Bug 104407 - EDITING: LO crashes when pasting a lot of RTF
Summary: EDITING: LO crashes when pasting a lot of RTF
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.2.0.0.alpha0+
Hardware: All All
: medium major
Assignee: Michael Stahl
QA Contact:
URL:
Whiteboard: target:5.4.0 target:5.3.4
Keywords: bibisected, bisected, haveBacktrace, regression
Depends on:
Blocks: Paste
  Show dependency treegraph
 
Reported: 2016-12-05 08:53 UTC by Luke Kendall
Modified: 2017-05-09 07:52 UTC (History)
6 users (show)

See Also:
Crash report or crash signature: ["writerfilter::dmapper::SectionPropertyMap::CloseSectionGroup(writerfilter::dmapper::DomainMapper_Impl%20&)"]


Attachments
Example document which reliably causes the crash (294.64 KB, application/vnd.oasis.opendocument.text)
2016-12-05 08:53 UTC, Luke Kendall
Details
backtrace (127.21 KB, text/x-log)
2017-04-24 17:59 UTC, Xisco Faulí
Details
backtrace (25.05 KB, text/plain)
2017-04-26 12:46 UTC, Xisco Faulí
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Luke Kendall 2016-12-05 08:53:09 UTC
Created attachment 129309 [details]
Example document which reliably causes the crash

I have a corrupted LO document (bug 103078), and tried copying the entire document as RTF into an empty document. It immediately crashes LO.

Steps to reproduce:

1. Open the attached file HarshLessons-CS-4x7-obfus.odt
2. Select all
3. Copy
4. File->New text document
5. Edit->Paste special; choose RTF

Results:
LO crashes

Expected result:
LO does not crash
Comment 1 Telesto 2016-12-05 14:04:49 UTC
Confirming with:
Version: 5.4.0.0.alpha0+
Build ID: 33f5bc54aaa7fe7aa9335726e30f9c349155e04d
CPU Threads: 4; OS Version: Windows 6.2; UI Render: default; 
TinderBox: Win-x86@62-merge-TDF, Branch:MASTER, Time: 2016-12-01_23:21:05
Locale: nl-NL (nl_NL); Calc: CL
Comment 2 Telesto 2017-04-23 18:07:04 UTC
Confirming crash with
Version: 5.4.0.0.alpha0+
Build ID: 4354f0e9ef4a5538729a2a6f2d1745e247f6c5cd
CPU threads: 4; OS: Windows 6.19; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-04-21_06:05:57
Locale: nl-NL (nl_NL); Calc: CL

No crash - but only incomplete paste - with:
Version: 5.0.2.2
Build ID: 37b43f919e4de5eeaca9b9755ed688758a8251fe-GL
Locale: en-US (nl_NL)

--------
RTF paste is also broken in:
Versie: 4.1.0.4 
Build ID: 89ea49ddacd9aa532507cbf852f2bb22b1ace28

but not in
LibreOffice 3.5.7.2 
Build ID: 3215f89-f603614-ab984f2-7348103-1225a5b
Comment 4 Xisco Faulí 2017-04-24 17:59:49 UTC
Created attachment 132801 [details]
backtrace
Comment 5 Xisco Faulí 2017-04-26 12:46:45 UTC
Created attachment 132861 [details]
backtrace
Comment 6 Xisco Faulí 2017-04-28 11:55:19 UTC
@Raal, @Aron, Could any of you please bisect this one ? Thanks
Comment 7 Aron Budea 2017-04-30 02:27:11 UTC Comment hidden (bibisection)
Comment 8 Aron Budea 2017-04-30 02:28:49 UTC
My bibisect results point to slightly earlier than the range in comment 3, to the comment referenced below. Adding Cc: to Miklos Vajna, please take a look.

https://cgit.freedesktop.org/libreoffice/core/commit/?id=abaf6bde4ee91c628bd55a7ec2e876a5d0ecff6e
author		Miklos Vajna <vmiklos@collabora.co.uk>	2016-03-22 07:09:01 (GMT)
committer	Miklos Vajna <vmiklos@collabora.co.uk>	2016-03-22 07:09:29 (GMT)

"tdf#65642 RTF filter: import \pgnrestart and \pgnucltr"
Comment 9 Michael Stahl 2017-05-05 20:12:36 UTC
fixed on master
Comment 10 Commit Notification 2017-05-05 20:13:49 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=e4da2e5dfa9e462e0d9c23a1a60caf4b3ef2dc56

tdf#104407 writerfilter: fix crash with null xRangeProperties

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2017-05-09 07:52:40 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=8521f4c8fb08aa37912f73a73ba1a34c2ccc97ed&h=libreoffice-5-3

tdf#104407 writerfilter: fix crash with null xRangeProperties

It will be available in 5.3.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.