Bug 111934 - FILEOPEN: crash sigsegv when opening file with invalid style:map
Summary: FILEOPEN: crash sigsegv when opening file with invalid style:map
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: filters and storage (show other bugs)
Version:
(earliest affected)
Inherited From OOo
Hardware: All All
: highest critical
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard: target:6.0.0 target:5.4.2 target:5.3.7
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2017-08-21 07:03 UTC by Dinh Le
Modified: 2017-08-25 20:17 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
Causes a crash with sigsev (2.15 KB, application/vnd.oasis.opendocument.text)
2017-08-21 07:04 UTC, Dinh Le
Details
bt with debug symbols (68.18 KB, text/plain)
2017-08-21 19:09 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Dinh Le 2017-08-21 07:03:27 UTC
Description:
I have been trying to fuzz some files and I am getting some crashes.

Opening it leads to a crash with SIGSEV. I have reproduced it in 5.1.6.2 in Ubuntu 16.04.2 LTS and 5.2 in Mac OS X 10.12.5.



Steps to Reproduce:
1. Just open the file 


Actual Results:  
Crashes with SIGSEV

Expected Results:
Getting a parsing error


Reproducible: Always

User Profile Reset: No

Additional Info:
I am also getting different crashes by fuzzing resulting in Application Error Signal 6. I would like to know if those are considered bugs worth reporting?


User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
Comment 1 Dinh Le 2017-08-21 07:04:21 UTC
Created attachment 135683 [details]
Causes a crash with sigsev
Comment 2 Julien Nabet 2017-08-21 08:01:01 UTC
Could you give a try to last stable LO version (5.3.5)?
For Ubuntu, you can search in LO ppa.
Comment 3 Dinh Le 2017-08-21 08:45:21 UTC
I have tried it again with 5.3.5 and could also confirm the same behaviour.
Comment 4 Julien Nabet 2017-08-21 08:53:41 UTC
On Windows 7, with LO 5.3.2 I could reproduce this.
Comment 5 Julien Nabet 2017-08-21 19:09:58 UTC
Created attachment 135711 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.
I attached an incomplete bt (because stack was quite big)
Comment 6 Xisco Faulí 2017-08-22 01:20:59 UTC
Reproduced in

- Version: 5.2.0.0.alpha1+
Build ID: 5b168b3fa568e48e795234dc5fa454bf24c9805e
CPU Threads: 4; OS Version: Linux 4.8; UI Render: default; 
Locale: ca-ES (ca_ES.UTF-8)

- Version: 5.0.0.0.alpha1+
Build ID: 0db96caf0fcce09b87621c11b584a6d81cc7df86
Locale: ca-ES (ca_ES.UTF-8)

- Version: 4.3.0.0.alpha1+
Build ID: c15927f20d4727c3b8de68497b6949e72f9e6e9e

- Version 4.1.0.0.alpha0+ (Build ID: efca6f15609322f62a35619619a6d5fe5c9bd5a)

- LibreOffice 3.3.0 
OOO330m19 (Build:6)
tag libreoffice-3.3.0.4
Comment 7 Commit Notification 2017-08-24 13:10:47 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=9fe857b7bd126ff4856fc4689d375881653b97a2

tdf#111934 xmloff: ODF import: self-referential conditional style crash

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2017-08-24 19:28:49 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=6e090b4272b8fa12d2032ff0c0ea4bfb24c0d2d2

tdf#111934: add document for filters-tests

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Michael Stahl (allotropia) 2017-08-24 19:47:27 UTC
fixed on master

also fixed 2 more bugs in getting the error dialog displayed

more fuzzing bugs would certainly be appreciated, filters shouldn't be this easy to crash
Comment 10 Commit Notification 2017-08-25 17:41:13 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1e264bb2bf0dc9d173abff02a078f089669d95cd&h=libreoffice-5-4

tdf#111934 xmloff: ODF import: self-referential conditional style crash

It will be available in 5.4.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 11 Commit Notification 2017-08-25 17:41:23 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=f07bb0fed885f7a13c08f2bc3203e727db7cef1c&h=libreoffice-5-3

tdf#111934 xmloff: ODF import: self-referential conditional style crash

It will be available in 5.3.7.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Jean-Baptiste Faure 2017-08-25 20:17:15 UTC
Verified fixed in LO 5.4.2.0.0+ built at home under Ubuntu 16.04 x86-64.

Version: 5.4.2.0.0+
Build ID: 1e264bb2bf0dc9d173abff02a078f089669d95cd
Threads CPU : 4; OS : Linux 4.4; UI Render : par défaut; VCL : gtk3; 
Ubuntu_16.04_x86-64
Locale : fr-FR (fr_FR.UTF-8); Calc: single

Best regards. JBF