Bug 104117 - Crash in Calc when selecting "Uniform Integer" with an max value "100000000000000" in "Random Number Generator
Summary: Crash in Calc when selecting "Uniform Integer" with an max value "10000000000...
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
5.0 all versions
Hardware: All Linux (All)
: highest critical
Assignee: Tomaz Vajngerl
URL:
Whiteboard: target:5.4.0 target:5.3.2 target:5.2....
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2016-11-22 15:40 UTC by Thomas Hackert
Modified: 2019-12-07 19:13 UTC (History)
6 users (show)

See Also:
Crash report or crash signature:


Attachments
bzip'ed "soffice --backtrace" output (308.30 KB, application/x-bzip)
2016-11-22 15:42 UTC, Thomas Hackert
Details
bzip2'ed "soffice --strace" output (285.04 KB, application/x-bzip)
2016-11-22 15:42 UTC, Thomas Hackert
Details
minimal test cpp file. (808 bytes, text/x-c++src)
2017-03-02 03:25 UTC, Kohei Yoshida
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Hackert 2016-11-22 15:40:53 UTC
Hello @ll,
while translating Lo in Pootle, I was playing around a little bit  with Calc's "Random Number Generator", and stumbled upon the following:

1. Start Calc
2. Mark cells A1 to C3
3. Select "Sheets - Fill Cells - Random Number..."
4. Change "Distribution" from "Uniform" to "Uniform Integer"
5. Change "Maximum" from "1" to "1000000000000000000000000000000000000000000000"
6. Press the Enter key

On my system,

OS: Debian Testing AMD64
LO: Version: 5.1.0.3
Build-ID: 5e3e00a007d9b3b6efb6797a8b8e57b51ab1f737
CPU Threads: 4; OS Version: Linux 4.5; UI Render: default; 
Gebietsschema: de-DE (de_DE.UTF-8)

up to

LO: Version: 5.3.0.0.alpha1+
Build ID: c03c77ef4f46b81cd000ea26c4ef154044322535
CPU Threads: 4; OS Version: Linux 4.5; UI Render: default; VCL: 
gtk2; Layout Engine: new; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 
2016-11-17_00:47:54
Locale: de-DE (de_DE.UTF-8); Calc: group
(all parallel installed, following the instructions from 
https://wiki.documentfoundation.org/Installing_in_parallel/Linux, 
and with de_DE lang- as well as helppack)

Calc crashes ... :( This also happens with

LO: Version: 5.2.3.1
Build-ID: 1:5.2.3~rc1-4
CPU-Threads: 4; BS-Version: Linux 4.5; UI-Render: Standard; 
Gebietsschema: de-DE (de_DE.UTF-8); Calc: group
(Debian's own version of LO).

If starting master with "--backtrace" I got a 93MB file, with "-strace" one with 3.3MB. I will both attach them as bzip'ed files afterwards.
Sorry for the inconvenience
Thomas.
Comment 1 Thomas Hackert 2016-11-22 15:42:02 UTC
Created attachment 128949 [details]
bzip'ed "soffice --backtrace" output
Comment 2 Thomas Hackert 2016-11-22 15:42:45 UTC
Created attachment 128950 [details]
bzip2'ed "soffice --strace" output
Comment 3 m_a_riosv 2016-11-22 18:24:59 UTC
Not repro on Windows.
Version: 5.2.3.3 (x64)
Build ID: d54a8868f08a7b39642414cf2c8ef2f228f780cf
CPU Threads: 4; OS Version: Windows 6.19; UI Render: default; 
Locale: es-ES (es_ES); Calc: group
Comment 4 MM 2016-11-22 20:13:34 UTC
Confirmed with v5.2.3.3 under ubuntu 16.04 x64.
Confirmed with Version: 5.3.0.0.alpha1+
Build ID: 43b5ca69aa545cf93eded55258d92d651917815f
CPU Threads: 2; OS Version: Linux 4.4; UI Render: default; VCL: gtk2; Layout Engine: new; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2016-11-18_05:17:53
Locale: en-US (en_US.UTF-8); Calc: single

