Bug 105182 - Crash with "invalid vector<T> subscript" during search in Impress
Summary: Crash with "invalid vector<T> subscript" during search in Impress
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Impress (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: All All
: medium major
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard: target:5.4.0 target:5.3.0.2 target:5.2.5
Keywords:
Depends on:
Blocks:
 
Reported: 2017-01-08 06:23 UTC by Aron Budea
Modified: 2017-01-12 00:48 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:
Regression By:


Attachments
Example file (11.33 KB, application/vnd.oasis.opendocument.presentation)
2017-01-08 11:32 UTC, Telesto
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Aron Budea 2017-01-08 06:23:26 UTC
1. Enter the following text on an empty slide (without quotes):
"test
test"
2. Press Ctrl-F (Find), enter "test" in search field.
3. Press Find Next, Find Next, Find Previous, Find Next.

=> Impress crashes with the dialog "invalid vector<T> subscript". No crash report is generated.

Different combination of actions sometimes yield a crash without dialog.
Reproduced the crash with dialog in 4.4.0.3 and 5.3.0.1 / Windows 7, but also got crash without a dialog in 3.3.0 (there you have to set checkbox Backwards in Find%Replace... dialog when you search for previous occurrence).

Note:
when the end of presentation is reached, it takes long to get back the expected "Search key not found" result (not in absolute time, but compared to the instant it should be).
Comment 1 Telesto 2017-01-08 11:20:21 UTC
No repro with Windows 8:
Version: 5.4.0.0.alpha0+
Build ID: 92a1ad1f36b6d3cc13135a8c0805508933011577
CPU Threads: 4; OS Version: Windows 6.19; UI Render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-01-06_23:42:59
Locale: nl-NL (nl_NL); Calc: CL
Comment 2 Telesto 2017-01-08 11:31:58 UTC
Found the same error (and also incorrect search behavior), but steps to reproduce are different:
1. Open attached file
2. Go to the second sheet, select 'test' row
3. Press CTRL+F (Find), enter "test" in search field.
4. Click Find Previous number of times (3 or so)
5. Click Find next 3 times or so
6. Click Find Previous once

Version: 5.4.0.0.alpha0+
Build ID: 92a1ad1f36b6d3cc13135a8c0805508933011577
CPU Threads: 4; OS Version: Windows 6.19; UI Render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-01-06_23:42:59
Locale: nl-NL (nl_NL); Calc: CL
Comment 3 Telesto 2017-01-08 11:32:20 UTC
Created attachment 130255 [details]
Example file
Comment 4 Jacques Guilleron 2017-01-08 12:07:52 UTC
Hi Aron,

Reproduced with
LO 5.4.0.0.alpha0+ Build ID: 08fa2e9307c9e4a49e18ecb0b4e9461492122fe3
LO 5.3.0.0.beta2 Build ID: a7e30712ad6d8bc9286007b37aa581983e0caba3
LO 4.3.7.2 Build ID: 8a35821d8636a03b8bf4e15b48f59794652c68ba
also with:
LO  3.5.3.2 Version ID : 235ab8a-3802056-4a8fed3-2d66ea8-e241b80
under windows 7 Home

Same results as Telesto with his test file.
 
Jacques
Comment 5 Commit Notification 2017-01-11 16:32:36 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=aa1ee198b5b55d0a92418eb3294c93553e8513dd

tdf#105182 sd: avoid iterating too far in SdOutliner::Initialize()

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 6 Michael Stahl (allotropia) 2017-01-11 16:34:34 UTC
should be fixed on master
Comment 7 Commit Notification 2017-01-11 20:19:31 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=dd133c29b3731c93c8cc0b96ea0632d8998ae594&h=libreoffice-5-3

tdf#105182 sd: avoid iterating too far in SdOutliner::Initialize()

It will be available in 5.3.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2017-01-12 00:48:34 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=5f081ce502e5eeee528049fc76657d623afcee24&h=libreoffice-5-2

tdf#105182 sd: avoid iterating too far in SdOutliner::Initialize()

It will be available in 5.2.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.