Excel 2003 DDE bug   

I have encountered a bug in the way Excel 2003 saves data passed to it
via DDE. The bug exists in Excel 2003 SP3 (build 11.8211.8202). It may
well have been introduced by SP3. The bug also affects Excel 2007 when
it saves spreadsheets in the older binary file format.

When Excel saves spreadsheets containing DDE links, it writes an
EXTERNNAME record (record type 0x23) containing a copy of the last
block of data received from the DDE link. If the size of this data is
large enough, it will also need to follow the EXTERNNAME record with
one or more CONTINUE records (0x3c), because the maximum size of a
record is 8228 bytes. Within these records, numeric values contained in
the data block take 9 bytes of storage each (a 0x01, followed by an 8
byte floating point representation).

The bug arises because Excel will attempt to store an additional 9 byte
field when there is only 8 bytes of space left in the EXTERNNAME (or
CONTINUE) records. Instead of storing this 9 byte field in the next
CONTINUE record, what results is an EXTERNNAME/CONTINUE record of
maximum size (8228 bytes), with a truncated (7 byte) floating point
representation at its end.

When Excel re-opens such a file, it will attempt to repair it. Often
this is successful, and the process happens so quickly that the user is
unaware that there is any problem. However, if there are a sufficient
number of corrupt EXTERNNAME/CONTINUE records, then the repair is not
successful, and large portions of the spreadsheet are lost.

This problem is entirely deterministic and reproducible. For example,
if Excel contains a DDE link named "server|topic!abcdef" consisting of
a column of 912 numeric values, this will result in an invalid
EXTERNNAME record. Taking into account the layout of the EXTERNNAME
record, this amount of data requires 8229 bytes of storage, and Excel
will not use a CONTINUE record for the last value, but will truncate it
instead. However, if the link name is changed to "server|topic!abcdefg"
(1 byte longer), this will require 8230 bytes to store, a CONTINUE
record will be used, and the EXTERNNAME record will be valid.

Chris Trengove

date: Thu, 12 Jun 2008 17:17:04 -0700   author:   Chris Trengove ail