Notice that tabbing 'max', the value doesn't beyond 9223372036854775807 anyway.
Comment 5 Julien Nabet 2016-11-23 08:46:41 UTC
According to http://opengrok.libreoffice.org/xref/core/sc/source/ui/StatisticsDialogs/RandomNumberGeneratorDialog.cxx#226, we expect int parameters. But it's obviously not the case here.
Perhaps should we check parameters are not greater than SAL_MAX_INT32 or SAL_MAX_INT16 ?
Comment 6 Yogesh Desai 2016-11-27 18:06:15 UTC
Hi,

I am able to reproduce this crash with following setup,

Version: 5.4.0.0.alpha0+
Build ID: a76ec55964e85a2567505b38e95c5bb9da7988ff
CPU Threads: 8; OS Version: Linux 4.8; UI Render: default; VCL: gtk3; Layout Engine: new; 
Locale: en-US (en_US.utf8); Calc: group

Any help or ideas to solve this bug would be appreciated.

Thank you.
Yogesh Desai
Comment 7 Xisco Faulí 2017-02-28 10:53:34 UTC
Regression introduced by:

author	Tomaž Vajngerl <tomaz.vajngerl@collabora.co.uk>	2015-01-26 06:29:38 (GMT)
committer	Tomaž Vajngerl <tomaz.vajngerl@collabora.co.uk>	2015-01-26 06:32:03 (GMT)
commit 26ad60aec69310fecd918f1c2e09056aa4782320 (patch)
tree 88798b80d2351f09446a602502717aa3e95d875d
parent eef0c5bf210635fe3edbe1ba58b73639fef4bc4b (diff)
convert to use std random instead of boost

Adding Cc: to Tomaž Vajngerl
Comment 8 Kohei Yoshida 2017-03-02 03:25:55 UTC
Created attachment 131568 [details]
minimal test cpp file.

Compiling and executing this code causes segmentation fault.  It appears that std::uniform_int_distribution can't handle 64-bit integer range.  32-bit range is okay.
Comment 9 Tomaz Vajngerl 2017-03-02 08:38:04 UTC
Seems the solution is quite simple then:

https://gerrit.libreoffice.org/#/c/34777/
Comment 10 Commit Notification 2017-03-02 13:38:23 UTC
Tomaž Vajngerl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=23672df737258391bd9533e61733c6cc70b9a5eb

tdf#104117 set template parameter sal_Int64 for random

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Kohei Yoshida 2017-03-02 13:51:51 UTC
I'll assign this to you. Tomaz.
Comment 12 Xisco Faulí 2017-03-07 09:20:39 UTC
Hi Tomaz,
Thanks for fixing this.
I can no longer reproduce it in

Version: 5.4.0.0.alpha0+
Build ID: 27c5268dd9908b749ca251e172944278d761a335
CPU threads: 4; OS: Linux 4.8; UI render: default; VCL: gtk2; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group.

You should close it as RESOLVED FIXED
Comment 13 Tomaz Vajngerl 2017-03-07 09:49:06 UTC
Backports for LO 5.3 and 5.2:
https://gerrit.libreoffice.org/#/c/34817/
https://gerrit.libreoffice.org/#/c/34818/
Comment 14 Commit Notification 2017-03-07 16:03:51 UTC
Tomaž Vajngerl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c713f227cc34b841c06beca2e9eaa96653eac372&h=libreoffice-5-3

tdf#104117 set template parameter sal_Int64 for random

It will be available in 5.3.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 15 Commit Notification 2017-03-15 10:07:04 UTC
Tomaž Vajngerl committed a patch related to this issue.
It has been pushed to "libreoffice-5-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=a5a2c9c83da3a3cc01a9262d6c659c99ad58b152&h=libreoffice-5-2

tdf#104117 set template parameter sal_Int64 for random

It will be available in 5.2.7.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 16 Commit Notification 2018-05-29 18:28:20 UTC
Zdeněk Crhonek committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f5af8615e40bca1a747695c8ca28675c4ab0d384

uitest for bug tdf#104117 and tdf#80693

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 17 raal 2019-12-07 19:13:55 UTC
The test exist, set status to Verified.