Bug 108903 - Crash after pasting text with SVG image from webpage
Summary: Crash after pasting text with SVG image from webpage
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.2.0.0.alpha0+
Hardware: All All
: medium critical
Assignee: Caolán McNamara
URL:
Whiteboard: target:6.0.0 target:5.4.1 target:5.3....
Keywords: bibisected, bibisectRequest, haveBacktrace, regression
Depends on:
Blocks:
 
Reported: 2017-07-02 15:25 UTC by bdy
Modified: 2017-07-21 09:22 UTC (History)
3 users (show)

See Also:
Crash report or crash signature: ["RtlAllocateHeap"]


Attachments
bt with debug symbols (33.89 KB, application/x-bzip)
2017-07-02 20:24 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description bdy 2017-07-02 15:25:06 UTC
Description:
Copy all the content of this page:
https://www.test.de/Geschirrspuelmittel-Die-Phosphatfreien-koennens-jetzt-auch-5048494-0/

beginning at "Inhalt"
Paste it into a new writer document -> crash

See crashreport.libreoffice.org/stats/crash_details/6e7b5df3-f506-495e-9d50-3ac34eedbc90

Actual Results:  
See above

Expected Results:
The content of the webpage should be copied in the writer document


Reproducible: Always

User Profile Reset: No

Additional Info:


User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0
Comment 1 m_a_riosv 2017-07-02 15:38:53 UTC
Reproducible.
Version: 5.4.0.1 (x64)
Build ID: 962a9c4e2f56d1dbdd354b1becda28edd471f4f2
CPU threads: 4; OS: Windows 6.19; UI render: GL; 
Locale: es-ES (es_ES); Calc: group
Version: 6.0.0.0.alpha0+
Build ID: cac5c9f6081590b0548d3116bc4cd4a2509ec576
CPU threads: 4; OS: Windows 6.19; UI render: GL; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-07-01_00:41:48
Locale: es-ES (es_ES); Calc: group
Comment 2 Julien Nabet 2017-07-02 20:24:11 UTC
Created attachment 134437 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce the crash.
The length of the stack is about 18 000 calls!
Comment 3 MM 2017-07-09 22:12:59 UTC
The crash comes from the little image next to the text '11. Testergebnisse: Geschirr­spül­mittel 08/2016', called v63631917972.svg
If you only copy/paste this image, you'll crash LO.
Comment 5 Caolán McNamara 2017-07-13 15:23:13 UTC
seems to be a recursive loop in reading an svg in the html pasted in and eventually we die from stack exhaustion
Comment 6 Commit Notification 2017-07-13 15:32:35 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=304b16c3bf6fba2fa28e723d1cb58157201b5c1f

Resolves: tdf#108903 avoid recurse to death

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Commit Notification 2017-07-13 20:36:35 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=e2075593e4d13b6e7c0b32b23912fdeed1ada6bf&h=libreoffice-5-4

Resolves: tdf#108903 avoid recurse to death

It will be available in 5.4.1.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2017-07-13 20:36:45 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2f64f2871d4e4091061d791db647de57ed390109&h=libreoffice-5-3

Resolves: tdf#108903 avoid recurse to death

It will be available in 5.3.6.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Xisco Faulí 2017-07-14 08:41:24 UTC
Hi Caolán,
Do you think it can be backported to 5.4.0 before it's released ?
Comment 10 Caolán McNamara 2017-07-14 20:20:06 UTC
https://gerrit.libreoffice.org/#/c/39989/
Comment 11 Commit Notification 2017-07-21 09:22:56 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-4-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=3825a8f2f367e0bcbb58c010167c5dfb94d46274&h=libreoffice-5-4-0

Resolves: tdf#108903 avoid recurse to death

It will be available in 5.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.