Bug 128208 - OOoSpotlightImporter.mdimporter causes segfault in mdworker macOS 10.15 Catalina with particular malformed empty ODB file
Summary: OOoSpotlightImporter.mdimporter causes segfault in mdworker macOS 10.15 Catal...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
6.3.2.2 release
Hardware: All macOS (All)
: medium normal
Assignee: Not Assigned
URL:
Whiteboard: target:6.4.0
Keywords:
Depends on:
Blocks:
 
Reported: 2019-10-17 12:23 UTC by Alex Thurgood
Modified: 2019-11-06 09:57 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
File causing LO Spotlight mdimporter to crash (3.59 KB, application/vnd.oasis.opendocument.database)
2019-10-17 12:29 UTC, Alex Thurgood
Details
Crash log (58.89 KB, text/plain)
2019-10-17 12:46 UTC, Alex Thurgood
Details
bt with debug symbols (19.40 KB, text/plain)
2019-10-17 20:28 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Thurgood 2019-10-17 12:23:45 UTC
Description:
mdworker segfaults regularly when calling OOoSpotlightImporter.mdimporter

The segfault appears to be caused by the attached ODB file.

Steps to Reproduce:
1) Start LibreOffice, do some work with it.
2) Check in Console.app crash logs
3) Note the entries for mdworker.

Actual Results:
mdworker crashes repeatedly due to LO Spotlight importer.

Expected Results:
mdworker shouldn't crash because of the LO Spotlight importer


Reproducible: Always


User Profile Reset: Yes



Additional Info:
Comment 1 Alex Thurgood 2019-10-17 12:29:07 UTC
Created attachment 155080 [details]
File causing LO Spotlight mdimporter to crash
Comment 2 Alex Thurgood 2019-10-17 12:30:42 UTC
The file is a basic empty ODB file with no tables or queries, created with the wizard in an earlier version of LO (can't remember which one).
Comment 3 Alex Thurgood 2019-10-17 12:46:33 UTC
Created attachment 155084 [details]
Crash log
Comment 4 Julien Nabet 2019-10-17 18:41:50 UTC
Just for curiosity, is it a recent behaviour? I mean, is it specific to Catalina?
Comment 5 Julien Nabet 2019-10-17 18:45:35 UTC
Forget my comment, answer is just in title :-)
Comment 6 Julien Nabet 2019-10-17 18:57:16 UTC
It seems there's a pb with the zip file:
julien@debianamd:/tmp$ unzip -t abinitio.odb 
Archive:  abinitio.odb
error [abinitio.odb]:  missing 9090 bytes in zipfile
  (attempting to process anyway)
error: invalid zip file with overlapped components (possible zip bomb)


julien@debianamd:/tmp$ zip abinitio.odb 
	zip warning: expected 26 entries but found 0

zip error: Zip file structure invalid (abinitio.odb)


Fix archive (-F) - assume mostly intact archive
Zip entry offsets appear off by -9090 bytes - correcting...
 copying: mimetype
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: mimetype
 copying: forms/Obj11/meta.xml
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/meta.xml
 copying: forms/Obj11/settings.xml
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/settings.xml
 copying: forms/Obj11/content.xml
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/content.xml
 copying: forms/Obj11/manifest.rdf
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/manifest.rdf
 copying: forms/Obj11/Configurations2/popupmenu/
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/Configurations2/popupmenu/
 copying: forms/Obj11/Configurations2/images/Bitmaps/
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/Configurations2/images/Bitmaps/
 copying: forms/Obj11/Configurations2/toolpanel/
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/Configurations2/toolpanel/
 copying: forms/Obj11/Configurations2/statusbar/
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/Configurations2/statusbar/
 copying: forms/Obj11/Configurations2/toolbar/
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/Configurations2/toolbar/
 copying: forms/Obj11/Configurations2/progressbar/
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/Configurations2/progressbar/
 copying: forms/Obj11/Configurations2/menubar/
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/Configurations2/menubar/
 copying: forms/Obj11/Configurations2/floater/
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/Configurations2/floater/
 copying: forms/Obj11/Configurations2/accelerator/current.xml
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/Configurations2/accelerator/current.xml
 copying: forms/Obj11/styles.xml
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: forms/Obj11/styles.xml
 copying: database/data
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: database/data
 copying: database/script
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: database/script
 copying: database/backup
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: database/backup
 copying: database/properties
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: database/properties
 copying: database/log
	zip warning: reading archive fseek: Invalid argument
	zip warning: bad - skipping: database/log
 copying: reports/
 copying: settings.xml
 copying: META-INF/
 copying: content.xml
 copying: Configurations2/
 copying: META-INF/manifest.xml
Comment 7 Julien Nabet 2019-10-17 18:59:15 UTC
Trying to open the file with master sources updated yesterday, it detects a odt!
Throwing InvalidHeaderException
Throwing InvalidHeaderException
WPSDocument::isFileFormatSupported()
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
Throwing InvalidHeaderException
WPSDocument::isFileFormatSupported()
Throwing InvalidHeaderException
AbiDocument::isFileFormatSupported
Found xml parser severity error Document is empty

