Bug 150992 - CRASH: applying popart filter to an SVG image
Summary: CRASH: applying popart filter to an SVG image
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
7.3.6.2 release
Hardware: All All
: medium normal
Assignee: Julien Nabet
URL:
Whiteboard: target:7.5.0 target:7.4.2 target:7.3.7
Keywords: haveBacktrace
: 136827 (view as bug list)
Depends on:
Blocks:
 
Reported: 2022-09-16 13:26 UTC by csongor
Modified: 2022-09-20 12:06 UTC (History)
5 users (show)

See Also:
Crash report or crash signature:

Attachments
illustration how LO Writer crashes when Pop Art filter is applied on an SVG image (28.35 KB, application/vnd.oasis.opendocument.text)
2022-09-16 13:26 UTC, csongor 		Details
bt with debug symbols (7.32 KB, text/plain)
2022-09-16 15:57 UTC, Julien Nabet 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description csongor 2022-09-16 13:26:38 UTC 
Created attachment 182491 [details]
illustration how LO Writer crashes when Pop Art filter is applied on an SVG image

The attached demo file contains an SVG image. If you apply the Pop Art filter, LO crashes. 

This bug is not identical to Bug #127913 because that one was about raster images. That bug has  been fixed but this one is a different one.
Comment 1 csongor 2022-09-16 13:29:41 UTC 
Note: all the other filters work well, just Pop Art was the first one I tried. Bad luck. :)
Comment 2 Julien Nabet 2022-09-16 15:57:27 UTC 
Created attachment 182499 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated today, I got an assertion.

I noticed this:
(gdb) frame 6
#6  0x00007f018c80186f in BitmapPalette::operator[] (this=0x5576a198fe48, nIndex=176) at vcl/source/bitmap/bitmappalette.cxx:139
139	    assert(nIndex < mpImpl->GetBitmapData().size() && "Palette index is out of range");
(gdb) p nIndex
$1 = 176
(gdb) p mpImpl->GetBitmapData().size()
$2 = 34

