Download it now!
Bug 101636 - dbgutil build: Crash when creating number format code "[$..."
Summary: dbgutil build: Crash when creating number format code "[$..."
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
5.2.0.0.alpha0+
Hardware: All All
: medium normal
Assignee: Laurent BP
URL:
Whiteboard: target:5.3.0 target:5.2.2
Keywords: haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2016-08-21 15:26 UTC by Laurent BP
Modified: 2016-08-22 11:19 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments
Test file one field from database Bibliography (7.88 KB, application/vnd.oasis.opendocument.text)
2016-08-21 15:26 UTC, Laurent BP
Details
bt with symbols (18.65 KB, text/plain)
2016-08-21 17:12 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Laurent BP 2016-08-21 15:26:03 UTC
Created attachment 126934 [details]
Test file one field from database Bibliography

Steps to reproduce:
1. Create a doc with a field "Type" from database Bibliography. See attached file
2. Right click on field > Fields
3. Modify format: User-defined > Additional formats
4. Remove format code and type [$

Actual behavior:
Crash with message
.../include/rtl/ustrbuf.hxx:370: sal_Unicode& rtl::OUStringBuffer::operator[](sal_Int32): Assertion `index >= 0 && index < pData->length' failed.

Reproduced with
- Version: 5.3.0.0.alpha0+
Build ID: 327f5cc66f122979943d2c896eb1824791a854c9
CPU Threads: 4; OS Version: Linux 3.16; UI Render: default; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF-dbg, Branch:master, Time: 2016-08-18_00:07:02
Locale: fr-FR (fr_FR.UTF-8); Calc: group

NOT reproduce with
- Version: 5.3.0.0.alpha0+
Build ID: 989e8bc0d792f0dc5778746fac45de129a22d7ac
CPU Threads: 4; OS Version: Linux 3.16; UI Render: default; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2016-08-16_01:29:43
Locale: fr-FR (fr_FR.UTF-8); Calc: group
Comment 1 Laurent BP 2016-08-21 16:26:47 UTC
Pb here:
svl/source/numbers/zformat.cxx:1414
            case '$' :
                if ( rString[nPos] == '-' )

nPos == 2 is >= nLength
We should not test rString[nPos] without testing nPos.

I don't understand what was changed recently which makes this happen.

By the way, simple steps:
1. New Calc doc, Format > Cells > Numbers
2. Remove format code and type
[$
Comment 2 Julien Nabet 2016-08-21 17:12:43 UTC
Created attachment 126942 [details]
bt with symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.

I attached a bt.
Comment 3 Julien Nabet 2016-08-21 17:56:17 UTC
With LO Debian package 5.2.0.2, I don't reproduce this
=> regression.
Comment 4 Laurent BP 2016-08-21 20:49:57 UTC
This crash is reproducible only with dbg builds

Confirmed with
- Version: 5.3.0.0.alpha0+
Build ID: dde4e9a95479850bfc968fe712fe9e7ea7ef324e
CPU Threads: 4; OS Version: Linux 3.16; UI Render: default; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF-dbg, Branch:master, Time: 2016-08-07_04:38:14
Locale: fr-FR (fr_FR.UTF-8); Calc: group
- Version: 5.3.0.0.alpha0+
Build ID: 989e8bc0d792f0dc5778746fac45de129a22d7ac
CPU Threads: 4; OS Version: Linux 3.16; UI Render: default; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF-dbg, Branch:master, Time: 2016-08-16_02:21:43
Locale: fr-FR (fr_FR.UTF-8); Calc: group

The later is the same build as in comment 0 where I did NOT reproduce the crash, but with dbg
Comment 5 Eike Rathke 2016-08-22 10:45:49 UTC
dbgutil builds have some internal string access checks that assert on out-of-bounds access. The "crash" likely is there since the change from class String to OUString, as String[length] returned the terminating 0 character, OUString does the same in a non-dbgutil build, but as the terminating 0 character is not part of the string (and actually not guaranteed to be there) the dbgutil build checks the actual length.
Comment 6 Commit Notification 2016-08-22 10:49:02 UTC
Laurent Balland-Poirier committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=734eb8b034c8035565d091aa016ce3b8df838b19

tdf#101636 Test index before reading OUString

It will be available in 5.3.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Eike Rathke 2016-08-22 11:19:53 UTC
Btw, for such dbgutil off-by-one assert/crash occurrences you don't need to file a bug, just fix it and decide whether it should go into another branch as well.