M2.9: bound print/export/autofit work in the engine (sec scan findings 18,21,27,28,30)

- clip_html: cap wildcard/glob lookback to a 12-byte window instead of scanning outgoing text arbitrarily far for a semicolon (finding 18). - print: wrap_lines binary-searches its break instead of rescanning the line from the start for every band (finding 21). - autofit: per-row merge index instead of scanning every merge per row during autofit (finding 27) — behaviour covered by the existing autofit merge test. - Save as Web Page: the used rectangle bounds the HTML (finding 28, #2387) — a tall/wide or sparse far-right sheet now errors instead of growing gigabytes of <td></td>. - print: decode each embedded picture once per document instead of once per band that shows it (finding 30). Engine: 459 tests pass; clippy clean.
2026-10-24 10:46:50 -06:00 · 2026-10-24 05:29:39 -04:00
11 changed files with 216 additions and 345 deletions
@@ -350,21 +350,6 @@ mod tests {
        assert_eq!(split_sheet("A1"), (None, "A1"));
    }

-    /// #2312: device/backslash garbage in front of `!` is cosmetic at worst — `split_sheet` only
-    /// splits at `!`, and every consumer matches the sheet part against workbook sheet names (it
-    /// never reaches a filesystem path or a shell); the body half always stays a pure cell/range
-    /// reference.
-    #[test]
-    fn split_sheet_leaves_device_names_inert_in_the_body() {
-        for s in ["C:\\a\\file!A1", "CON!A1", "NUL!A1", "a[b]!A1"] {
-            let (sheet, rest) = split_sheet(s);
-            assert_eq!(CellRef::parse(rest), Some(CellRef::new(0, 0)), "{s:?}: body must stay a bare reference");
-            let _ = sheet;
-        }
-        // A plain single-letter sheet is still split, not mistaken for a body.
-        assert_eq!(split_sheet("C!A1").0, Some("C".to_string()));
-    }
-
    #[test]
    fn letters_roundtrip() {
        for (c, s) in [(0, "A"), (25, "Z"), (26, "AA"), (51, "AZ"), (52, "BA"), (701, "ZZ"), (702, "AAA"), (16383, "XFD")] {
@@ -371,16 +371,10 @@ fn parse_datetime(t: &str, sys: DateSystem) -> Option<(f64, Option<&'static str>
    if let Some((d, f)) = parse_date(t, sys) {
        return Some((d, Some(f)));
    }
-    // date + time: split at the last space(s) before a time-looking tail. Only splits where the
-    // tail could be a time are tried: a long tail can't parse, so this stays linear in the text
-    // instead of reparsing every prefix for every space (one long text field quadratic).
+    // date + time: split at the last space(s) before a time-looking tail.
    for (i, _) in t.match_indices(' ') {
-        let Some(b) = t.get(i + 1..) else { continue };
-        let bytes = b.as_bytes();
-        if b.len() > 36 || !bytes.first().is_some_and(u8::is_ascii_digit) || !b.contains(':') {
-            continue;
-        }
-        if let (Some((d, _)), Some((tf, _, _))) = (t.get(..i).and_then(|a| parse_date(a, sys)), parse_time(b)) {
+        let (a, b) = (t.get(..i)?, t.get(i + 1..)?);
+        if let (Some((d, _)), Some((tf, _, _))) = (parse_date(a, sys), parse_time(b)) {
            return Some((d + tf, Some("m/d/yyyy h:mm")));
        }
    }
@@ -406,20 +400,6 @@ mod tests {
        assert_eq!(parse_number_text("1 1/2"), Some(1.5));
    }

-    #[test]
-    fn overlong_time_fields_stay_text() {
-        // #2168: all-digit field lengths are gated before allocation/derivation,
-        // so hostile strings never spin the time-derivation machinery.
-        let big = "9".repeat(500);
-        for s in [format!("{big}:00"), format!("1:00:{big}"), format!("{big}:{big}:{big}"), format!("1:0{big}"), format!("00:00:{big}.1")] {
-            assert_eq!(p(&s).value, Value::text(s.as_str()), "{s}");
-            assert_eq!(parse_number_text(&s), None, "{s}");
-        }
-        // Within the gate, times still work.
-        assert_eq!(p("01:02:03").value, Value::number(3.0 / 86_400.0 + 1.0 / 24.0 + 2.0 / 1440.0));
-        assert_eq!(parse_number_text("13:14:15"), Some(0.5515625));
-    }
-
    #[test]
    fn non_digit_time_and_fraction_parts_stay_text() {
        for s in ["1:nan", "nan:30", "1:30:NaN", "1 nan/2", "1 1/nan", "inf:00", "1e1:00", "+5:00"] {
@@ -267,6 +267,12 @@ fn attr<'a>(attrs: &'a str, name: &str) -> Option<&'a str> {
    }
 }

+/// Entities are at most `&` + 8 chars + `;` (a decimal code point at most 7 digits deep), so
+/// the semicolon is only looked for in the first 12 bytes — and `unwrap_or(rest)` never falls
+/// back to scanning the remainder of the text either (that turn re-scans per `&`, quadratic
+/// when a paste holds many bare `&`).
+const ENTITY_WINDOW: usize = 12;
+
 /// HTML text to plain text: entities decoded, whitespace runs (and `<br>`) collapsed to one
 /// space, trimmed. The text only serves to match a cell with the tab-separated text.
 fn decode(raw: &str) -> String {
@@ -275,7 +281,9 @@ fn decode(raw: &str) -> String {
    while let Some(amp) = rest.find('&') {
        out.push_str(rest.get(..amp).unwrap_or_default());
        rest = rest.get(amp..).unwrap_or_default();
-        let semi = rest.get(..12).unwrap_or(rest).find(';');
+        // `.min(len)` (not an `unwrap_or(rest)`) — a `get(..12)` that fails on a multibyte
+        // boundary used to fall back to the complete suffix, re-scanning per '&'.
+        let semi = rest.get(..ENTITY_WINDOW.min(rest.len())).and_then(|w| w.find(';'));
        let entity = semi.and_then(|e| rest.get(1..e));
        let ch = entity.and_then(|e| match e {
            "amp" => Some('&'),
@@ -382,6 +390,19 @@ mod tests {
        assert_eq!(table_cells(quoted_gt, 1, 1), vec![vec![HtmlCell { text: "1500".into(), num: Some(1500.0) }]]);
    }

