Bug 104162 - CRASH: Writer crashes on opening docx with comment that contains a table with <w:hideMark/>
Summary: CRASH: Writer crashes on opening docx with comment that contains a table with...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: filters and storage (show other bugs)
Version:
(earliest affected)
4.3.7.2 release
Hardware: All All
: highest critical
Assignee: Miklos Vajna
URL:
Whiteboard: interoperability target:5.4.0 target:...
Keywords: bibisected, bisected, filter:docx, haveBacktrace, regression
Depends on:
Blocks: DOCX-Opening
  Show dependency treegraph
 
Reported: 2016-11-25 13:06 UTC by Tristan Miller
Modified: 2017-03-03 15:49 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:


Attachments
docx file causing LibreOffice to crash (48.31 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2016-11-25 13:06 UTC, Tristan Miller
Details
"soffice --backtrace" output (32.26 KB, text/x-log)
2016-11-25 13:56 UTC, Thomas Hackert
Details
bzip2'ed "soffice --strace" output (422.37 KB, application/x-bzip)
2016-11-25 13:57 UTC, Thomas Hackert
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Tristan Miller 2016-11-25 13:06:49 UTC
Created attachment 129002 [details]
docx file causing LibreOffice to crash

LibreOffice Writer 5.2.3.3 (on openSUSE 13.2 and openSUSE Tumbleweed for x86-64) crashes when opening the attached docx file.  The file was created with Microsoft Word 2010 and seems to contain nothing remarkable other than a comment.

Reproducibility: Always

Steps to reproduce:
$ libreoffice test.docx

Expected behaviour:
LibreOffice should open and display the file.

Observed behaviour:
The following dialog appears as soon as LibreOffice starts:

LibreOffice Document Recovery

Due to an unexpected error, LibreOffice crashed.  All the files you were working on will now be saved. The next time LibreOffice is launched, your files will be recovered automatically.
Comment 1 Tristan Miller 2016-11-25 13:19:11 UTC
I can also reproduce the problem with 5.3.0 Beta1:

Version: 5.3.0.0.beta1
Build ID: 690f553ecb3efd19143acbf01f3af4e289e94536
CPU Threads: 4; OS Version: Linux 3.16; UI Render: default; VCL: gtk2; Layout Engine: new; 
Locale: en-CA (en_CA.utf8); Calc: group
Comment 2 Telesto 2016-11-25 13:27:44 UTC
Confirming crash with:
Version: 5.3.0.0.beta1
Build ID: 690f553ecb3efd19143acbf01f3af4e289e94536
CPU Threads: 4; OS Version: Windows 6.2; UI Render: default; Layout Engine: new; 
Locale: nl-NL (nl_NL); Calc: CL
Comment 4 Thomas Hackert 2016-11-25 13:41:38 UTC
Hello Tristan, *,
thank you very much for reporting this bug :) I can reproduce it with

OS: Debian Testing AMD64
LO: Version: 5.3.0.0.beta1
Build-ID: 690f553ecb3efd19143acbf01f3af4e289e94536
CPU-Threads: 4; BS-Version: Linux 4.5; UI-Render: Standard; VCL: gtk2; Layout-Engine: neu; 
Gebietsschema: de-DE (de_DE.UTF-8); Calc: group

and back to

LO: Version: 4.3.7.2
Build-ID: 8a35821d8636a03b8bf4e15b48f59794652c68ba

but not with

LO: Version 4.0.0.3 (Build ID: 7545bee9c2a0782548772a21bc84a9dcc583b89)
(all parallel installed, following the instructions from https://wiki.documentfoundation.org/Installing_in_parallel/Linux)

. So it seems, that somewhere between 4.0.0.3 and 4.3.7.2 it was introduced. Sorry, that I have no further version installed between the two ones ... :(

As I can confirm your bug, I will set "Version" to 4.3.7.2.
HTH
Thomas.
Comment 5 Xisco Faulí 2016-11-25 13:43:03 UTC
Confirmed in 

Version: 5.3.0.0.alpha1+
Build ID: 4ebf1ea7cb66fc3e6b94cd38dd233aaead69f3d5
CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; VCL: gtk3; Layout Engine: new; 
Locale: ca-ES (ca_ES.UTF-8); Calc: group
Comment 6 Aron Budea 2016-11-25 13:50:05 UTC
(In reply to thackert from comment #4)
> . So it seems, that somewhere between 4.0.0.3 and 4.3.7.2 it was introduced.