Before sorting, aPopArtTable state is:
std::__debug::vector of length 256, capacity 256 = {{mnIndex = 0, mnCount = 6160}, {mnIndex = 1, mnCount = 162}, {mnIndex = 2, mnCount = 148}, {mnIndex = 3, mnCount = 116}, {mnIndex = 4, mnCount = 119}, {
    mnIndex = 5, mnCount = 103}, {mnIndex = 6, mnCount = 89}, {mnIndex = 7, mnCount = 89}, {mnIndex = 8, mnCount = 84}, {mnIndex = 9, mnCount = 108}, {mnIndex = 10, mnCount = 102}, {mnIndex = 11, 
    mnCount = 92}, {mnIndex = 12, mnCount = 94}, {mnIndex = 13, mnCount = 87}, {mnIndex = 14, mnCount = 77}, {mnIndex = 15, mnCount = 111}, {mnIndex = 16, mnCount = 83}, {mnIndex = 17, mnCount = 100}, {
    mnIndex = 18, mnCount = 100}, {mnIndex = 19, mnCount = 97}, {mnIndex = 20, mnCount = 107}, {mnIndex = 21, mnCount = 93}, {mnIndex = 22, mnCount = 88}, {mnIndex = 23, mnCount = 106}, {mnIndex = 24, 
    mnCount = 102}, {mnIndex = 25, mnCount = 96}, {mnIndex = 26, mnCount = 111}, {mnIndex = 27, mnCount = 107}, {mnIndex = 28, mnCount = 111}, {mnIndex = 29, mnCount = 147}, {mnIndex = 30, mnCount = 149}, {
    mnIndex = 31, mnCount = 140677}, {mnIndex = 32, mnCount = 0}, {mnIndex = 33, mnCount = 0}, {mnIndex = 34, mnCount = 0}, {mnIndex = 35, mnCount = 0}, {mnIndex = 36, mnCount = 0}, {mnIndex = 37, 
    mnCount = 0}, {mnIndex = 38, mnCount = 0}, {mnIndex = 39, mnCount = 0}, {mnIndex = 40, mnCount = 0}, {mnIndex = 41, mnCount = 0}, {mnIndex = 42, mnCount = 0}, {mnIndex = 43, mnCount = 0}, {mnIndex = 44, 
    mnCount = 0}, {mnIndex = 45, mnCount = 0}, {mnIndex = 46, mnCount = 0}, {mnIndex = 47, mnCount = 0}, {mnIndex = 48, mnCount = 0}, {mnIndex = 49, mnCount = 0}, {mnIndex = 50, mnCount = 0}, {mnIndex = 51, 
    mnCount = 0}, {mnIndex = 52, mnCount = 0}, {mnIndex = 53, mnCount = 0}, {mnIndex = 54, mnCount = 0}, {mnIndex = 55, mnCount = 0}, {mnIndex = 56, mnCount = 0}, {mnIndex = 57, mnCount = 0}, {mnIndex = 58, 
    mnCount = 0}, {mnIndex = 59, mnCount = 0}, {mnIndex = 60, mnCount = 0}, {mnIndex = 61, mnCount = 0}, {mnIndex = 62, mnCount = 0}, {mnIndex = 63, mnCount = 0}, {mnIndex = 64, mnCount = 0}, {mnIndex = 65, 
    mnCount = 0}, {mnIndex = 66, mnCount = 0}, {mnIndex = 67, mnCount = 0}, {mnIndex = 68, mnCount = 0}, {mnIndex = 69, mnCount = 0}, {mnIndex = 70, mnCount = 0}, {mnIndex = 71, mnCount = 0}, {mnIndex = 72, 
    mnCount = 0}, {mnIndex = 73, mnCount = 0}, {mnIndex = 74, mnCount = 0}, {mnIndex = 75, mnCount = 0}, {mnIndex = 76, mnCount = 0}, {mnIndex = 77, mnCount = 0}, {mnIndex = 78, mnCount = 0}, {mnIndex = 79, 
    mnCount = 0}, {mnIndex = 80, mnCount = 0}, {mnIndex = 81, mnCount = 0}, {mnIndex = 82, mnCount = 0}, {mnIndex = 83, mnCount = 0}, {mnIndex = 84, mnCount = 0}, {mnIndex = 85, mnCount = 0}, {mnIndex = 86, 
    mnCount = 0}, {mnIndex = 87, mnCount = 0}, {mnIndex = 88, mnCount = 0}, {mnIndex = 89, mnCount = 0}, {mnIndex = 90, mnCount = 0}, {mnIndex = 91, mnCount = 0}, {mnIndex = 92, mnCount = 0}, {mnIndex = 93, 
    mnCount = 0}, {mnIndex = 94, mnCount = 0}, {mnIndex = 95, mnCount = 0}, {mnIndex = 96, mnCount = 0}, {mnIndex = 97, mnCount = 0}, {mnIndex = 98, mnCount = 0}, {mnIndex = 99, mnCount = 0}, {mnIndex = 100, 