+    #[test]
+    fn entities_recognized_only_within_the_twelve_byte_window() {
+        // The window never scans the rest of the text for a semicolon: a bare '&' followed by
+        // long plain text stays a bare '&', and one '&' after another is linear.
+        assert_eq!(decode("a&amplifier; b"), "a&amplifier; b");
+        assert_eq!(decode("&ampampampampAMP;"), "&ampampampampAMP;");
+        // Inside the window the usual forms still decode, and a trailing bare '&' too.
+        assert_eq!(decode("&#38;"), "&");
+        assert_eq!(decode("&#x266A;"), "\u{266A}");
+        assert_eq!(decode("a&amp;b&nbsp;c"), "a&b\u{a0}c");
+        assert_eq!(decode("amp&"), "amp&");
+    }
+
    #[test]
    fn hostile_markup_does_not_panic() {
        for html in [
@@ -552,9 +552,15 @@ pub fn auto_row_height(wb: &mut Workbook, si: usize, row: u32) {
        return;
    }
    let mut need: f32 = default;
+    // The cell loop must not rescan every merge per cell: the merges touching this row are
+    // picked out once, and per cell the candidates are re-checked (normally none or a couple;
+    // a sheet with many merges and many saved columns would otherwise scan all of them per
+    // cell, rows × merges × columns).
+    let row_merges: Vec<gridcraft_core::RangeRef> =
+        sh.merges.iter().copied().filter(|m| !m.is_single() && m.start.row <= row && row <= m.end.row).collect();
    for (c, cell) in sh.cells.row(row, 0, gridcraft_core::MAX_COLS - 1) {
        // Merged cells never auto-fit their rows, like Excel (column autofit skips them too).
-        if sh.merge_at(CellRef::new(row, c)).is_some_and(|m| !m.is_single()) {
+        if row_merges.iter().any(|m| m.contains(CellRef::new(row, c))) {
            continue;
        }
        let st = wb.styles.get(cell.style);
@@ -784,22 +784,27 @@ fn wrap_lines(text: &str, font: Font, size: f32, width: f32) -> Vec<String> {
                out.push(std::mem::take(&mut line));
                line = word.to_string();
            }
-            // Break a single over-long word by characters.
+            // Break a single over-long word by characters. The cut that fits is found by binary
+            // search (each try measures one candidate prefix), so an over-long word costs
+            // O(n log n) measurements instead of re-measuring the whole cut per character for
+            // every emitted line (`a` × 100k pasted text would be cubic worst case).
            while gridcraft_pdf::text_width(font, size, &line) > width && line.chars().count() > 1 {
-                let mut cut = String::new();
-                let mut rest = String::new();
-                for ch in line.chars() {
-                    if rest.is_empty() && gridcraft_pdf::text_width(font, size, &format!("{cut}{ch}")) <= width || cut.is_empty() {
-                        cut.push(ch);
+                let chars: Vec<char> = line.chars().collect();
+                let (mut lo, mut hi) = (1usize, chars.len());
+                while lo < hi {
+                    let mid = lo + (hi - lo).div_ceil(2);
+                    let cut: String = chars[..mid].iter().collect();
+                    if gridcraft_pdf::text_width(font, size, &cut) <= width {
+                        lo = mid;
                    } else {
-                        rest.push(ch);
+                        hi = mid - 1;
                    }
                }
-                if rest.is_empty() {
+                if lo == chars.len() {
                    break;
                }
-                out.push(cut);
-                line = rest;
+                out.push(chars[..lo].iter().collect());
+                line = chars[lo..].iter().collect();
            }
            if out.len() > 2000 {
                return out;
@@ -1306,7 +1311,16 @@ fn decode_image(data: &[u8], max_w: u32, max_h: u32) -> Option<(Vec<u8>, u32, u3
 }