No crash in 4.3.0.4, general input-output error in 4.4.0.3.
Comment 7 Thomas Hackert 2016-11-25 13:56:26 UTC
Created attachment 129004 [details]
"soffice --backtrace" output
Comment 8 Thomas Hackert 2016-11-25 13:57:55 UTC
Created attachment 129005 [details]
bzip2'ed "soffice --strace" output
Comment 9 Xisco Faulí 2016-11-25 14:07:59 UTC
Regression introduced by:

author	Miklos Vajna <vmiklos@collabora.co.uk>	2014-08-14 11:54:18 (GMT)
committer	Miklos Vajna <vmiklos@collabora.co.uk>	2014-08-14 13:55:44 (GMT)
commit d1278ef4849661b9ae0eb7aaf4d74fbf91ccaf11 (patch)
tree 07e1c063cbd015b90c8be638197ad6e15e531b07
parent ffdc8780eba3ec34e502b01b9a54401627ee25c5 (diff)

bnc#865381 DOCX import: handle <w:hideMark> table cell property

Adding Cc: to Miklos Vajna
Comment 10 Julien Nabet 2016-11-25 21:05:37 UTC
On pc Debian x86-64 with master sources updated today, I could reproduce this.

gdb gives this:
(gdb) frame 5
#5  0x00002aaadca6adec in writerfilter::dmapper::lcl_emptyRow (rTableRanges=std::__debug::vector of length 4, capacity 4 = {...}, nRow=0)
    at /home/julien/lo/libreoffice/writerfilter/source/dmapper/DomainMapperTableHandler.cxx:899
899	    uno::Reference<text::XTextRangeCompare> xTextRangeCompare(rRowSeq[0][0]->getText(), uno::UNO_QUERY);
(gdb) p rRowSeq
$4 = uno::Sequence of length 1 = {uno::Sequence of length 2 = {empty uno::Reference, empty uno::Reference}}
(gdb) p rRowSeq[0]
$5 = uno::Sequence of length 2 = {empty uno::Reference, empty uno::Reference}
Comment 11 Miklos Vajna 2016-12-16 21:18:40 UTC
I'll take care of this; the special thing about the bugdoc is that it has a comment that contains a table and that table contains a <w:hideMark/>.
Comment 12 Commit Notification 2016-12-19 18:37:41 UTC
Miklos Vajna committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=74dddd8b483d89dc7915471441cc30a1aa342363

tdf#104162 DOCX import: fix crash on <w:hideMark/> in a comment table

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Commit Notification 2016-12-20 13:10:03 UTC
Miklos Vajna committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=e4be3c9810ecbf2733f7e5884dbba19c426749ef&h=libreoffice-5-3

tdf#104162 DOCX import: fix crash on <w:hideMark/> in a comment table

It will be available in 5.3.0.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 14 zahra 2017-02-04 13:15:10 UTC
hello.
thanks extremely for helping to resolve bugs and make your program for your users better and better every day.
could you please also fix this bug for version 5.2.6 also?
i wish that use 5.2 and can open and read my documents without any bug!
thanks extremely for your help,
i remember you in my five times daily prayers,
pray for you and request divine infinite mercy for you.
Comment 15 Julien Nabet 2017-02-05 10:10:30 UTC
Commit cherry-picked for 5.2 branch waiting for review here:
https://gerrit.libreoffice.org/#/c/33925/
Comment 16 zahra 2017-02-06 19:00:04 UTC
(In reply to Julien Nabet from comment #15)
> Commit cherry-picked for 5.2 branch waiting for review here:
> https://gerrit.libreoffice.org/#/c/33925/

hi julien.
thanks extremely for your quick reply and patch.
i admire your efforts, appreciate you and pray for you sincerely.
i request divine extreme mercy and graces for you.
i waite for fixing this.
Comment 17 Julien Nabet 2017-02-06 19:27:23 UTC
(In reply to zahra from comment #16)
> (In reply to Julien Nabet from comment #15)
> > Commit cherry-picked for 5.2 branch waiting for review here:
> > https://gerrit.libreoffice.org/#/c/33925/
> 
> hi julien.
> thanks extremely for your quick reply and patch.
>...

Just to say that Miklos made the patch (it's him you must thank not me! :-)). I just cherry-picked (ie. retrieved) for gerrit review in 5.2 branch. For the moment, we must wait for some people approve it (or not!) so it may available for  5.2.6
Comment 18 Commit Notification 2017-02-07 10:55:25 UTC
Miklos Vajna committed a patch related to this issue.
It has been pushed to "libreoffice-5-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=24ed49a2547349634cc8fa2f0f65f52bfc7c3d63&h=libreoffice-5-2

tdf#104162 DOCX import: fix crash on <w:hideMark/> in a comment table

It will be available in 5.2.6.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 19 zahra 2017-02-07 14:30:58 UTC
(In reply to Commit Notification from comment #18)
> Miklos Vajna committed a patch related to this issue.
> It has been pushed to "libreoffice-5-2":
> 
> http://cgit.freedesktop.org/libreoffice/core/commit/
> ?id=24ed49a2547349634cc8fa2f0f65f52bfc7c3d63&h=libreoffice-5-2
> 
> tdf#104162 DOCX import: fix crash on <w:hideMark/> in a comment table
> 
> It will be available in 5.2.6.
> 
> The patch should be included in the daily builds available at
> http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
> information about daily builds can be found at:
> http://wiki.documentfoundation.org/Testing_Daily_Builds
> 
> Affected users are encouraged to test the fix and report feedback.

hi miklos.
i also appreciate your great work, pray for you and invoke divine extreme blessings, mercy and graces for you.
i pray this for you and all developers and supporters of libreoffice.
i wish that i was programmer and could help you in improving your program, not only reporting bugs!
Comment 20 vihsa 2017-03-03 07:10:49 UTC
verified. Version: 5.4.0.0.alpha0+
Build ID: febc116

the libreoffice does not crash.