| Summary: | UI Crash on deleting part of animated gif | ||
|---|---|---|---|
| Product: | LibreOffice | Reporter: | Katarina Behrens (Inactive) <Katarina.Behrens> |
| Component: | Impress | Assignee: | Armin Le Grand <Armin.Le.Grand> |
| Status: | CLOSED FIXED | ||
| Severity: | major | CC: | h3734236, jalojo, serval2412 |
| Priority: | medium | Keywords: | haveBacktrace |
| Version: | 5.0.2.2 release | ||
| Hardware: | Other | ||
| OS: | All | ||
| Whiteboard: | target:5.1.0 target:5.0.4 | ||
| Crash report or crash signature: | Regression By: | ||
| Attachments: | console logs + bt with debug symbols | ||
|
Description
Katarina Behrens (Inactive)
2015-10-24 12:35:59 UTC
Created attachment 119928 [details]
console logs + bt with debug symbols
On pc Debian x86-64 with master sources updated today, I could reproduce the crash.
I attached console logs + bt with debug symbols
Reproduced on LO 5.0.2.2 Debian testing package. Also reproduced with LO 5.1.0.0.alpha1+ Build ID: 186f32f63434e16ff5776251657f902d5808ed3d TinderBox: Win-x86@39, Branch:master, Time: 2015-10-16_09:42:47 under Windows 7 Home ALG: Taking a look... Problem was that the var to express the current frame (m_nCurrentFrame) uses a state EMPTY_FRAMELIST which is (of course) max integer and that it was partially used as array/vector access index without testing. Needed to add these missing tests and also corrections when the frame deleted was the last frame. Checked that this works now when deleting first/last frame, all frames and others. Checked and secured more places in the source, too. Preparing commit. Armin Le Grand committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=f0cef70cd4164342b218fbee34bf57eedc22c998 tdf#95298: corrected some out-of-bound accesses to array It will be available in 5.1.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback. integrated to master, done Armin Le Grand committed a patch related to this issue. It has been pushed to "libreoffice-5-0": http://cgit.freedesktop.org/libreoffice/core/commit/?id=6b3b080f8cedc1b496022b18e477af0c7361fba3&h=libreoffice-5-0 tdf#95298: corrected some out-of-bound accesses to array It will be available in 5.0.4. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback. |