Bug 113871 - writer crashes when scrolling Doc file
Summary: writer crashes when scrolling Doc file
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected) release
Hardware: All All
: medium normal
Assignee: Caolán McNamara
Whiteboard: target:6.0.0
Keywords: haveBacktrace
Depends on:
Reported: 2017-11-16 06:22 UTC by Fahad Al-Saidi
Modified: 2017-11-17 09:15 UTC (History)
3 users (show)

See Also:
Crash report or crash signature: ["ucrtbase.dll"]

the problematic file (216.00 KB, application/msword)
2017-11-16 06:23 UTC, Fahad Al-Saidi
gdb backtrace (36.82 KB, text/plain)
2017-11-16 11:16 UTC, Xisco Faulí

Note You need to log in before you can comment on or make changes to this bug.
Description Fahad Al-Saidi 2017-11-16 06:22:53 UTC
I have doc file, when I try to open it and just scrolling down writer crash !! The file attached.

Actual Results:  
Writer crashes

Expected Results:
should be open the file without crash.

Reproducible: Always

User Profile Reset: Yes

Additional Info:

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0
Comment 1 Fahad Al-Saidi 2017-11-16 06:23:36 UTC
Created attachment 137799 [details]
the problematic file
Comment 2 Dieter 2017-11-16 07:51:42 UTC
Not reproducible for me with Windows 10. Perhaps it's only a Linux problem.

Version: (x64)
Build-ID: 92a7159f7e4af62137622921e809f8546db437e5
CPU-Threads: 4; Betriebssystem:Windows 6.19; UI-Render: Standard; 
Gebietsschema: de-DE (de_DE); Calc: group
Comment 3 Aschalew 2017-11-16 08:31:48 UTC
Can not reproduce!
it works fine!

Windows 10

Version: (x64)
Build ID: 92a7159f7e4af62137622921e809f8546db437e5
CPU threads: 8; OS: Windows 6.19; UI render: default; 
Locale: en-US (en_US); Calc: group
Comment 4 Fahad Al-Saidi 2017-11-16 08:32:55 UTC
please make sure to scroll down till the end of the doc.
Comment 5 Xisco Faulí 2017-11-16 09:30:05 UTC
Yep, it crashes for me when I scroll down from page 1 to page 10

Build ID: a5550289a37950195b7a7e5b22cba79ce5b5a673
CPU threads: 4; OS: Linux 4.10; UI render: default; VCL: gtk3; 
Locale: th-TH (ca_ES.UTF-8); Calc: group
Comment 6 Xisco Faulí 2017-11-16 09:41:37 UTC
Also reproduced in

Id. de compilación: 92a7159f7e4af62137622921e809f8546db437e5
Subprocs. CPU: 1; SO: Windows 6.1; Repres. IU: predet.; 
Configuración regional: es-ES (es_ES); Calc: group
Comment 7 Xisco Faulí 2017-11-16 10:10:54 UTC
Surprisingly, I can't reproduce it with any bibisect repository...
Comment 8 Xisco Faulí 2017-11-16 11:16:02 UTC
Created attachment 137806 [details]
gdb backtrace

Using a debug build, I can reproduce the crash if I scroll the document using the scrollbar
Comment 9 Xisco Faulí 2017-11-16 11:17:37 UTC
@Caolán, Michael, one for you?
Comment 10 Caolán McNamara 2017-11-16 14:23:39 UTC
I have a plausible fix at https://gerrit.libreoffice.org/#/c/44831/ based on the same logic the code following the crash uses to restrict the kashida index to a valid range
Comment 11 Commit Notification 2017-11-17 09:10:24 UTC
Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":


Resolves: tdf#113871 bounds check kashida pos

It will be available in 6.0.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:

Affected users are encouraged to test the fix and report feedback.
Comment 12 Fahad Al-Saidi 2017-11-17 09:15:09 UTC
@Caolán can you backport it to 5.4?