Bug 91916

Summary: FILEOPEN: Writer hangs when trying to open a certain fishy .doc file
Product: LibreOffice Reporter: Eyal Rozenberg <eyalroz1>
Component: WriterAssignee: Caolán McNamara <caolan.mcnamara>
Status: RESOLVED FIXED    
Severity: normal CC: caolan.mcnamara, lo_bugs, raal, xiscofauli
Priority: medium Keywords: bibisected, bisected, filter:doc, regression
Version: 4.4.3.2 release   
Hardware: x86-64 (AMD64)   
OS: All   
Whiteboard: target:5.3.0
Crash report or crash signature: Regression By:
Attachments: Copy of the problematic file

Description Eyal Rozenberg 2015-06-07 06:26:59 UTC 
Created attachment 116343 [details]
Copy of the problematic file

The Israeli Ministry of Justice has a form for requesting legal aid. It's downloadable from here:

http://www.justice.gov.il/NR/rdonlyres/34A43BBF-7B75-4E22-8A52-4083B054B79E/0/tofes1.doc

Even if you download it and open it with Word, the behavior is a bit funny - it's protected and it seems you can't do anything with it, including Save As for example. When I open it with LO 4.4.3.2, LO hangs.


PS - I know there are a bunch of open bugs with a similar title, but I don't know that the issues with those files are similar to the ones with this file. Please feel free to mark as duplicate if you're sure it's really the same problem.
Comment 1 raal 2015-06-07 06:50:13 UTC 
I can confirm with Version: 5.1.0.0.alpha1+
Build ID: eb8c323d94bf13d4a373f88c6b932a97701c283b
TinderBox: Linux-rpm_deb-x86_64@46-TDF, Branch:master, Time: 2015-06-05_00:59:00

After open the file LO freeze, 100%CPU

I can open file in LO 3.5,regression
Comment 2 Terrence Enger 2015-06-07 18:04:11 UTC 
In LibreOffice from the daily dbgutil repository version 2015-06-07,
LibreOffice was too busy to paint the Writer window.  I cancelled with
<Ctrl>+C in the terminal.  Terminal buffer was filled with (whitespace
added) ...

    warn:sw.core:5270:1:sw/source/core/text/porlay.cxx:354:
        SwLineLayout::CalcLine: bad ascent or height


Working in the 50max bibisect repository, I see ...

    a387b4baf39d306aaee0ed0395d61004eb5bbfa7 is the first bad commit
    commit a387b4baf39d306aaee0ed0395d61004eb5bbfa7
    Author: Matthew Francis <mjay.francis@gmail.com>
    Date:   Wed May 27 17:57:36 2015 +0800

        source-hash-b7d07699c8142e33f9d05d4e203b6fb567f36a9b
    
        commit b7d07699c8142e33f9d05d4e203b6fb567f36a9b
        Author:     Caolán McNamara <caolanm@redhat.com>
        AuthorDate: Fri Jan 9 16:44:07 2015 +0000
        Commit:     Caolán McNamara <caolanm@redhat.com>
        CommitDate: Fri Jan 9 17:38:02 2015 +0000
    
            asan: heap-buffer-overflow on ooo8726-1.doc
    
            Change-Id: I9fd7b873b6e64a6450c1bd946cd9bb08c293290a

    :040000 040000 99fff29638841c97b700609b64c147fde1b77957 59b374eac43178d2dc03b02572a1ae56f6bc3993 M	opt

and from `git bisect log` ...

