Bug 131273 - Crash when pasting quotes with fixed width
Summary: Crash when pasting quotes with fixed width
Status: VERIFIED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Calc (show other bugs)
Version:
(earliest affected)
7.0.0.0.alpha0+
Hardware: All All
: medium normal
Assignee: Julien Nabet
URL:
Whiteboard: target:7.0.0 target:6.4.3 target:6.3.6
Keywords:
Depends on:
Blocks:
 
Reported: 2020-03-11 10:33 UTC by Heiko Tietze
Modified: 2020-04-03 15:17 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Heiko Tietze 2020-03-11 10:33:18 UTC
Copy something like 1\n" (\n = line break, the second line should contain of just a single quote) and paste this in Calc. Use Fixed Width and see the app crash.

soffice.bin: /home/ht/Sources/libreoffice/sal/rtl/strtmpl.cxx:1390: void rtl_uString_newFromSubString(rtl_uString**, const rtl_uString*, sal_Int32, sal_Int32): Assertion `false' failed.
Application Error
Comment 1 Samuel Mehrbrodt (allotropia) 2020-03-11 10:43:14 UTC
Reproduced in current master. This is what you need to copy:

1
"
Comment 2 Samuel Mehrbrodt (allotropia) 2020-03-11 10:44:43 UTC
Paste unformatted, then choose "Fixed width" in the dialog which appears.

Backtrace:

#3  0x00007ffff7a78006 in __GI___assert_fail
    (assertion=0x7ffff7f8d84b "false", file=0x7ffff7f8ca28 "/libreoffice/core/sal/rtl/strtmpl.cxx", line=1390, function=0x7ffff7f8d7f0 "void rtl_uString_newFromSubString(rtl_uString**, const rtl_uString*, sal_Int32, sal_Int32)") at assert.c:101
#4  0x00007ffff7f379e3 in rtl_uString_newFromSubString(rtl_uString**, rtl_uString const*, sal_Int32, sal_Int32) (ppThis=0x7ffffffefdd0, pFrom=0x55555b5cbb30, beginIndex=1, count=-1)
    at /libreoffice/core/sal/rtl/strtmpl.cxx:1390
#5  0x00007fffdbd89cbc in rtl::OUString::copy(int, int) const
    (this=0x7ffffffefec8, beginIndex=1, count=-1) at /libreoffice/core/include/rtl/ustring.hxx:2256
#6  0x00007fffdcadc844 in lcl_GetFixed(rtl::OUString const&, sal_Int32, sal_Int32, bool&, bool&)
    (rLine="\"", nStart=0, nNext=1, rbIsQuoted=@0x7ffffffefed8: true, rbOverflowCell=@0x5555586e8843: false) at /libreoffice/core/sc/source/ui/docshell/impex.cxx:1281
#7  0x00007fffdcadd31d in ScImportExport::ExtText2Doc(SvStream&) (this=0x5555586e87f0, rStrm=...)
    at /libreoffice/core/sc/source/ui/docshell/impex.cxx:1418
#8  0x00007fffdcad934f in ScImportExport::ImportStream(SvStream&, rtl::OUString const&, SotClipboardFormatId) (this=0x5555586e87f0, rStrm=..., rBaseURL="", nFmt=SotClipboardFormatId::STRING)
    at /libreoffice/core/sc/source/ui/docshell/impex.cxx:383
#9  0x00007fffdcad8beb in ScImportExport::ImportString(rtl::OUString const&, SotClipboardFormatId)
    (this=0x5555586e87f0, rText="\n1\n\"", nFmt=SotClipboardFormatId::STRING)
    at /libreoffice/core/sc/source/ui/docshell/impex.cxx:309
#10 0x00007fffdd07b0a5 in ScViewFunc::<lambda(sal_Int32)>::operator()(sal_Int32) const
    (__closure=0x55555b48b160, nResult=1) at /libreoffice/core/sc/source/ui/view/viewfun5.cxx:361
#11 0x00007fffdd07f3a4 in std::_Function_handler<void(int), ScViewFunc::PasteDataFormat(SotClipboardFormatId, const com::sun::star::uno::Reference<com::sun::star::datatransfer::XTransferable>&, SCCOL, SCROW, const Point*, bool, bool)::<lambda(sal_Int32)> >::_M_invoke(const std::_Any_data &, int &&)
Comment 3 Julien Nabet 2020-03-11 21:07:12 UTC
Don't know if it's a naive patch but I don't reproduce the crash with it:
diff --git a/sc/source/ui/docshell/impex.cxx b/sc/source/ui/docshell/impex.cxx
index f99a8ce5fff5..56aa2e7f2506 100644
--- a/sc/source/ui/docshell/impex.cxx
+++ b/sc/source/ui/docshell/impex.cxx
@@ -1278,7 +1278,7 @@ static OUString lcl_GetFixed( const OUString& rLine, sal_Int32 nStart, sal_Int32
         bool bFits = (nSpace - nStart - 3 <= SAL_MAX_UINT16);
         OSL_ENSURE( bFits, "lcl_GetFixed: line doesn't fit into data");
         if (bFits)
-            return rLine.copy(nStart+1, nSpace-nStart-2);
+            return rLine.copy(nStart+1, std::max(0, nSpace-nStart-2));
         else
         {
             rbOverflowCell = true;
Comment 4 Samuel Mehrbrodt (allotropia) 2020-03-12 08:22:52 UTC
(In reply to Julien Nabet from comment #3)
> Don't know if it's a naive patch but I don't reproduce the crash with it:
> diff --git a/sc/source/ui/docshell/impex.cxx
> b/sc/source/ui/docshell/impex.cxx
> index f99a8ce5fff5..56aa2e7f2506 100644
> --- a/sc/source/ui/docshell/impex.cxx
> +++ b/sc/source/ui/docshell/impex.cxx
> @@ -1278,7 +1278,7 @@ static OUString lcl_GetFixed( const OUString& rLine,
> sal_Int32 nStart, sal_Int32
>          bool bFits = (nSpace - nStart - 3 <= SAL_MAX_UINT16);
>          OSL_ENSURE( bFits, "lcl_GetFixed: line doesn't fit into data");
>          if (bFits)
> -            return rLine.copy(nStart+1, nSpace-nStart-2);
> +            return rLine.copy(nStart+1, std::max(0, nSpace-nStart-2));
>          else
>          {
>              rbOverflowCell = true;