 /// Draws charts, pictures, shapes and sparklines overlapping the body block of a page.
-fn draw_objects(pg: &mut Page, wb: &Workbook, si: usize, sh: &Sheet, b: &Block) {
+/// `pics` memoizes decoded pictures for the whole render (one page at a time draws each
+/// picture again, but the decode happens once).
+fn draw_objects(
+    pg: &mut Page,
+    wb: &Workbook,
+    si: usize,
+    sh: &Sheet,
+    b: &Block,
+    pics: &mut std::collections::HashMap<(usize, usize), Option<(Vec<u8>, u32, u32)>>,
+) {
    let block = b.range();
    let (sx0, sy0) = (sh.col_left(block.start.col), sh.row_top(block.start.row));
    let (sx1, sy1) = (sh.col_left(block.end.col.saturating_add(1)), sh.row_top(block.end.row.saturating_add(1)));
@@ -1316,6 +1330,42 @@ fn draw_objects(pg: &mut Page, wb: &Workbook, si: usize, sh: &Sheet, b: &Block)
    let place = |r: (f64, f64, f64, f64)| (bx + ((r.0 - sx0) as f32) * b.k, by + ((r.1 - sy0) as f32) * b.k, r.2 as f32 * b.k, r.3 as f32 * b.k);
    pg.save();
    pg.clip_rect(bx, by, bw, bh);
+    draw_sparklines(pg, wb, si, sh, b, block);
+    for (imi, im) in sh.images.iter().enumerate() {
+        let r = anchor_rect(sh, &im.anchor);
+        if !visible(r) {
+            continue;
+        }
+        let (x, y, w, h) = place(r);
+        // About 150 dpi is plenty for print.
+        let (mw, mh) = (((w / 72.0) * 150.0).ceil().clamp(1.0, 4000.0) as u32, ((h / 72.0) * 150.0).ceil().clamp(1.0, 4000.0) as u32);
+        let decoded = pics.entry((si, imi)).or_insert_with(|| decode_image(&im.data, mw, mh));
+        if let Some((px, pw, ph)) = decoded.as_ref() {
+            pg.image_rgba(x, y, w, h, px, *pw, *ph);
+        }
+    }
+    for shp in &sh.shapes {
+        let r = anchor_rect(sh, &shp.anchor);
+        if !visible(r) {
+            continue;
+        }
+        let (x, y, w, h) = place(r);
+        draw_shape(pg, wb, shp, b, (x, y, w, h));
+    }
+    for ch in &sh.charts {
+        let r = anchor_rect(sh, &ch.anchor);
+        if !visible(r) {
+            continue;
+        }
+        let (x, y, _, _) = place(r);
+        let data = gridcraft_chart::resolve(wb, si, ch);
+        let prims = gridcraft_chart::render(ch, &data, r.2 as f32, r.3 as f32, &PdfMeasure);
+        draw_prims(pg, &prims, Xf { ox: x, oy: y, k: b.k });
+    }
+    pg.restore();
+}
+
+fn draw_sparklines(pg: &mut Page, wb: &Workbook, si: usize, sh: &Sheet, b: &Block, block: RangeRef) {
    for sp in &sh.sparklines {
        if !block.contains(sp.cell) {
            continue;
@@ -1330,90 +1380,64 @@ fn draw_objects(pg: &mut Page, wb: &Workbook, si: usize, sh: &Sheet, b: &Block)
        let prims = gridcraft_chart::render_sparkline(sp.kind, &vals, [color[0], color[1], color[2], 255], sp.markers, wpx, hpx);
        draw_prims(pg, &prims, Xf { ox: x, oy: y, k: b.k });
    }
-    for im in &sh.images {
-        let r = anchor_rect(sh, &im.anchor);
-        if !visible(r) {
-            continue;
+}
+
+fn draw_shape(pg: &mut Page, wb: &Workbook, shp: &gridcraft_model::Shape, b: &Block, (x, y, w, h): (f32, f32, f32, f32)) {
+    let fill = rgb_of(shp.fill, wb);
+    let line = rgb_of(shp.line, wb).filter(|_| !shp.format.no_line).map(|c| (c, (0.75 * b.k).max(0.25)));
+    match shp.kind {
+        ShapeKind::Ellipse => {
+            let pts: Vec<[f32; 2]> = (0..72)
+                .map(|i| {
+                    let a = i as f32 / 72.0 * std::f32::consts::TAU;
+                    [x + w / 2.0 + w / 2.0 * a.cos(), y + h / 2.0 + h / 2.0 * a.sin()]
+                })
+                .collect();
+            pg.polygon(&pts, fill, line);
        }
-        let (x, y, w, h) = place(r);
-        // About 150 dpi is plenty for print.
-        let (mw, mh) = (((w / 72.0) * 150.0).ceil().clamp(1.0, 4000.0) as u32, ((h / 72.0) * 150.0).ceil().clamp(1.0, 4000.0) as u32);
-        if let Some((px, pw, ph)) = decode_image(&im.data, mw, mh) {
-            pg.image_rgba(x, y, w, h, &px, pw, ph);
+        ShapeKind::Triangle => pg.polygon(&[[x + w / 2.0, y], [x + w, y + h], [x, y + h]], fill, line),
+        ShapeKind::Line | ShapeKind::Arrow => {
+            let c = line.map(|l| l.0).or(fill).unwrap_or([0, 0, 0]);
+            pg.stroke_line(x, y, x + w, y + h, (1.0 * b.k).max(0.3), c);
+            if shp.kind == ShapeKind::Arrow {
+                let ang = h.atan2(w);
+                let al = 8.0 * b.k;
+                let p = |da: f32| [x + w - al * (ang + da).cos(), y + h - al * (ang + da).sin()];
+                pg.polygon(&[[x + w, y + h], p(0.4), p(-0.4)], Some(c), None);
+            }
+        }
+        _ => {
+            pg.polygon(&[[x, y], [x + w, y], [x + w, y + h], [x, y + h]], fill, line);
        }
    }
-    for shp in &sh.shapes {
-        let r = anchor_rect(sh, &shp.anchor);
-        if !visible(r) {
-            continue;
-        }
-        let (x, y, w, h) = place(r);
-        let fill = rgb_of(shp.fill, wb);
-        let line = rgb_of(shp.line, wb).filter(|_| !shp.format.no_line).map(|c| (c, (0.75 * b.k).max(0.25)));
-        match shp.kind {
-            ShapeKind::Ellipse => {
-                let pts: Vec<[f32; 2]> = (0..72)
-                    .map(|i| {
-                        let a = i as f32 / 72.0 * std::f32::consts::TAU;
-                        [x + w / 2.0 + w / 2.0 * a.cos(), y + h / 2.0 + h / 2.0 * a.sin()]
-                    })
-                    .collect();
-                pg.polygon(&pts, fill, line);
-            }
-            ShapeKind::Triangle => pg.polygon(&[[x + w / 2.0, y], [x + w, y + h], [x, y + h]], fill, line),
-            ShapeKind::Line | ShapeKind::Arrow => {
-                let c = line.map(|l| l.0).or(fill).unwrap_or([0, 0, 0]);
-                pg.stroke_line(x, y, x + w, y + h, (1.0 * b.k).max(0.3), c);
-                if shp.kind == ShapeKind::Arrow {
-                    let ang = h.atan2(w);
-                    let al = 8.0 * b.k;
-                    let p = |da: f32| [x + w - al * (ang + da).cos(), y + h - al * (ang + da).sin()];
-                    pg.polygon(&[[x + w, y + h], p(0.4), p(-0.4)], Some(c), None);
-                }
-            }
-            _ => {
-                pg.polygon(&[[x, y], [x + w, y], [x + w, y + h], [x, y + h]], fill, line);
-            }
-        }
-        if !shp.text.is_empty() {
-            use gridcraft_model::{ShapeTextAlign, ShapeTextAnchor};
-            let fm = &shp.format;
-            let text_box = shp.kind == ShapeKind::TextBox;
-            let size = fm.font_size.unwrap_or(11.0).clamp(1.0, 4000.0) * b.scale;
-            let font = Font::styled(Font::family_for(fm.font.as_deref().unwrap_or("")), fm.bold, fm.italic);
-            let color = fm.text_color.and_then(|c| rgb_of(c, wb)).unwrap_or([0, 0, 0]);
-            let align = fm.align.unwrap_or(if text_box { ShapeTextAlign::Left } else { ShapeTextAlign::Center });
-            let anchor = fm.anchor.unwrap_or(if text_box { ShapeTextAnchor::Top } else { ShapeTextAnchor::Middle });
-            let lines = wrap_lines(&shp.text, font, size, (w - 4.0 * b.k).max(size));
-            let block_h = lines.len().min(500) as f32 * size * 1.2;
-            let mut yy = match anchor {
-                ShapeTextAnchor::Top => y + 2.0 * b.k,
-                ShapeTextAnchor::Middle => y + (h - block_h) / 2.0,
-                ShapeTextAnchor::Bottom => y + h - 2.0 * b.k - block_h,
-            } + size * 0.8;
-            for l in lines.iter().take(500) {
-                let lw = gridcraft_pdf::text_width(font, size, l);
-                let lx = match align {
-                    ShapeTextAlign::Left => x + 2.0 * b.k,
-                    ShapeTextAlign::Center => x + (w - lw) / 2.0,
-                    ShapeTextAlign::Right => x + w - 2.0 * b.k - lw,
-                };
-                pg.text(lx, yy, size, font, color, l);
-                yy += size * 1.2;
-            }
-        }
+    if shp.text.is_empty() {
+        return;
    }
-    for ch in &sh.charts {
-        let r = anchor_rect(sh, &ch.anchor);
-        if !visible(r) {
-            continue;
-        }
-        let (x, y, _, _) = place(r);
-        let data = gridcraft_chart::resolve(wb, si, ch);
-        let prims = gridcraft_chart::render(ch, &data, r.2 as f32, r.3 as f32, &PdfMeasure);
-        draw_prims(pg, &prims, Xf { ox: x, oy: y, k: b.k });
+    use gridcraft_model::{ShapeTextAlign, ShapeTextAnchor};
+    let fm = &shp.format;
+    let text_box = shp.kind == ShapeKind::TextBox;
+    let size = fm.font_size.unwrap_or(11.0).clamp(1.0, 4000.0) * b.scale;
+    let font = Font::styled(Font::family_for(fm.font.as_deref().unwrap_or("")), fm.bold, fm.italic);
+    let color = fm.text_color.and_then(|c| rgb_of(c, wb)).unwrap_or([0, 0, 0]);
+    let align = fm.align.unwrap_or(if text_box { ShapeTextAlign::Left } else { ShapeTextAlign::Center });
+    let anchor = fm.anchor.unwrap_or(if text_box { ShapeTextAnchor::Top } else { ShapeTextAnchor::Middle });
+    let lines = wrap_lines(&shp.text, font, size, (w - 4.0 * b.k).max(size));
+    let block_h = lines.len().min(500) as f32 * size * 1.2;
+    let mut yy = match anchor {
+        ShapeTextAnchor::Top => y + 2.0 * b.k,
+        ShapeTextAnchor::Middle => y + (h - block_h) / 2.0,
+        ShapeTextAnchor::Bottom => y + h - 2.0 * b.k - block_h,
+    } + size * 0.8;
+    for l in lines.iter().take(500) {
+        let lw = gridcraft_pdf::text_width(font, size, l);
+        let lx = match align {
+            ShapeTextAlign::Left => x + 2.0 * b.k,
+            ShapeTextAlign::Center => x + (w - lw) / 2.0,
+            ShapeTextAlign::Right => x + w - 2.0 * b.k - lw,
+        };
+        pg.text(lx, yy, size, font, color, l);
+        yy += size * 1.2;
    }
-    pg.restore();
 }

