Bug 112018 - FILEOPEN: Hang on file with negative table:number-columns-repeated
Summary: FILEOPEN: Hang on file with negative table:number-columns-repeated
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: filters and storage (show other bugs)
Version:
(earliest affected)
5.3.5.2 release
Hardware: All All
: medium normal
Assignee: Caolán McNamara
URL:
Whiteboard: target:6.0.0 target:5.4.2 target:5.3.7
Keywords:
Depends on:
Blocks:
 
Reported: 2017-08-24 22:17 UTC by Dinh Le
Modified: 2017-09-06 08:41 UTC (History)
0 users

See Also:
Crash report or crash signature:


Attachments
Hangs with high memory usage (2.78 KB, application/vnd.oasis.opendocument.text)
2017-08-24 22:18 UTC, Dinh Le
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Dinh Le 2017-08-24 22:17:38 UTC
Description:
Opening leads to a hang with very fast memory usage growth. 
16gb of memory is consumed within less than half a minute

Should be an invalid file as table:number-columns-repeated must be positive.

Tested it on version 5.3.5.2 on Ubuntu 16.04.2 LTS.

On Windows 10 it leads to fatal error: bad allocation instead of hang

Steps to Reproduce:
1.Open the file

Actual Results:  
hangs with very high memory usage

Expected Results:
getting parsing error


Reproducible: Always

User Profile Reset: No

Additional Info:


User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.101 Safari/537.36
Comment 1 Dinh Le 2017-08-24 22:18:19 UTC
Created attachment 135778 [details]
Hangs with high memory usage
Comment 2 MM 2017-08-28 20:34:25 UTC
Confirmed with Version: 6.0.0.0.alpha0+
Build ID: b9f85538e65882238de80ab36c864bc0082ad7f4
CPU threads: 2; OS: Linux 4.4; UI render: default; VCL: gtk2; 
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2017-08-20_00:40:11
Locale: en-US (en_US.UTF-8); Calc: single
Comment 3 Commit Notification 2017-08-29 13:06:23 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=384abc0615b22c586544689d5e28e92c0e74481e

Related: tdf#112018 limit to min of 1 before conversion from signed int

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 4 Caolán McNamara 2017-08-29 13:11:47 UTC
5-4 backport in gerrit
Comment 5 Commit Notification 2017-08-29 13:11:48 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=3415764d00044a19568b3a1b5d5382c73a0342c9

Resolves: tdf#112018 number-columns-repeated has the data type positiveInteger

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 6 Commit Notification 2017-08-29 15:24:43 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=d2eb1a06fdd823a985c0e1f58df6c92bcc1f3629&h=libreoffice-5-4

Related: tdf#112018 limit to min of 1 before conversion from signed int

It will be available in 5.4.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 Commit Notification 2017-08-29 15:24:50 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-4":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=dccb73d961799a88f5fd28423808f184db5de985&h=libreoffice-5-4

Resolves: tdf#112018 number-columns-repeated has the data type positiveInteger

It will be available in 5.4.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2017-09-06 08:41:03 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-5-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=eab61f66c6cfa4b290c8789a375e6894be054f32&h=libreoffice-5-3

Resolves: tdf#112018 number-columns-repeated has the data type positiveInteger

It will be available in 5.3.7.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.