Just upload to gerrit. Thx!
Comment 5 Julien Nabet 2020-03-12 08:27:59 UTC
(In reply to Samuel Mehrbrodt (CIB) from comment #4)
>> ...
> 
> Just upload to gerrit. Thx!
No pb but I'll be able to do this only after my day time job. If you're in a hurry, don't hesitate to submit the patch.
Comment 6 Julien Nabet 2020-03-12 18:46:12 UTC
Patch submitted on gerrit here:
https://gerrit.libreoffice.org/c/core/+/90438
Comment 7 Julien Nabet 2020-03-15 08:53:49 UTC
Backport for 6.4 waiting for review here:
https://gerrit.libreoffice.org/c/core/+/90398
Comment 8 Commit Notification 2020-03-15 08:54:06 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/cf3fec9e7cadd0a6c4f42a4015df429d9e32b7e8

tdf#131273: fix crash when pasting quotes with fixed width

It will be available in 7.0.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 9 Xisco Faulí 2020-03-19 16:48:21 UTC
@Heiko, could you please verify the issue is fixed ?
I can't reproduce the original problem...
Comment 10 Heiko Tietze 2020-03-20 09:34:05 UTC
No crash anymore. Just to mention: pasting this content in 6.4 showed "!!br0ken!!" in the cell which is empty now. That's good but all feedback is gone, which is bad. An infobar with the statement "Some cells couldn't be pasted" would be nice.
Comment 11 Julien Nabet 2020-03-20 10:22:39 UTC
(In reply to Heiko Tietze from comment #10)
> No crash anymore. Just to mention: pasting this content in 6.4 showed
> "!!br0ken!!" in the cell which is empty now. That's good but all feedback is
> gone, which is bad. An infobar with the statement "Some cells couldn't be
> pasted" would be nice.

Here the steps I did:
- put in a text file:
1
"
- copy paste these on Calc
=> it opened dialog Text Import
- Click Ok
The selected cell contains just "1" (without the quotes)

Did I miss something?
Comment 12 Heiko Tietze 2020-03-20 12:48:54 UTC
(In reply to Julien Nabet from comment #11)
> Did I miss something?

No, except the fixed width setting. And as I said, the crash is fixed. But compared to older versions we lack on feedback, not because of this patch.
Comment 13 Commit Notification 2020-03-25 11:39:44 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-6-4":

https://git.libreoffice.org/core/commit/3d264dc8742733a797a3e315033851d0bda3bffd

tdf#131273: fix crash when pasting quotes with fixed width

It will be available in 6.4.3.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 14 Xisco Faulí 2020-03-25 11:48:10 UTC
(In reply to Heiko Tietze from comment #12)
> (In reply to Julien Nabet from comment #11)
> > Did I miss something?
> 
> No, except the fixed width setting. And as I said, the crash is fixed. But
> compared to older versions we lack on feedback, not because of this patch.

Please, create a new report for that. Thanks
Comment 15 Commit Notification 2020-04-03 15:17:53 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-6-3":

https://git.libreoffice.org/core/commit/41d90ebc2f53df095c8b66d3cd31adef2a5304c9

tdf#131273: fix crash when pasting quotes with fixed width

It will be available in 6.3.6.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.