Bug 146718 - Crash in: SwDBManager::MergeMailFiles(SwWrtShell *,SwMergeDescriptor const &) - Mailmerge print form letter, individual documents, path with non-existing user
Summary: Crash in: SwDBManager::MergeMailFiles(SwWrtShell *,SwMergeDescriptor const &)...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.1.8.1 release
Hardware: x86-64 (AMD64) All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard: target:7.5.0
Keywords:
Depends on:
Blocks: Mail-Merge Crash
  Show dependency treegraph
 
Reported: 2022-01-12 13:02 UTC by jncressey
Modified: 2023-10-15 08:29 UTC (History)
5 users (show)

See Also:
Crash report or crash signature: ["SwDBManager::MergeMailFiles(SwWrtShell *,SwMergeDescriptor const &)"]


Attachments
minimal example to use to test (11.08 KB, application/x-zip-compressed)
2022-01-12 16:08 UTC, jncressey
Details

Note You need to log in before you can comment on or make changes to this bug.
Description jncressey 2022-01-12 13:02:06 UTC
This bug was filed from the crash reporting server and is br-0d94ea8f-0ca3-42a0-b77b-c319b7b03519.
=========================================

# Description

## Actual Behaviour

Using the mail merge feature to create and save individual documents, the save folder path can look like it is within a user profile folder that doesn't exist. 

In that case, LibreOffice crashes when the mail merge is started. And the error dialogue shown might not help users find what is wrong; it says 'Action not supported. This operation is not supported on this operating system.' 

The save folder path was as such for me after I had renamed my user profile folder since the previous time that I had done a mail merge, and the path field was already populated with the path I had previously used. 

The path field can also be manually written into, so a user could make it as such by a simple mistake. 

Unknown whether the path field would also populate as such if you had previously targeted a path within another user's profile and had since removed that user from your computer.

## Expected behaviour

User to be alerted that the chosen output folder path doesn't exist and can't be created.

# Steps to reproduce

1. Environment: Windows 10 Verison 21H2

2. Have a registered database.
   
   1. Have a spreadsheet file with tabular data in it.
   2. From LibreOffice, click to create a new Base Database.
   3. Choose 'Connect to an existing database', pick 'Spreadsheet', click 'Next'.
   4. Click 'Browse', select the spreadsheet with the data and click 'Open', then click 'Next'.
   5. Select 'Yes, register the database for me', and click 'Finish'.

3. Add a field from data sources to a Writer document
   
   1. From LibreOffice, click to create a new Writer Document
   2. Save the document as the type 'ODF Text Document (.odt)'.
   3. From the menu bar, click 'View' > 'Data Sources'.
   4. Navigate to the table in the data sources explorer.
   5. Drag from a field heading into the document.

4. From the menu bar, click 'File' > 'Print'.

5. You are asked if you want to print a form letter, click 'Yes'.

6. Under 'Output' select 'File'.

7. Under 'Save merged document' select 'Save as individual documents'.

8. Change the path so that it looks to be within a user profile folder that does not exist, eg 'C:\Users\johnsmith\Documents' if you do not have a user on your computer called johnsmith.

9. Click 'OK'.

10. An error dialogue says 'Action not supported. This operation is not supported on this operating system.'

11. Click 'OK' then LibreOffice crashes. Document Recovery window appears. Mail Merge progress window remains with 'not responding'.
Comment 1 Xisco Faulí 2022-01-12 14:47:06 UTC
Thank you for reporting the bug. Please attach a sample document, as this makes it easier for us to verify the bug. 
I have set the bug's status to 'NEEDINFO'. Please change it back to 'UNCONFIRMED' once the requested document is provided.
(Please note that the attachment will be public, remove any sensitive information before attaching it. 
See https://wiki.documentfoundation.org/QA/FAQ#How_can_I_eliminate_confidential_data_from_a_sample_document.3F for help on how to do so.)
Comment 2 jncressey 2022-01-12 16:08:46 UTC
Created attachment 177496 [details]
minimal example to use to test

I have uploaded the attachments 'datasource.odb' and 'mailmerge.odt', with minimal example data to make it easier to set up to verify. It cuts down the steps 2 and 3, though some steps are still required to ensure the database is connected on your system. Steps 4 to 11 are unchanged.

# Steps to reproduce with provided attachments

1. Environment: Windows 10 Version 21H2
  
2. Extract the attachments from 'minimalexample.zip', and open 'mailmerge.odt' in LibreOffice Writer.
  
3. Use 'Exchange Database...' to update the writer document's reference to the database
  
  1. From the menu bar, click 'Edit' > 'Exchange Database...'
    
  2. Click 'Browse...' and use the dialog to open 'datasource.odb'.
    
  3. Select 'datasource' > 'Table1' from both the lists 'Databases in Use' and 'Available Databases', and click 'Define'.
    
  4. Save changes (File > Save).
    
4. From the menu bar, click 'File' > 'Print'.
  
5. You are asked if you want to print a form letter, click 'Yes'.
  
6. Under 'Output' select 'File'.
  
7. Under 'Save merged document' select 'Save as individual documents'.
  
8. Change the path so that it looks to be within a user profile folder that does not exist, eg 'C:\Users\johnsmith\Documents' if you do not have a user on your computer called johnsmith.
  
9. Click 'OK'.
  
10. An error dialogue says 'Action not supported. This operation is not supported on this operating system.'
  
11. Click 'OK' then LibreOffice crashes. Document Recovery window appears. Mail Merge progress window remains with 'not responding'.
Comment 3 csyu.279 2023-01-20 21:14:05 UTC
I was unable to reproduce bug in:

Version: 7.4.3.2 (x64) / LibreOffice Community
Build ID: 1048a8393ae2eeec98dff31b5c133c5f1d08b890
CPU threads: 8; OS: Windows 10.0 Build 19044; UI render: Skia/Vulkan; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: CL

Version: 7.5.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: 5a1f41a0d3aab15c113651f2edc9d4137ae99063
CPU threads: 8; OS: Windows 10.0 Build 19044; UI render: Skia/Raster; VCL: win
Locale: en-US (en_US); UI: en-US
Calc: threaded
Comment 4 Stéphane Guillou (stragu) 2023-10-11 20:05:13 UTC
Using the steps in comment 2, crash reproduced in 7.4:

Version: 7.4.7.2 / LibreOffice Community
Build ID: 723314e595e8007d3cf785c16538505a1c878ca5
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

However, no crash anymore since 7.5:

Version: 7.5.7.1 (X86_64) / LibreOffice Community
Build ID: 47eb0cf7efbacdee9b19ae25d6752381ede23126
CPU threads: 8; OS: Linux 5.15; UI render: default; VCL: gtk3
Locale: en-AU (en_AU.UTF-8); UI: en-US
Calc: threaded

I bibisected the fix with the linux-64-7.5 repo to Miklos' c400c36018e8d89bbf8e551258a480c8f6571efe:

commit c400c36018e8d89bbf8e551258a480c8f6571efe
author	Miklos Vajna Fri Nov 04 18:07:13 2022 +0100
committer	Miklos Vajna	Fri Nov 04 21:07:03 2022 +0100
sw: fix heap-use-after-free in SwDBManager::MergeMailFiles()
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/142282

Thank you Miklos!