    # bad: [dda106fd616b7c0b8dc2370f6f1184501b01a49e] source-hash-0db96caf0fcce09b87621c11b584a6d81cc7df86
    # good: [5b9dd620df316345477f0b6e6c9ed8ada7b6c091] source-hash-2851ce5afd0f37764cbbc2c2a9a63c7adc844311
    git bisect start 'latest' 'oldest'
    # bad: [0c30a2c797b249d0cd804cb71554946e2276b557] source-hash-45aaec8206182c16025cbcb20651ddbdf558b95d
    git bisect bad 0c30a2c797b249d0cd804cb71554946e2276b557
    # good: [770ff0d1a74d2450c2decb349b62c5087e12c46b] source-hash-549b7fad48bb9ddcba7dfa92daea6ce917853a03
    git bisect good 770ff0d1a74d2450c2decb349b62c5087e12c46b
    # bad: [259e888083cf7697956bb7e5f2691e8153eadb4c] source-hash-1884c0bbd40f0ded41d7a1656cb64fb1f6368c36
    git bisect bad 259e888083cf7697956bb7e5f2691e8153eadb4c
    # bad: [ee7c82541a2e99f76af570d3faa897504149913a] source-hash-54defd1bd3359c95e45891c7294847d0cebca753
    git bisect bad ee7c82541a2e99f76af570d3faa897504149913a
    # bad: [66a2c077694c47af9c40b46f740eab2d59f15efb] source-hash-c7d23291ea9ae7a3a2c055b09fce9c29bb7f58d3
    git bisect bad 66a2c077694c47af9c40b46f740eab2d59f15efb
    # good: [2c50abc2f0b266825b28c7c63df7b97ae8e74f1b] source-hash-2ad35f36db9195c01fe4ccb428f6d9626fa5060c
    git bisect good 2c50abc2f0b266825b28c7c63df7b97ae8e74f1b
    # good: [0e25a9f11c7338b9efdd3fd2fb63f45237f7952a] source-hash-201f99919253b370437d754137964d2757852079
    git bisect good 0e25a9f11c7338b9efdd3fd2fb63f45237f7952a
    # bad: [590d9e09fd28c9f940f42481f983ef607d573c85] source-hash-2ce00302275f8676decbdfe919590bb215b1c134
    git bisect bad 590d9e09fd28c9f940f42481f983ef607d573c85
    # good: [1bc1e4aadbb17fb8395a7c8a2826eece269396e1] source-hash-97a8b3ed5e5bd42e213d3230fa764b0f5d10f0f2
    git bisect good 1bc1e4aadbb17fb8395a7c8a2826eece269396e1
    # bad: [2862cfb32acf499cc0a39d11e446ff960e5ac363] source-hash-b3c6f2765602290fecd1f1e291e11667b6b446b6
    git bisect bad 2862cfb32acf499cc0a39d11e446ff960e5ac363
    # bad: [e0e6600f7d449a13baeadb45ec4e026319843486] source-hash-e52589553caaf05951b8e26b86ed2ebd1a8cae2e
    git bisect bad e0e6600f7d449a13baeadb45ec4e026319843486
    # good: [d2614afedd10bc7e059c4c988d5580b1dd7743e8] source-hash-82f02d7248f5959409a9a90f936649d602905067
    git bisect good d2614afedd10bc7e059c4c988d5580b1dd7743e8
    # bad: [a387b4baf39d306aaee0ed0395d61004eb5bbfa7] source-hash-b7d07699c8142e33f9d05d4e203b6fb567f36a9b
    git bisect bad a387b4baf39d306aaee0ed0395d61004eb5bbfa7
    # first bad commit: [a387b4baf39d306aaee0ed0395d61004eb5bbfa7] source-hash-b7d07699c8142e33f9d05d4e203b6fb567f36a9b
Comment 3 Robinson Tryon (qubit) 2015-12-13 11:13:16 UTC Comment hidden (obsolete)
Comment 4 Björn Michaelsen 2016-08-14 18:47:06 UTC Comment hidden (obsolete)
Comment 5 Xisco Faulí 2016-09-26 14:53:43 UTC 
Adding Cc: to Caolán McNamara
Comment 6 Caolán McNamara 2016-11-15 16:30:07 UTC 
The hang is in layout after the load, I don't think the change to the load is wrong I think it just changes the loaded attributes which somehow leads to the layout hang.
Comment 7 Caolán McNamara 2016-11-17 21:39:47 UTC 
hmm, or maybe not. I think there are two sets of different properties with the same id numbers in closely related, but different versions, of word and in one family they are of a different length to another, so bogus font heights are entering this document
Comment 8 Commit Notification 2016-11-18 10:54:24 UTC 
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c80a0fcdd9a4389616e92cfeafa9d932a784ee71

Resolves: tdf#91916 different word 6/7 vers have ambiguous sprms

It will be available in 5.3.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.