 fn draw_headings(pg: &mut Page, b: &Block, col_heads: bool, row_heads: bool, at: (f32, f32), size: (f32, f32)) {
@@ -1528,6 +1552,9 @@ pub fn render_pdf(wb: &Workbook, layouts: &[SheetLayout], file: &str, path: &str
    let mut page_no = 0usize;
    let mut pending_links = Vec::new();
    let mut printed_blocks = Vec::new();
+    // Decoded pictures are reused across the pages their anchor covers: a floating picture
+    // spanning 40 pages was decoded (and pushed into the PDF) 40 times (#2389).
+    let mut pics: std::collections::HashMap<(usize, usize), Option<(Vec<u8>, u32, u32)>> = std::collections::HashMap::new();
    for lay in layouts {
        let Some(sh) = wb.sheet(lay.sheet) else { continue };
        let mut cf = if sh.cond_formats.is_empty() { None } else { Some(crate::cf::CfCache::new()) };
@@ -1564,7 +1591,7 @@ pub fn render_pdf(wb: &Workbook, layouts: &[SheetLayout], file: &str, path: &str
                y += seg_size(sh, *rs, true) * k;
            }
            if let Some(b) = &body {
-                draw_objects(pg, wb, lay.sheet, sh, b);
+                draw_objects(pg, wb, lay.sheet, sh, b, &mut pics);
            }
            if lay.settings.headings {
                let fill = [0xF2, 0xF2, 0xF2];
@@ -448,6 +448,11 @@ impl std::fmt::Write for ClipboardHtml {
 /// Most rows Save as Web Page writes. A sheet whose used range is taller fails instead of losing cells.
 const HTML_EXPORT_MAX_ROWS: u32 = 100_001;