WPSDocument::isFileFormatSupported()
WPSDocument::isFileFormatSupported()
WPSDocument::isFileFormatSupported()
WPSDocument::isFileFormatSupported()
Throwing InvalidHeaderException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
WPSDocument::isFileFormatSupported()
warn:oox.storage:12047:12047:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
VisioDocument: version 0
Found xml parser severity error Document is empty

warn:legacy.osl:12047:12047:sw/source/filter/ascii/parasc.cxx:264: Autodetect of text import without nag dialog must have failed
Comment 8 Julien Nabet 2019-10-17 19:18:09 UTC
Tor/Stephan: even if the zip file is corrupted, I think LO shouldn't crash.
I took a look to the crash log and the stack chain is:
GetMetadataForFile -> OOoSpotlightImporter importDocument:contentType:attributes -> OOoSpotlightImporter openZipFileAtPath -> readCentralDirectoryEntry -> readInt

then taking a look at "GetMetadataForFile", we got:
However, considering this code:
47     Boolean importOK = NO;
48     @try {
49         importOK = [importer importDocument:(NSString*)pathToFile
50                                 contentType:(NSString*)contentTypeUTI
51                                  attributes:(NSMutableDictionary*)attributes];
52     }
53     @catch (NSException *exception) {
54         NSLog(@"main: Caught %@: %@", [exception name], [exception  reason]);
55     }
see 
https://opengrok.libreoffice.org/xref/core/extensions/source/macosx/spotlight/GetMetadataForFile.m?r=c5a51893#34

Shouldn't the catch block catches any pb here?
How to prevent LO from crashing?
Comment 9 Julien Nabet 2019-10-17 20:07:45 UTC
The odb file seems really corrupted.
I used hexedit to see beginning of the file, I've got:
00000000   0C 00 00 00

So it's not even zip signature:
00000000   50 4B 03 04

See https://stackoverflow.com/questions/1887041/what-is-a-good-way-to-test-a-file-to-see-if-its-a-zip-file

I've a created a brand new odb file, the signature is indeed present.
Comment 10 Julien Nabet 2019-10-17 20:28:26 UTC
Created attachment 155097 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I retrieved a bt from ZipFile::readCEN() when throwing ZipException("Invalid END header (bad central directory size)" )

See https://opengrok.libreoffice.org/xref/core/package/source/zipapi/ZipFile.cxx?r=ee22409a#901

I'll give it a try on Windows to compare.
Anyway, it can give some hints to avoid the crash on Mac.
Comment 11 Commit Notification 2019-10-17 21:50:05 UTC
Tor Lillqvist committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/f8b80054751e83de669f607336e0f24515ea5e35

tdf#128208: Add a testbench for the Spotlight importer

It will be available in 6.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 12 Commit Notification 2019-10-17 21:50:14 UTC
Tor Lillqvist committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/d2b36c2674ab382140cf8aa5a4ea457065152f4c

tdf#128208: Don't crash if the zip archive is broken

It will be available in 6.4.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 13 Julien Nabet 2019-10-18 07:19:54 UTC
On Win10 with master sources updated today, it opens Calc and shows gibberish.

I noticed this on console:
warn:oox.storage:7396:2716:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
Throwing InvalidHeaderException
Throwing InvalidHeaderException
warn:oox.storage:7396:2716:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
Throwing InvalidHeaderException
Throwing InvalidHeaderException
AbiDocument::isFileFormatSupported
Found xml parser severity error Document is empty

Throwing InvalidHeaderException
warn:oox.storage:7396:2716:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
warn:oox.storage:7396:2716:oox/source/helper/zipstorage.cxx:67: ZipStorage::ZipStorage exception opening input storage com.sun.star.io.IOException
Comment 14 How can I remove my account? 2019-10-18 07:31:40 UTC
Trying to open the .odb document in question in LibreOffice is irrelevant as the Spotlight importer doesn't use any LibreOffice code at all to "import" documents. (Which is sad, and means that it is able to "import" only a very restricted subset of document types (ODF, which the importer parses completely by itself using its own ZIP uncompressing, ODF and XML parsing code), and fixing that should be a separate enhancement request.)
Comment 15 Julien Nabet 2019-10-18 07:36:03 UTC
My goal was just to know if it crashes in other envs.
Now, I don't have a Windows 32 which seems to have specific code to deal with zip, see shell/source/win32/zipfile/ (unless it's dead code?)

(This odb file is some kind of fuzzing test and it allowed to indeed pinpoint a pb in OOoSpotlightImporter.mdimporter)
Comment 16 Xisco Faulí 2019-10-23 14:29:37 UTC
Hi  Alex Thurgood,
is this issue still reproducible in master ?
Comment 17 Alex Thurgood 2019-11-06 09:57:39 UTC
Seems to be fixed now in master, at least with my own build. Thanks Tor !