Bug Hunting Session
Bug 120706 - Crash in: SbxArray::Count() when trying to call a WinAPI function
Summary: Crash in: SbxArray::Count() when trying to call a WinAPI function
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: BASIC (show other bugs)
Version:
(earliest affected)
6.1.2.1 release
Hardware: All All
: medium normal
Assignee: Mike Kaganski
URL:
Whiteboard: target:6.2.0 target:6.1.4
Keywords:
Depends on:
Blocks:
 
Reported: 2018-10-19 12:46 UTC by Mike Kaganski
Modified: 2018-10-20 12:44 UTC (History)
0 users

See Also:
Crash report or crash signature: ["SbxArray::Count()"]


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Kaganski 2018-10-19 12:46:33 UTC
This bug was filed from the crash reporting server and is br-40075a0f-fe06-47d8-b3ed-df62a4caa89a.
=========================================

This macro crashes LibreOffice:

> Private Declare Function GetTickCount Lib "kernel32" () as Long
> 
> sub tst
>   Dim time as Long
>   time = GetTickCount()
> end sub

(see https://ask.libreoffice.org/en/question/169310/how-to-call-winapi-in-64-bit-libreoffice/).
Comment 1 Mike Kaganski 2018-10-19 12:53:31 UTC
This is the error in ErrCode call() in basic/source/runtime/dllmgr-x64.cxx, where it dereferences `arguments` before checking it for nullptr (as done below, and as mentioned in a comment to SbiRuntime::DllCall()). 32-bit version of the function doesn't have this problem.
Comment 2 Mike Kaganski 2018-10-19 12:56:00 UTC
https://gerrit.libreoffice.org/62005
Comment 3 Commit Notification 2018-10-19 18:32:00 UTC
Mike Kaganski committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=49d304c4f6635381a27b60a8944744cc81ff1e91

tdf#120706: nullptr dereference

It will be available in 6.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 4 Commit Notification 2018-10-20 12:44:04 UTC
Mike Kaganski committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=7951138541caabcd25fccaa8f9ebb0226ce2ce12&h=libreoffice-6-1

tdf#120706: nullptr dereference

It will be available in 6.1.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.