Bug 65825

Summary:	FILEOPEN: attempting to insert Visio SVG causes Writer to crash
Product:	LibreOffice	Reporter:	Owen Genat (retired) <owen.genat>
Component:	Writer	Assignee:	Not Assigned <libreoffice-bugs>
Status:	RESOLVED FIXED
Severity:	normal	CC:	fridrich.strba, jorendc, serval2412
Priority:	medium
Version:	4.0.3.3 release
Hardware:	Other
OS:	Linux (All)
See Also:	https://bugs.freedesktop.org/show_bug.cgi?id=65847
Whiteboard:	BSA (target:4.4.0) (target:4.3.1)
Crash report or crash signature:		Regression By:
Attachments:	console + bt with symbols on master sources Screenshot with master sources updated yesterday

Description Owen Genat (retired) 2013-06-16 13:38:21 UTC

Problem description: I originally pointed this problem out in bug #45771, but have been instructed that it should be raised as a separate bug report. I experience a crash under Crunchbang 11 running TDF/LO v4.0.3.3 (Build ID: 0eaa50a932c8f2199a615e1eb30f7ac74279539) if I try and insert a particular Visio-generated SVG into a new Writer document. I have marked the Component as FILEOPEN, but am uncertain if this is correct.

I am also not sure what the policy is for re-using attachments in other bugs, so am simply linking to the related files. The problem Visio SVG is attached in comment four of the related bug:

https://bugs.freedesktop.org/attachment.cgi?id=65119

The gdbtrace.log file was nearly 50MB and appeared to terminate once gdb reached around ~750-800MB of RAM. I have head and tailed the first and last 100 lines as the rest appears to be repetition of the same detail. I attached the log file in comment seven of the related bug:

https://bugs.freedesktop.org/attachment.cgi?id=80510

Steps to reproduce:
1. Start Writer (new document).
2. Insert > Picture...
3. Select Visio SVG.
4. Click OK.

Current behavior:
Immediate crash (closure of window) after clicking OK.

Expected behavior:
Picture is inserted into document.

Please let me know if there is any further information I can provide.
Operating System: Linux (Other)
Version: 4.0.3.3 release

Comment 1 Julien Nabet 2013-06-18 18:28:45 UTC

Created attachment 81032 [details]
console + bt with symbols on master sources

On pc Debian x86-64 with master sources updated  today, I reproduced the problem. I attached the bt.

Comment 2 Julien Nabet 2013-06-18 18:31:29 UTC

Fridrich: here's a naive patch:
diff --git a/svgio/source/svgreader/svgnode.cxx b/svgio/source/svgreader/svgnode.cxx
index bbd21d2..cf66846 100644
--- a/svgio/source/svgreader/svgnode.cxx
+++ b/svgio/source/svgreader/svgnode.cxx
@@ -120,9 +120,14 @@ namespace svgio
                 SvgStyleAttributes* pCurrent = const_cast< SvgStyleAttributes* >(&rOriginal);
                 pCurrent->setCssStyleParent(0);
 
-                for(sal_uInt32 a(0); a < maCssStyleVector.size(); a++)
+                SvgStyleAttributeVector::const_reverse_iterator aIter = maCssStyleVector.rbegin();
+                // advance once since the last one musn't be used
+                if (++aIter == maCssStyleVector.rend())
+                   return pCurrent;
+
+                for( ; aIter != maCssStyleVector.rend(); ++aIter)
                 {
-                    SvgStyleAttributes* pCandidate = const_cast< SvgStyleAttributes* >(maCssStyleVector[maCssStyleVector.size() - a - 1]);
+                    SvgStyleAttributes* pCandidate = const_cast< SvgStyleAttributes* >(*aIter);
 
                     pCandidate->setCssStyleParent(pCurrent);
                     pCurrent = pCandidate;

There's no crash anymore but the image is completely black and I can see this on console:
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:documentProperties> (!)
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:pageProperties> (!)
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:layer> (!)
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:userDefs> (!)
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:ud> (!)
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:userDefs> (!)
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:ud> (!)
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:textBlock> (!)
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:textRect> (!)
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:paragraph> (!)
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:tabList> (!)
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:custProps> (!)
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:cp> (!)
...
warn:legacy.osl:12715:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:newlineChar> (!)

Would you have some time to take a look?

Comment 3 Julien Nabet 2013-08-24 06:27:39 UTC

To give an update, with master sources updated yesterday, I don't reproduce the crash.
However the image is wrongly imported and I noticed these kinds of console log:
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:documentProperties> (!)
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:pageProperties> (!)
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:layer> (!)
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:userDefs> (!)
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:ud> (!)
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:userDefs> (!)
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:ud> (!)
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:textBlock> (!)
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:textRect> (!)
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:paragraph> (!)
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:tabList> (!)
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:custProps> (!)
warn:legacy.osl:14455:1:svgio/source/svgreader/svgtools.cxx:40: Unknown Base SvgToken <v:cp> (!)

Comment 4 Julien Nabet 2013-08-24 06:29:34 UTC

Created attachment 84548 [details]
Screenshot with master sources updated yesterday

Comment 5 Jorendc 2014-07-24 19:31:49 UTC

Should be resolved with http://cgit.freedesktop.org/libreoffice/core/commit/?id=0879a639bc7c734f0847f74b965809f9107b3195

I did backport that change to LibreOffice-4-3 branch and will be available in 4.3.1 too.

Kind regards,
Joren