Merge pull request #2686 from PHPOffice/Additional-Validations-for-Lookup-Arrays

Validate that lookup arrays are actually arrays

Author: Mark Baker

src/PhpSpreadsheet/Calculation/LookupRef/HLookup.php

@@ -32,9 +32,10 @@ public static function lookup($lookupValue, $lookupArray, $indexNumber, $notExac
         }
 
         $notExactMatch = (bool) ($notExactMatch ?? true);
-        $lookupArray = self::convertLiteralArray($lookupArray);
 
         try {
+            self::validateLookupArray($lookupArray);
+            $lookupArray = self::convertLiteralArray($lookupArray);
             $indexNumber = self::validateIndexLookup($lookupArray, $indexNumber);
         } catch (Exception $e) {
             return $e->getMessage();

src/PhpSpreadsheet/Calculation/LookupRef/LookupBase.php

@@ -7,6 +7,16 @@
 
 abstract class LookupBase
 {
+    /**
+     * @param mixed $lookup_array
+     */
+    protected static function validateLookupArray($lookup_array): void
+    {
+        if (!is_array($lookup_array)) {
+            throw new Exception(ExcelError::REF());
+        }
+    }
+
     protected static function validateIndexLookup(array $lookup_array, $index_number): int
     {
         // index_number must be a number greater than or equal to 1

src/PhpSpreadsheet/Calculation/LookupRef/VLookup.php

@@ -33,6 +33,7 @@ public static function lookup($lookupValue, $lookupArray, $indexNumber, $notExac
         $notExactMatch = (bool) ($notExactMatch ?? true);
 
         try {
+            self::validateLookupArray($lookupArray);
             $indexNumber = self::validateIndexLookup($lookupArray, $indexNumber);
         } catch (Exception $e) {
             return $e->getMessage();

tests/data/Calculation/LookupRef/VLOOKUP.php

@@ -24,6 +24,13 @@ function densityGrid(): array
         2,
         false,
     ],
+    [
+        '#REF!',
+        1,
+        'HELLO WORLD',
+        2,
+        false,
+    ],
     [
         100,
         1,