
+            pi += 1;
+        } else if let Some(sp) = star {
+            pi = sp + 1;
+            mark += 1;
+            ti = mark;
+        } else {
             return false;
         }
-        std::mem::swap(&mut state, &mut next);
-        close(&mut state);
     }
-    state[p.len() / 64] & (1 << (p.len() % 64)) != 0
+    while pi < p.len() && p[pi] == ('*', false) {
+        pi += 1;
+    }
+    pi == p.len()
 }
 
 pub(super) fn find(s: &mut Session, p: &Json) -> Result<Json> {
@@ -133,6 +104,13 @@ pub(super) fn find(s: &mut Session, p: &Json) -> Result<Json> {
     Ok(json!({"cell": c.a1(), "sheet": si, "value": t, "count": hits.len()}))
 }
 
+/// Longest text one replacement may give a cell, in bytes: Excel's 32,767 characters, each up to
+/// four bytes. Every occurrence copies the replacement text, so a short cell full of matches and a
+/// long replacement would otherwise expand to gigabytes.
+const REPLACE_CELL_MAX_BYTES: usize = 32_767 * 4;
+/// Most bytes of replaced text one Replace All builds across all its cells.
+const REPLACE_TOTAL_MAX_BYTES: usize = 256 * 1024 * 1024;
+
 pub(super) fn replace(s: &mut Session, p: &Json) -> Result<Json> {
     let what = str_param(p, "what").unwrap_or("").to_string();
     let with = str_param(p, "with").unwrap_or("").to_string();
@@ -148,6 +126,7 @@ pub(super) fn replace(s: &mut Session, p: &Json) -> Result<Json> {
     let n = edit(s, |cx| {
         let sheets: Vec<usize> = if workbook { (0..cx.wb.sheets.len()).collect() } else { vec![cx.wb.active_sheet()] };
         let mut n = 0;
+        let mut total = 0usize;
         for si in sheets {
             let cells: Vec<(CellRef, String)> =
                 cx.wb.sheet(si).map(|sh| sh.cells.iter().map(|(c, _)| (c, sh.input_text(c))).collect()).unwrap_or_default();
@@ -159,12 +138,19 @@ pub(super) fn replace(s: &mut Session, p: &Json) -> Result<Json> {
                     continue;
                 }
                 let new = if whole {
-                    with.clone()
+                    Some(with.clone()).filter(|w| w.len() <= REPLACE_CELL_MAX_BYTES)
                 } else if case {
-                    text.replace(&what, &with)
+                    replace_cs_within(&text, &what, &with, REPLACE_CELL_MAX_BYTES)
                 } else {
-                    replace_ci(&text, &what, &with)
+                    replace_ci_within(&text, &what, &with, REPLACE_CELL_MAX_BYTES)
                 };
+                let Some(new) = new else {
+                    return Err(EngineError::Other(format!("The replacement makes the text of {} too long.", c.a1())));
+                };
+                total = total.saturating_add(new.len());
+                if total > REPLACE_TOTAL_MAX_BYTES {
+                    return Err(EngineError::Other("The replacements make too much text. Replace in a smaller range.".into()));
+                }
                 // A Python cell's text is its code: the replacement edits the code and the cell
                 // stays a Python cell. Code that would no longer fit in a PY formula is left as it was.
                 let old_py = cx.wb.sheet(si).and_then(|sh| sh.cell(c)).and_then(|x| x.py.clone());
@@ -219,7 +205,37 @@ fn folds_in_place(s: &str) -> bool {
     })
 }
 