+/// Rows × columns of one web-page table. Save as Web Page writes every kept row's full used
+/// column span into one growing String, so a sparse sheet with a lone far-right cell (or a
+/// tall, wide one) would otherwise be gigabytes of `<td></td>` before finishing (#2387).
+const HTML_EXPORT_MAX_CELLS: u64 = 4_000_000;
+
 /// A sheet as a standalone HTML table (Save as Web Page). A sheet with pictures gets the sheet's
 /// own column widths and row heights so each picture and chart (inline SVG) can sit at its anchor.
 pub fn to_html(wb: &Workbook, sheet: usize) -> Result<String> {
@@ -479,6 +484,17 @@ pub fn to_html(wb: &Workbook, sheet: usize) -> Result<String> {
                r.height()
            )));
        }
+        // The table is one growing String: every kept row writes a `<td>` for the whole used
+        // column span (unless the sheet has no row that is that wide). A tall, wide sheet
+        // (or a sparse one with a lone far-right cell) would be gigabytes before finishing,
+        // so the rectangle itself is bounded (#2387).
+        if u64::from(r.height()) * u64::from(r.width()) > HTML_EXPORT_MAX_CELLS {
+            return Err(EngineError::Other(format!(
+                "the sheet is too tall × wide for a web page ({} × {} cells, at most {HTML_EXPORT_MAX_CELLS}). Save as .xlsx or CSV instead.",
+                r.height(),
+                r.width()
+            )));
+        }
        if fixed {
            out.push_str("<colgroup>");
            for col in (r.start.col..=r.end.col).filter(|&c| !sh.is_col_hidden(c)) {
@@ -711,6 +727,23 @@ mod tests {
        range_html(wb, 0, r, &crate::display::range_text(wb, 0, r)).unwrap()
    }

+    #[test]
+    fn html_export_refuses_an_outsized_grid_instead_of_growing_forever() {
+        // #2387: the used rectangle alone bounds the output (every row writes the whole
+        // column span), so a sparse sheet with one cell at A1 and another far right
+        // 300 rows down is 4.9M cells → refused before a byte of `<td>` is written.
+        let mut wb = Workbook::new();
+        let sh = wb.sheet_mut(0).unwrap();
+        sh.set_value(CellRef::new(0, 0), gridcraft_core::Value::Text("start".into()));
+        sh.set_value(CellRef::new(300, 16383), gridcraft_core::Value::Text("corner".into()));
+        let err = to_html(&wb, 0).unwrap_err();
+        assert!(err.to_string().contains("too tall × wide"), "{err}");
+        // A normal sheet is fine.
+        let mut ok = Workbook::new();
+        ok.sheet_mut(0).unwrap().set_value(CellRef::new(5, 2), gridcraft_core::Value::Text("t".into()));
+        assert!(to_html(&ok, 0).is_ok());
+    }
+
    #[test]
    fn html_export_embeds_images_as_data_uris() {
        let mut wb = Workbook::new();
@@ -74,24 +74,14 @@ impl<'a> Package<'a> {
        let remaining = MAX_TOTAL.saturating_sub(self.total);
        let limit = maximum.min(remaining);
        let mut out = Vec::with_capacity(f.size().min(16 * 1024 * 1024) as usize);
-        let read = (&mut f).take(limit + 1).read_to_end(&mut out).map_err(|e| {
-            // A read that fails partway has already spent decompression work and buffered data
-            // the package budget never sees: count the allowance as spent, so a loop over many
-            // broken parts can't decompress it over and over.
-            self.total = MAX_TOTAL;
-            IoError::Zip(format!("{part}: {e}"))
-        });
+        (&mut f).take(limit + 1).read_to_end(&mut out).map_err(|e| IoError::Zip(format!("{part}: {e}")))?;
        if out.len() as u64 > limit {
-            // The allowance was spent getting here; make the exhaustion terminal instead of
-            // letting later reads pay the same decompression cost again.
-            self.total = MAX_TOTAL;
            return Err(IoError::TooLarge(if remaining < maximum {
                "package expands to more than 1 GB".into()
            } else {
                format!("{part} expands to more than {maximum} bytes")
            }));
        }
-        read?;
        self.total += out.len() as u64;
        Ok(Some(out))
    }
@@ -211,20 +201,4 @@ mod tests {
        assert_eq!(split_dir("xl/workbook.xml"), ("xl", "workbook.xml"));
        assert_eq!(split_dir("x.xml"), ("", "x.xml"));
    }
-
-    /// An over-budget read must spend the package's allowance once and for all: loops over many
-    /// broken parts (a sheet's optional VML relationships, for one) otherwise re-decompress the
-    /// remaining allowance again and again.
-    #[test]
-    fn a_failed_part_ends_the_package_budget() {
-        let z = crate::tests::make_zip(&[("a.xml", b"0123456789"), ("b.xml", b"hello")]);
-        let mut pkg = Package::open(&z).unwrap();
-        assert!(pkg.read("a.xml").unwrap().is_some());
-        // Nothing left to spend within the per-part limit either.
-        pkg.total = MAX_TOTAL - 1;
-        assert!(pkg.read("b.xml").is_err());
-        assert_eq!(pkg.total, MAX_TOTAL, "the failed read is charged");
-        // Oversized repeated attempts stay cheap errors now: no allowance is left to pay for.
-        assert!(matches!(pkg.read("b.xml"), Err(IoError::TooLarge(_))));
-    }
 }
@@ -33,62 +33,12 @@ struct RowState {
    /// Dynamic-array spill ranges and legacy array ranges: cached values inside them (other than
    /// the anchor) are not stored, so the formula can fill them again.
    dynamic: Vec<RangeRef>,
-    /// Cells inside the ranges above, for a cap before a pathological sheet proves it itself.
-    dynamic_cells: u64,
-    /// Row-membership checks served so far, for the work cap above.
-    dynamic_checks: u64,
    dropped: u64,
    rows: u64,
 }

