Bug 49666

Summary: CRASH while opening RTF document
Product: LibreOffice Reporter: opensuse.lietuviu.kalba
Component: WriterAssignee: Miklos Vajna <vmiklos>
Status: RESOLVED FIXED    
Severity: critical CC: dtardon, serval2412
Priority: high    
Version: 3.5.3 release   
Hardware: Other   
OS: All   
Whiteboard: BSA target:4.2.0
Crash report or crash signature: Regression By:
Attachments: rtf document, causing CRASH
bt with symbols + console message
Bug 49666 - WinDbg session
RTF file containing image data and tables, with internal positioning and scaling control data.

Description opensuse.lietuviu.kalba 2012-05-08 22:15:00 UTC
Created attachment 61265 [details]
rtf document, causing CRASH

Problem description: 
Immediate crash in opening RTF document.

Steps to reproduce:
1. Try open attached file

Current behavior:
crash

Expected behavior:
Document is opened

Platform (if different from the browser): 
              
Browser: Mozilla/5.0 (X11; Linux x86_64; rv:12.0) Gecko/20100101 Firefox/12.0
Comment 1 Julien Nabet 2012-05-09 13:22:03 UTC
Created attachment 61305 [details]
bt with symbols + console message

On pc Debian x86-64, I reproduced the problem on 3.5 branch and master (both updated today).
I attached the bt with symbols (+ console messages) from master.
Comment 2 Korrawit Pruegsanusak 2012-05-15 03:12:09 UTC
Thanks for reporting this bug, but it's not BASIC, but Writer issue.
Comment 3 bfoman (inactive) 2012-05-31 23:18:07 UTC
Created attachment 62356 [details]
Bug 49666 - WinDbg session

Confirmed with:
LO 3.5.4.2 
Build ID: own W7 debug build
Windows 7 Professional SP1 64 bit

Crash while loading.

Attached full WinDbg session with mini dump file loaded generated by procdump soffice.bin -h.
Comment 4 Julien Nabet 2012-06-18 13:13:57 UTC
On Pc Debian x86-64, with master sources updated today, I don't reproduce the crash anymore but I had "General Input/output error" popup.
Comment 5 Scott Marshall 2012-07-05 01:36:27 UTC
Also crashes in v3.5.5.2 (build id: 24b32b4-b87ec2e-85c8e98-87a4e20-9a1b8c1) under Windows 7 (x86_64).

Same RTF that crashes v3.5.5.2 does NOT crash LODEV v3.6
Comment 6 Scott Marshall 2012-07-05 01:39:51 UTC
Created attachment 63853 [details]
RTF file containing image data and tables, with internal positioning and scaling control data.

This file crashes v3.5.5.2, and does not render correctly in v3.5.4 or LODEV v3.6

File correctly renders in IBM Lotus Symphony and Microsoft Word.
Comment 7 Caolán McNamara 2012-07-05 02:05:28 UTC
don't pile up different rtf documents that crash/render incorrectly in the same bug, write different ones for each.
Comment 8 Ronildo Matsuura 2012-08-07 13:11:19 UTC
I am having the same problem! I'm tested v3.5.4, v.3.5.5 and v3.6.0.4rc
Comment 9 Caolán McNamara 2012-08-22 14:14:50 UTC
3.5.6.2 doesn't crash on the original .rtf anymore, although it does fail to load, which I guess is acceptable as the format is busted.

If there are outstanding rtf crashers, please use different bugs for them.
Comment 10 Miklos Vajna 2013-11-01 20:41:39 UTC
Latest crash report points this document out once again.

Seems the problem is that the bugdoc contains a shape with type 75 (ESCHER_ShpInst_PictureFrame), which also has a shape text. Looks like this is an RTF which is generated by some 3rd-party tool: Word can open it, but it doesn't show the text on the picture frame, either -- and if I try to save it as RTF again, it crashes. ;-)

So, let's just ignore the shape text for picture frames at RTF import time as well, that should avoid the crash.
Comment 11 Commit Notification 2013-11-04 09:51:10 UTC
Miklos Vajna committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=0d9a5bfb1845a40fe701317486014145fdd08d06

fdo#49666 RTF import: fix crash on picture frame with shape text



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 12 Miklos Vajna 2013-11-04 09:59:53 UTC
I don't see the problem on -4-1, so closing without backporting.