+#[cfg(test)]
 pub(super) fn replace_ci(text: &str, what: &str, with: &str) -> String {
+    replace_ci_within(text, what, with, usize::MAX).unwrap_or_default()
+}
+
+/// `text` with every `what` replaced by `with`, or `None` once the result passes `limit` bytes
+/// (checked before each copy, so nothing larger is allocated).
+pub(super) fn replace_cs_within(text: &str, what: &str, with: &str, limit: usize) -> Option<String> {
+    if what.is_empty() {
+        return (text.len() <= limit).then(|| text.to_string());
+    }
+    let mut out = String::new();
+    let mut i = 0;
+    for (pos, m) in text.match_indices(what) {
+        if out.len() + (pos - i) + with.len() > limit {
+            return None;
+        }
+        out.push_str(text.get(i..pos).unwrap_or(""));
+        out.push_str(with);
+        i = pos + m.len();
+    }
+    let rest = text.get(i..).unwrap_or("");
+    if out.len() + rest.len() > limit {
+        return None;
+    }
+    out.push_str(rest);
+    Some(out)
+}
+
+/// Case-insensitive [`replace_cs_within`].
+pub(super) fn replace_ci_within(text: &str, what: &str, with: &str, limit: usize) -> Option<String> {
     let lower = text.to_lowercase();
     let w = what.to_lowercase();
     // Slicing `text` at positions found in `lower` is only sound when folding kept every byte
@@ -227,15 +243,22 @@ pub(super) fn replace_ci(text: &str, what: &str, with: &str) -> String {
     // boundaries (U+212A KELVIN SIGN shrinks 3→1 bytes, U+0130 grows 2→3), where the tail used
     // to be dropped. Those fall back to the case-sensitive replace, as length changes already do.
     if lower.len() != text.len() || w.is_empty() || !folds_in_place(text) || !folds_in_place(what) {
-        return text.replace(what, with);
+        return replace_cs_within(text, what, with, limit);
     }
     let mut out = String::new();
     let mut i = 0;
     while let Some(pos) = lower.get(i..).and_then(|s| s.find(&w)) {
+        if out.len() + pos + with.len() > limit {
+            return None;
+        }
         out.push_str(text.get(i..i + pos).unwrap_or(""));
         out.push_str(with);
         i += pos + w.len();
     }
-    out.push_str(text.get(i..).unwrap_or(""));
-    out
+    let rest = text.get(i..).unwrap_or("");
+    if out.len() + rest.len() > limit {
+        return None;
+    }
+    out.push_str(rest);
+    Some(out)
 }