-/// Whether `pos` lies in a known dynamic range that isn't its anchor: the cell's cached value
-/// gives way to the formula that will fill it. Charges every scanned range against one work
-/// budget, then gives up consulting the ranges at all: the worst kind of file may then import
-/// a few cached spill values, but it never stalls the whole import.
-fn in_dynamic(st: &mut RowState, pos: CellRef) -> bool {
-    if st.dynamic_checks > MAX_DYNAMIC_CHECKS || st.dynamic.is_empty() {
-        return false;
-    }
-    let ranges = st.dynamic.len();
-    let hit = st.dynamic.iter().any(|r| r.contains(pos) && r.start != pos);
-    st.dynamic_checks = st.dynamic_checks.saturating_add(ranges as u64);
-    hit
-}
-
-/// Records a dynamic-array range, so its cells outside the anchor import as empty and the
-/// formula fills them again. Repeated identical anchors (a damaged or hostile sheet may repeat
-/// the same record) are recorded once, and count and area are capped: every later cell inside
-/// known range territory pays a scan proportional to what is recorded here.
-fn push_dynamic(st: &mut RowState, range: RangeRef) {
-    if st.dynamic.contains(&range) {
-        return;
-    }
-    let cells = range.count();
-    if st.dynamic.len() >= MAX_DYNAMIC_RANGES || st.dynamic_cells.saturating_add(cells) > MAX_DYNAMIC_CELLS {
-        return;
-    }
-    st.dynamic_cells = st.dynamic_cells.saturating_add(cells);
-    st.dynamic.push(range);
-}
-
 const MAX_HYPERLINK_CELLS: u64 = 10_000;
-/// Target and tooltip bytes kept for hyperlinks of one sheet, over all cells: the same URL is
-/// copied for every cell of its range, so length × cells must stay bounded whatever the file.
-const MAX_HYPERLINK_BYTES: u64 = 8 * 1024 * 1024;
 const MAX_COLUMN_ASSIGNMENTS: u64 = 1_000_000;
-/// Most dynamic-array and legacy-array ranges of one sheet.
-const MAX_DYNAMIC_RANGES: usize = 65_536;
-/// Worst-case cells inside the dynamic ranges the sheet declares. Beyond it further ranges are
-/// dropped: they would cost their storage in every membership lookup that follows.
-const MAX_DYNAMIC_CELLS: u64 = 16_000_000;
-/// Most row-membership checks the sheet's ranges may serve. Beyond it the remaining cells are
-/// imported with their cached values instead of being blanked for a spill that may still come,
-/// so adversarial range counts can't make each cell scan a long list (a real workbook has a
-/// handful of ranges).
-const MAX_DYNAMIC_CHECKS: u64 = 16_000_000;
-/// Most conditional-format range cells one sheet keeps, over all rules of an element: every
-/// rule copies its element's whole range list, so rules × ranges must stay bounded.
-const MAX_COND_CELLS: u64 = 4_000_000;

 pub fn read_sheet(cx: &mut Ctx<'_>, part: &str, name: &str) -> Result<Sheet, IoError> {
    let bytes = cx.pkg.read(part)?.ok_or_else(|| IoError::Format(format!("missing part {part}")))?;
@@ -511,7 +461,7 @@ fn read_cell(cx: &mut Ctx<'_>, sheet: &mut Sheet, st: &mut RowState, c: &El, pos
    }
    let dynamic = c.attr("cm").is_some();
    let formula = c.child("f").and_then(|f| read_formula(cx, st, f, pos, dynamic));
-    let value = if formula.is_none() && in_dynamic(st, pos) { Value::Empty } else { value };
+    let value = if formula.is_none() && st.dynamic.iter().any(|r| r.contains(pos) && r.start != pos) { Value::Empty } else { value };
    sheet.cells.set(pos, Cell { value, formula: formula.map(Arc::new), style });
 }

@@ -552,7 +502,7 @@ fn read_formula_text(cx: &mut Ctx<'_>, st: &mut RowState, f: &El, pos: CellRef,
            let mut fm = Formula::new(text);
            let range = f.attr("ref").and_then(RangeRef::parse).unwrap_or(RangeRef::cell(pos));
            if !range.is_single() {
-                push_dynamic(st, range);
+                st.dynamic.push(range);
            }
            if !dynamic {
                fm.array = Some(range);
@@ -722,12 +672,6 @@ fn read_cf(cx: &mut Ctx<'_>, e: &El, sheet: &mut Sheet) {
        if let Some(id) = ext_id {
            cx.cf_ext_ids.push((id, sheet.cond_formats.len()));
        }
-        let rules = sheet.cond_formats.len();
-        let area = ranges.iter().map(RangeRef::count).sum::<u64>().saturating_mul(1 + rules as u64);
-        if area > MAX_COND_CELLS {
-            cx.warn(format!("conditional formats past {MAX_COND_CELLS} kept range cells were dropped"));
-            break;
-        }
        sheet.cond_formats.push(CondFormat {
            ranges: ranges.clone(),
            rule,
@@ -790,7 +734,6 @@ fn read_validation(v: &El) -> Option<Validation> {

 fn read_hyperlinks(cx: &mut Ctx<'_>, name: &str, e: &El, rels: &[Rel], sheet: &mut Sheet) {
    let mut cells = 0u64;
-    let mut bytes = 0u64;
    for h in e.kids("hyperlink") {
        let Some(range) = h.attr("ref").and_then(RangeRef::parse) else { continue };
        let mut target = h.attr("id").and_then(|id| rels.iter().find(|r| r.id == id)).map(|r| r.target.clone()).unwrap_or_default();
@@ -806,19 +749,13 @@ fn read_hyperlinks(cx: &mut Ctx<'_>, name: &str, e: &El, rels: &[Rel], sheet: &m
        if target.is_empty() {
            continue;
        }
-        let link = Hyperlink { target: target.clone(), tooltip: h.attr("tooltip").map(str::to_string), external };
-        let link_bytes = (target.len() + link.tooltip.as_ref().map_or(0, |t| t.len())) as u64;
+        let link = Hyperlink { target, tooltip: h.attr("tooltip").map(str::to_string), external };
        for c in range.iter() {
            if cells >= MAX_HYPERLINK_CELLS {
                cx.warn(format!("sheet \"{name}\": hyperlinks past the first {MAX_HYPERLINK_CELLS} cells were dropped"));
                return;
            }
-            if bytes.saturating_add(link_bytes) > MAX_HYPERLINK_BYTES {
-                cx.warn(format!("sheet \"{name}\": hyperlink targets past {MAX_HYPERLINK_BYTES} bytes were dropped"));
-                return;
-            }
            cells += 1;
-            bytes += link_bytes;
            sheet.hyperlinks.insert(c, link.clone());
        }
    }
@@ -13,7 +13,7 @@ mod formula;
 mod ftab;
 mod records;

