| Summary: | segmentation fault in XComponentLoader::loadComponentFromURL due to libvisio/libraptor/libxml2 interaction | ||
|---|---|---|---|
| Product: | LibreOffice | Reporter: | Horst Reiterer <horst.reiterer> |
| Component: | filters and storage | Assignee: | Michael Stahl (allotropia) <michael.stahl> |
| Status: | RESOLVED FIXED | ||
| Severity: | critical | CC: | bernhard.scholze, fridrich.strba, gerhard.temper, jmadero.dev, michael.stahl, robinson.libreoffice, serval2412 |
| Priority: | medium | ||
| Version: | 4.0.0.3 release | ||
| Hardware: | x86-64 (AMD64) | ||
| OS: | Linux (All) | ||
| Whiteboard: | target:4.2.0 target:4.1.0 target:3.6.6 target:4.0.5 | ||
| Crash report or crash signature: | Regression By: | ||
| Attachments: |
Dump archive (xz-based compression, split into 3kb parts)
Dump archive Dump archive Dump archive Dump archive Dump archive Dump archive Dump archive Dump archive Dump archive |
||
|
Description
Horst Reiterer
2013-05-16 13:48:10 UTC
Created attachment 79422 [details]
Dump archive (xz-based compression, split into 3kb parts)
Created attachment 79423 [details]
Dump archive
Created attachment 79424 [details]
Dump archive
Created attachment 79425 [details]
Dump archive
Created attachment 79426 [details]
Dump archive
Created attachment 79427 [details]
Dump archive
Created attachment 79428 [details]
Dump archive
Created attachment 79429 [details]
Dump archive
Created attachment 79430 [details]
Dump archive
I added a dump representing the segmentation fault (download all "Dump archive" attachments). The dump can be opened as follows: cat libreoffice-dump.tar.xz_* | xz -d > libreoffice-dump.tar tar xf libreoffice-dump.tar cd libreoffice-dump gdb -ex "set solib-absolute-prefix ." -ex "core core.17796" /opt/libreoffice4.0/program/soffice.bin LibreOffice build 4.0.0.3-103 must be installed. Created attachment 79431 [details]
Dump archive
I know that LO uses a newer version of raptor in master branch. (see http://cgit.freedesktop.org/libreoffice/core/commit/?id=d719c01c2f112d97b09aee008f9bfee57719eeed) For the test, could you give a try to a daily build? (see http://dev-builds.libreoffice.org/daily/) Thanks for the input! I tested the issue with the daily build (4.2.0.0.alpha0-2013-06-26_00.15.36) and cannot reproduce the segmentation fault within a timeframe that usually results in an abort. After switching back to 4.0, the segmentation fault occurred again within a matter of minutes. When will the next release (4.1?) with the new version of raptor (libraptor2-lo.so.0) be available? Any chance for a backport to 4.0? Test results: OK: LibreOffice 3.6.6.2/libraptor-lo.so.1 LibreOffice 4.1.0.1/libraptor2-lo.so.0 LibreOffice 4.2.0.0.alpha0-2013-06-26_00.15.36/libraptor2-lo.so.0 NOK: LibreOffice 4.0.0.3/libraptor-lo.so.1 LibreOffice 4.0.4.2/libraptor-lo.so.1 Horst: thank you for your feedback. About 4.1 branch, it should be ok for 4.1.0 and this one should be released at the end of July (see https://wiki.documentfoundation.org/ReleasePlan#4.1_release). About 4.0 backport, see below. Michael: is it ok if I cherry pick the commit http://cgit.freedesktop.org/libreoffice/core/commit/?id=d719c01c2f112d97b09aee008f9bfee57719eeed and submit it for review on gerrit for 4.0 branch? no the new raptor can't be backported easily as the 4.0 branch has to run on Mac OS 10.4 and the libxml2 on that is too old... but honestly i'm surprised that this serious bug in raptor (another instance of messing with libxml2 global state) is only found now, after shipping this thing for 5 years... _perhaps_ we've never had an import filter that uses libxml2 in type-detection until the new libvisio started to read XML-based Visio files? (and everything else that uses libxml2 doesn't get to read invalid input so doesn't call error handlers?) Michael Stahl committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=246a78b1d2a88ff1937b09b22325d160739ef47e fdo#64672 prevent raptor from setting global libxml2 error handlers The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback. reading the raptor code it's not at all clear to me why it should not crash with the newer version in LO 4.1: it also sets the global error handlers by default... but at least now there is a way to disable that. so for master/4.1 only disabling some feature flags when creating the librdf_world is needed. for 4.0 the same is needed (for a --with-system-redland build) and in addition a patch to the bundled old raptor lib; patches are in gerrit. Michael Stahl committed a patch related to this issue. It has been pushed to "libreoffice-4-1": http://cgit.freedesktop.org/libreoffice/core/commit/?id=ae11e5501c9cf436a3f8b956e9b3fba6d1cb67cf&h=libreoffice-4-1 fdo#64672 prevent raptor from setting global libxml2 error handlers It will be available in LibreOffice 4.1. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback. Michael Stahl committed a patch related to this issue. It has been pushed to "libreoffice-4-0": http://cgit.freedesktop.org/libreoffice/core/commit/?id=9727a88b614350c832c151fbc670097850cdcc97&h=libreoffice-4-0 fdo#64672 prevent raptor from setting global libxml2 error handlers It will be available in LibreOffice 4.0.5. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback. Michael Stahl committed a patch related to this issue. It has been pushed to "libreoffice-4-0": http://cgit.freedesktop.org/libreoffice/core/commit/?id=402a919c54bca942941e8ef2f0b340047fa152fc&h=libreoffice-4-0 fdo#64672 prevent raptor from setting global libxml2 error handlers It will be available in LibreOffice 4.0.5. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback. Michael Stahl committed a patch related to this issue. It has been pushed to "libreoffice-4-0": http://cgit.freedesktop.org/libreoffice/core/commit/?id=3c1559ba0ba71bb18faacd18016cd9e3b510c598&h=libreoffice-4-0 fdo#64672: untested attempt to get unordf to link in raptor with MSVC It will be available in LibreOffice 4.0.5. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback. Migrating Whiteboard tags to Keywords: (Need_Advice -> needAdvice) [NinjaEdit] 'needsConfirmationAdvice' is only used for unconfirmed bugs. Removing it from this bug. [NinjaEdit] |