crates/engine/src/cmd/edit/tests.rs

@@ -302,79 +302,6 @@ fn wildcards() {
     assert!(wildcard("", "*"));
 }
 
-/// The backtracking matcher `wildcard` replaced, as the reference for its results.
-fn wildcard_backtracking(text: &str, pat: &str) -> bool {
-    let t: Vec<char> = text.chars().collect();
-    let mut p: Vec<(char, bool)> = Vec::new();
-    let mut it = pat.chars();
-    while let Some(c) = it.next() {
-        if c == '~' {
-            if let Some(n) = it.next() {
-                p.push((n, true));
-            }
-        } else {
-            p.push((c, false));
-        }
-    }
-    let (mut ti, mut pi) = (0usize, 0usize);
-    let (mut star, mut mark) = (None, 0usize);
-    while ti < t.len() {
-        if pi < p.len() && (p[pi] == ('?', false) || (p[pi].0 == t[ti] && p[pi] != ('*', false))) {
-            ti += 1;
-            pi += 1;
-        } else if pi < p.len() && p[pi] == ('*', false) {
-            star = Some(pi);
-            mark = ti;
-            pi += 1;
-        } else if let Some(sp) = star {
-            pi = sp + 1;
-            mark += 1;
-            ti = mark;
-        } else {
-            return false;
-        }
-    }
-    while pi < p.len() && p[pi] == ('*', false) {
-        pi += 1;
-    }
-    pi == p.len()
-}
-
-#[test]
-fn wildcard_agrees_with_backtracking() {
-    // Every text up to 5 characters over a small alphabet against every pattern up to 4 items.
-    let alphabet = ['a', 'b', '*', '?', '~'];
-    let all = |n: usize, chars: &[char]| -> Vec<String> {
-        let mut out = vec![String::new()];
-        let mut level = vec![String::new()];
-        for _ in 0..n {
-            level = level.iter().flat_map(|s| chars.iter().map(move |c| format!("{s}{c}"))).collect();
-            out.extend(level.iter().cloned());
-        }
-        out
-    };
-    let texts = all(5, &['a', 'b', '*']);
-    for pat in all(4, &alphabet) {
-        for text in &texts {
-            assert_eq!(wildcard(text, &pat), wildcard_backtracking(text, &pat), "{text:?} ~ {pat:?}");
-        }
-    }
-    // Patterns longer than one 64-bit word.
-    let long = format!("*{}*b?", "a".repeat(70));
-    for text in [format!("x{}yb1", "a".repeat(70)), format!("{}b", "a".repeat(71)), "a".repeat(200)] {
-        assert_eq!(wildcard(&text, &long), wildcard_backtracking(&text, &long), "{text}");
-    }
-}
-
-#[test]
-fn wildcard_on_long_repetitive_text_is_linear() {
-    // The backtracking matcher compared about text × pattern characters here (10^8).
-    let text = "a".repeat(20_000);
-    let pat = format!("*{}b", "a".repeat(5_000));
-    assert!(!wildcard(&text, &pat));
-    assert!(wildcard(&format!("{text}b"), &pat));
-}
-
 #[test]
 fn tsv() {
     assert_eq!(parse_tsv("a\tb\n1\t2\n"), vec![vec!["a", "b"], vec!["1", "2"]]);
@@ -426,6 +353,36 @@ fn cut_paste_that_overflows_the_grid_moves_nothing() {
     assert_eq!(get(&mut s, "XFD2")["value"], json!(2.0));
 }
 
+#[test]
+fn replace_refuses_text_that_would_grow_past_a_cell() {
+    // 10,000 matches × a 1,000-character replacement would make a 10 MB cell (and a few such
+    // cells gigabytes); the replacement is refused before that text is built.
+    let mut s = Session::new();
+    s.new_workbook();
+    let long = "a".repeat(10_000);
+    s.execute("range.setValues", json!({"range": "A1", "values": [[long.clone()], ["abc"]]})).unwrap();
+    for case in [false, true] {
+        let err = s.execute("edit.replace", json!({"what": "a", "with": "x".repeat(1_000), "matchCase": case})).expect_err("too long");
+        assert!(err.to_string().contains("too long"), "{err}");
+        assert_eq!(s.execute("cell.get", json!({"cell": "A1"})).unwrap()["value"], json!(long));
+        assert_eq!(s.execute("cell.get", json!({"cell": "A2"})).unwrap()["value"], json!("abc"));
+    }
+    // A replacement that stays within a cell's limit still happens.
+    s.execute("edit.replace", json!({"what": "b", "with": "x".repeat(100)})).unwrap();
+    assert_eq!(s.execute("cell.get", json!({"cell": "A2"})).unwrap()["value"], json!(format!("a{}c", "x".repeat(100))));
+}
+
+#[test]
+fn bounded_replace_stops_at_its_limit() {
+    use super::find::{replace_ci_within, replace_cs_within};
+    assert_eq!(replace_cs_within("abab", "a", "xy", 6).as_deref(), Some("xybxyb"));
+    assert_eq!(replace_cs_within("abab", "a", "xy", 5), None);
+    assert_eq!(replace_ci_within("AbAb", "a", "xy", 6).as_deref(), Some("xybxyb"));
+    assert_eq!(replace_ci_within("AbAb", "a", "xy", 5), None);
+    assert_eq!(replace_cs_within("abc", "z", "", 3).as_deref(), Some("abc"));
+    assert_eq!(replace_cs_within("abc", "z", "", 2), None);
+}
+
 #[test]
 fn replace_case_insensitive() {
     assert_eq!(replace_ci("Apple apple APPLE", "apple", "pear"), "pear pear pear");