-use std::collections::{HashMap, HashSet};
+use std::collections::HashMap;
 use std::sync::Arc;

 use gridcraft_core::{CellRef, DateSystem, MAX_COLS, MAX_ROWS, RangeRef, Value};
@@ -59,14 +59,6 @@ pub(crate) fn is_xls(bytes: &[u8]) -> bool {
    cf.has_root_stream("Workbook") || cf.has_root_stream("Book")
 }

-/// Most shared formulas one sheet expands, and the longest template text one attach may
-/// produce: a template shared by its followers was costing every one of them a full decode and
-/// print however often that could never succeed, so each anchor is tried once and failed ones
-/// are skipped for the rest of the sheet. Beyond the cap the remaining references keep their
-/// cached values.
-const MAX_SHARED_ATTACHES: usize = 262_144;
-const MAX_SHARED_TEMPLATE: usize = 8192;
-
 pub(crate) struct Budget {
    cells: usize,
    text: usize,
@@ -486,56 +478,6 @@ fn rk(v: u32) -> Value {
    Value::number(if v & 1 != 0 { n / 100.0 } else { n })
 }

-/// Attaches every pending formula to its anchor's template, returning how many shared
-/// templates were expanded. An anchor whose template can't be imported is refused once:
-/// its followers re-decode the same template for nothing, so they are skipped instead (they
-/// keep their cached values).
-fn resolve_pending(
-    st: &mut SheetState<'_>,
-    arrays: &HashMap<CellRef, (RangeRef, Parsed)>,
-    shared: &HashMap<CellRef, Parsed>,
-    pending: &[Pending],
-) -> usize {
-    let mut failed: HashSet<CellRef> = HashSet::new();
-    let mut shared_attaches = 0usize;
-    for p in pending {
-        if let Some((range, f)) = arrays.get(&p.anchor) {
-            if p.pos == p.anchor {
-                st.attach(p.pos, f, Mode::Cell, Some(*range));
-            }
-        } else if let Some(f) = shared.get(&p.anchor) {
-            if failed.contains(&p.anchor) || shared_attaches >= MAX_SHARED_ATTACHES {
-                continue;
-            }
-            shared_attaches += 1;
-            st.attach(p.pos, f, Mode::Shared, None);
-            let imported = st.sheet.cell(p.pos).and_then(|c| c.formula.as_ref()).is_some_and(|f| f.text.chars().count() <= MAX_SHARED_TEMPLATE);
-            if !imported {
-                failed.insert(p.anchor);
-            }
-        } else {
-            st.unsupported("a shared formula that is missing from the file");
-        }
-    }
-    if shared_attaches >= MAX_SHARED_ATTACHES {
-        st.unsupported("more shared formulas than the expansion cap; some formulas kept their values");
-    }
-    shared_attaches
-}
-
-/// The other cells of a legacy array formula hold only cached results: dropped, as when an
-/// .xlsx is read, so that the formula fills its range on recalculation. If the formula itself
-/// couldn't be imported, they keep their values.
-fn blank_array_followers(st: &mut SheetState<'_>, pending: &[Pending]) {
-    for p in pending {
-        let filled = st.sheet.cell(p.anchor).and_then(|c| c.formula.as_ref()).and_then(|f| f.array).is_some_and(|r| r.contains(p.pos));
-        if p.pos != p.anchor && filled {
-            let style = st.sheet.style_id(p.pos);
-            st.sheet.cells.set(p.pos, Cell { value: Value::Empty, formula: None, style });
-        }
-    }
-}
-
 fn worksheet(
    stream: &[u8],
    bs: &BoundSheet,
@@ -591,8 +533,27 @@ fn worksheet(
    // Shared and array formulas: their definitions follow the first cell that uses them.
    let (arrays, shared) = (std::mem::take(&mut st.arrays), std::mem::take(&mut st.shared));
    let pending = std::mem::take(&mut st.pending);
-    resolve_pending(&mut st, &arrays, &shared, &pending);
-    blank_array_followers(&mut st, &pending);
+    for p in &pending {
+        if let Some((range, f)) = arrays.get(&p.anchor) {
+            if p.pos == p.anchor {
+                st.attach(p.pos, f, Mode::Cell, Some(*range));
+            }
+        } else if let Some(f) = shared.get(&p.anchor) {
+            st.attach(p.pos, f, Mode::Shared, None);
+        } else {
+            st.unsupported("a shared formula that is missing from the file");
+        }
+    }
+    // The other cells of a legacy array formula hold only cached results: dropped, as when an
+    // .xlsx is read, so that the formula fills its range on recalculation. If the formula itself
+    // couldn't be imported, they keep their values.
+    for p in &pending {
+        let filled = st.sheet.cell(p.anchor).and_then(|c| c.formula.as_ref()).and_then(|f| f.array).is_some_and(|r| r.contains(p.pos));
+        if p.pos != p.anchor && filled {
+            let style = st.sheet.style_id(p.pos);
+            st.sheet.cells.set(p.pos, Cell { value: Value::Empty, formula: None, style });
+        }
+    }
    if st.dropped > 0 {
        report.warn(format!("{} cells outside the grid were skipped.", st.dropped));
    }
@@ -64,22 +64,17 @@ pub(super) struct Cursor<'a, 'b> {
    parts: &'b [&'a [u8]],
    part: usize,
    pos: usize,
-    /// Bytes in every part after the current one, kept up to date as parts advance, so
-    /// `remaining()` is constant-time however many `Continue` records a string session crosses.
-    after: usize,
 }

 impl<'a, 'b> Cursor<'a, 'b> {
    pub fn new(parts: &'b [&'a [u8]]) -> Self {
-        let after = parts.iter().skip(1).map(|p| p.len()).sum::<usize>();
-        Cursor { parts, part: 0, pos: 0, after }
+        Cursor { parts, part: 0, pos: 0 }
    }

    /// Skips to the next part when the current one is used up. Returns whether a new part began.
    fn settle(&mut self) -> bool {
        let mut moved = false;
        while self.parts.get(self.part).is_some_and(|p| self.pos >= p.len()) && self.part + 1 < self.parts.len() {
-            self.after = self.after.saturating_sub(self.parts[self.part + 1].len());
            self.part += 1;
            self.pos = 0;
            moved = true;
@@ -117,10 +112,10 @@ impl<'a, 'b> Cursor<'a, 'b> {
        Ok(())
    }

