Bug 112017 - FILEOPEN: Crash with Application Error when opening file with nested draw elements
Summary: FILEOPEN: Crash with Application Error when opening file with nested draw ele...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: filters and storage (show other bugs)
Version:
(earliest affected)
4.4.6.3 release
Hardware: All All
: medium major
Assignee: Caolán McNamara
QA Contact:
URL:
Whiteboard: target:6.0.0 target:5.4.2 target:5.3.7
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2017-08-24 20:36 UTC by Dinh Le
Modified: 2017-08-30 08:15 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments
crashes with application error (1.94 KB, application/vnd.oasis.opendocument.text)
2017-08-24 20:37 UTC, Dinh Le
Details
A second testcase which has slightly different content (1.96 KB, application/vnd.oasis.opendocument.text)
2017-08-24 20:38 UTC, Dinh Le
Details
stacktrace of error (4.33 KB, text/plain)
2017-08-24 20:39 UTC, Dinh Le
Details
bt with debug symbols (14.94 KB, text/plain)
2017-08-25 16:55 UTC, Julien Nabet
Details
bt from xml error (15.78 KB, text/plain)
2017-08-25 17:09 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Dinh Le 2017-08-24 20:36:13 UTC
Description:
Opening the file leads to a crash with  Application Error Fatal Exception: Signal 6

Tested it on version 5.3.5.2 on Ubuntu 16.04.2 LTS.


Steps to Reproduce:
1.Open the file

Actual Results:  
crashes

Expected Results:
Getting parsing error


Reproducible: Always

User Profile Reset: No

Additional Info:


User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.101 Safari/537.36
Comment 1 Dinh Le 2017-08-24 20:37:11 UTC
Created attachment 135773 [details]
crashes with application error
Comment 2 Dinh Le 2017-08-24 20:38:00 UTC
Created attachment 135774 [details]
A second testcase which has slightly different content
Comment 3 Dinh Le 2017-08-24 20:39:12 UTC
Created attachment 135775 [details]
stacktrace of error
Comment 4 Telesto 2017-08-25 10:28:14 UTC
Repro with:
Version: 6.0.0.0.alpha0+
Build ID: 02c53f744ed23e2149fc7c83d67cb7d8aa5eb0ed
CPU threads: 4; OS: Windows 6.19; UI render: default; 
TinderBox: Win-x86@42, Branch:master, Time: 2017-08-24_05:48:55
Locale: nl-NL (nl_NL); Calc: CL

and with:
Versie: 4.4.6.3 
Build ID: e8938fd3328e95dcf59dd64e7facd2c7d67c704d
Locale: nl_NL
Comment 5 Julien Nabet 2017-08-25 16:55:28 UTC
Created attachment 135797 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I could reproduce this.
Comment 6 Julien Nabet 2017-08-25 16:57:40 UTC
As indicated in the bt, I noticed this log on console:
warn:sw.uno:13512:1:sw/source/filter/xml/xmltexti.cxx:188: SwXTextCursor missing
Comment 7 Julien Nabet 2017-08-25 16:58:08 UTC
Oups + this:
warn:sw.uno:13512:1:sw/source/filter/xml/xmltexti.cxx:188: SwXTextCursor missing
warn:xmloff:13512:1:xmloff/source/core/xmlerror.cxx:169: An error or a warning has occurred during XML import/export!
Error-Id: 0x20040004
    Flags: 2 ERROR
    Class: 4 API
    Number: 4
Parameters:
    0: com.sun.star.drawing.RectangleShape
Exception-Message: 
Position:
    Public Identifier: 
    System Identifier: 
    Row, Column: 7,0
Comment 8 Julien Nabet 2017-08-25 17:09:18 UTC
Created attachment 135798 [details]
bt from xml error
Comment 9 Commit Notification 2017-08-29 19:58:50 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=79cfd48dae2b986b691bb00a8400c7e9cc2cdda7

Resolves: tdf#112017 crash on particular odt

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 10 Caolán McNamara 2017-08-29 19:59:17 UTC
backports in gerrit
Comment 11 Commit Notification 2017-08-30 08:13:46 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=9c781148593b71eaca1798d4415f63d8bc289899&h=libreoffice-5-4

Resolves: tdf#112017 crash on particular odt

It will be available in 5.4.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2017-08-30 08:15:44 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=932a81e9c31a3a5bf5edad3d9e79b111e19b113d&h=libreoffice-5-3

Resolves: tdf#112017 crash on particular odt

It will be available in 5.3.7.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.