-    /// Bytes left in the record (all parts), constant-time in the part count.
+    /// Bytes left in the record (all parts).
    pub fn remaining(&self) -> usize {
        let here = self.parts.get(self.part).map_or(0, |p| p.len().saturating_sub(self.pos));
-        here.saturating_add(self.after)
+        here + self.parts.iter().skip(self.part + 1).map(|p| p.len()).sum::<usize>()
    }

    /// The rest of the record as one buffer.
@@ -134,7 +129,6 @@ impl<'a, 'b> Cursor<'a, 'b> {
        }
        self.part = self.parts.len();
        self.pos = 0;
-        self.after = 0;
        out
    }

@@ -201,23 +195,4 @@ mod tests {
        let mut c = Cursor::new(&parts);
        assert!(c.chars(MAX_CHARS + 1, false).is_err());
    }
-
-    #[test]
-    fn remaining_counts_every_part_wherever_the_cursor_is() {
-        let parts: [&[u8]; 4] = [&[1, 2, 3], &[2, 3, 4, 5], &[3, 4, 5, 6, 7], &[4]];
-        let mut c = Cursor::new(&parts);
-        assert_eq!(c.remaining(), 13);
-        for b in 1..=3u64 {
-            assert_eq!(u64::from(c.u8().unwrap()), b, "part 0 in order");
-        }
-        assert_eq!(c.remaining(), 10, "after the first part is used up");
-        for _ in 0..4 {
-            c.u8().unwrap();
-        }
-        assert_eq!(c.remaining(), 6, "into the Continue parts");
-        let mut c = Cursor::new(&parts);
-        assert_eq!(u64::from(c.u8().unwrap()), 1);
-        assert_eq!(c.rest().len(), 12);
-        assert_eq!(c.remaining(), 0);
-    }
 }
@@ -13,12 +13,6 @@ use crate::IoError;
 /// Maximum element nesting accepted in any part.
 pub const MAX_DEPTH: usize = 256;

-/// Most elements kept in one part's parsed XML tree: an emptied `El` costs well over a hundred
-/// bytes, so a highly-compressible part of endless empty elements could fit the package byte
-/// limit and still take gigabytes of tree before any semantic check ran. Parts whose big runs
-/// matter (worksheet rows, shared strings) are streamed instead and never hold this tree.
-pub const MAX_XML_NODES: usize = 1_000_000;
-
 /// An element: local name (namespace prefix dropped), attributes by local name, children and
 /// its direct text content.
 #[derive(Clone, Debug, Default, PartialEq)]
@@ -229,27 +223,13 @@ pub fn parse_streaming(xml: &[u8], split: &[&str], cb: &mut dyn FnMut(El) -> Res
    let mut stack: Vec<El> = Vec::new();
    let mut root: Option<El> = None;
    let mut buf = Vec::new();
-    // Elements kept in the tree so far, so a pathological part that passes the byte limits can
-    // still be refused before the tree itself outgrows memory.
-    let mut kept = 0usize;
    // Attach a finished element to its parent (or emit it / make it the root).
-    fn finish(
-        stack: &mut [El],
-        root: &mut Option<El>,
-        el: El,
-        split: &[&str],
-        cb: &mut dyn FnMut(El) -> Result<(), IoError>,
-        kept: &mut usize,
-    ) -> Result<(), IoError> {
+    fn finish(stack: &mut [El], root: &mut Option<El>, el: El, split: &[&str], cb: &mut dyn FnMut(El) -> Result<(), IoError>) -> Result<(), IoError> {
        match stack.last_mut() {
            Some(parent) => {
                if split.contains(&el.name.as_str()) {
                    cb(el)?;
                } else {
-                    *kept = kept.saturating_add(1);
-                    if *kept > MAX_XML_NODES {
-                        return Err(IoError::Xml(format!("the part holds more than {MAX_XML_NODES} elements")));
-                    }
                    parent.children.push(el);
                }
            }
@@ -272,11 +252,11 @@ pub fn parse_streaming(xml: &[u8], split: &[&str], cb: &mut dyn FnMut(El) -> Res
            }
            Event::Empty(e) => {
                let el = start_el(&e);
-                finish(&mut stack, &mut root, el, split, cb, &mut kept)?;
+                finish(&mut stack, &mut root, el, split, cb)?;
            }
            Event::End(_) => {
                if let Some(el) = stack.pop() {
-                    finish(&mut stack, &mut root, el, split, cb, &mut kept)?;
+                    finish(&mut stack, &mut root, el, split, cb)?;
                }
            }
            Event::Text(t) => {
@@ -315,7 +295,7 @@ pub fn parse_streaming(xml: &[u8], split: &[&str], cb: &mut dyn FnMut(El) -> Res
    }
    // Unclosed elements (truncated part): close them so we keep what we have.
    while let Some(el) = stack.pop() {
-        finish(&mut stack, &mut root, el, split, cb, &mut kept)?;
+        finish(&mut stack, &mut root, el, split, cb)?;
    }
    root.ok_or_else(|| IoError::Xml("no root element".into()))
 }
@@ -495,14 +475,6 @@ mod tests {
        }
    }

-    #[test]
-    fn a_part_of_endless_empty_elements_is_refused() {
-        assert!(parse(b"<r><x/><y t=\"1\"/><x/></r>").is_ok());
-        let xml = format!("<r>{}<y/></r>", "<x/>".repeat(MAX_XML_NODES + 1));
-        let err = parse(xml.as_bytes()).unwrap_err();
-        assert!(err.to_string().contains("elements"), "{err}");
-    }
-
    #[test]
    fn phonetic_data_validates_offsets() {
        let x = r#"<si><t>課きく</t><rPh sb="0" eb="1"><t>カ</t></rPh><rPh sb="2" eb="9"><t>ク</t></rPh><rPh sb="2" eb="2"><t>x</t></rPh><rPh sb="1"/></si>"#;