    mnCount = 0}, {mnIndex = 101, mnCount = 0}, {mnIndex = 102, mnCount = 0}, {mnIndex = 103, mnCount = 0}, {mnIndex = 104, mnCount = 0}, {mnIndex = 105, mnCount = 0}, {mnIndex = 106, mnCount = 0}, {
    mnIndex = 107, mnCount = 0}, {mnIndex = 108, mnCount = 0}, {mnIndex = 109, mnCount = 0}, {mnIndex = 110, mnCount = 0}, {mnIndex = 111, mnCount = 0}, {mnIndex = 112, mnCount = 0}, {mnIndex = 113, 
    mnCount = 0}, {mnIndex = 114, mnCount = 0}, {mnIndex = 115, mnCount = 0}, {mnIndex = 116, mnCount = 0}, {mnIndex = 117, mnCount = 0}, {mnIndex = 118, mnCount = 0}, {mnIndex = 119, mnCount = 0}, {
    mnIndex = 120, mnCount = 0}, {mnIndex = 121, mnCount = 0}, {mnIndex = 122, mnCount = 0}, {mnIndex = 123, mnCount = 0}, {mnIndex = 124, mnCount = 0}, {mnIndex = 125, mnCount = 0}, {mnIndex = 126, 
    mnCount = 0}, {mnIndex = 127, mnCount = 0}, {mnIndex = 128, mnCount = 0}, {mnIndex = 129, mnCount = 0}, {mnIndex = 130, mnCount = 0}, {mnIndex = 131, mnCount = 0}, {mnIndex = 132, mnCount = 0}, {
    mnIndex = 133, mnCount = 0}, {mnIndex = 134, mnCount = 0}, {mnIndex = 135, mnCount = 0}, {mnIndex = 136, mnCount = 0}, {mnIndex = 137, mnCount = 0}, {mnIndex = 138, mnCount = 0}, {mnIndex = 139, 
    mnCount = 0}, {mnIndex = 140, mnCount = 0}, {mnIndex = 141, mnCount = 0}, {mnIndex = 142, mnCount = 0}, {mnIndex = 143, mnCount = 0}, {mnIndex = 144, mnCount = 0}, {mnIndex = 145, mnCount = 0}, {
    mnIndex = 146, mnCount = 0}, {mnIndex = 147, mnCount = 0}, {mnIndex = 148, mnCount = 0}, {mnIndex = 149, mnCount = 0}, {mnIndex = 150, mnCount = 0}, {mnIndex = 151, mnCount = 0}, {mnIndex = 152, 
    mnCount = 0}, {mnIndex = 153, mnCount = 0}, {mnIndex = 154, mnCount = 0}, {mnIndex = 155, mnCount = 0}, {mnIndex = 156, mnCount = 0}, {mnIndex = 157, mnCount = 0}, {mnIndex = 158, mnCount = 0}, {
    mnIndex = 159, mnCount = 0}, {mnIndex = 160, mnCount = 0}, {mnIndex = 161, mnCount = 0}, {mnIndex = 162, mnCount = 0}, {mnIndex = 163, mnCount = 0}, {mnIndex = 164, mnCount = 0}, {mnIndex = 165, 
    mnCount = 0}, {mnIndex = 166, mnCount = 0}, {mnIndex = 167, mnCount = 0}, {mnIndex = 168, mnCount = 0}, {mnIndex = 169, mnCount = 0}, {mnIndex = 170, mnCount = 0}, {mnIndex = 171, mnCount = 0}, {
    mnIndex = 172, mnCount = 0}, {mnIndex = 173, mnCount = 0}, {mnIndex = 174, mnCount = 0}, {mnIndex = 175, mnCount = 0}, {mnIndex = 176, mnCount = 0}, {mnIndex = 177, mnCount = 0}, {mnIndex = 178, 
    mnCount = 0}, {mnIndex = 179, mnCount = 0}, {mnIndex = 180, mnCount = 0}, {mnIndex = 181, mnCount = 0}, {mnIndex = 182, mnCount = 0}, {mnIndex = 183, mnCount = 0}, {mnIndex = 184, mnCount = 0}, {
    mnIndex = 185, mnCount = 0}, {mnIndex = 186, mnCount = 0}, {mnIndex = 187, mnCount = 0}, {mnIndex = 188, mnCount = 0}, {mnIndex = 189, mnCount = 0}, {mnIndex = 190, mnCount = 0}, {mnIndex = 191, 
    mnCount = 0}, {mnIndex = 192, mnCount = 0}, {mnIndex = 193, mnCount = 0}, {mnIndex = 194, mnCount = 0}, {mnIndex = 195, mnCount = 0}, {mnIndex = 196, mnCount = 0}, {mnIndex = 197, mnCount = 0}, {
    mnIndex = 198, mnCount = 0}, {mnIndex = 199, mnCount = 0}...}

after sorting:
std::__debug::vector of length 256, capacity 256 = {{mnIndex = 176, mnCount = 0}, {mnIndex = 161, mnCount = 0}, {mnIndex = 162, mnCount = 0}, {mnIndex = 163, mnCount = 0}, {mnIndex = 164, mnCount = 0}, {
    mnIndex = 165, mnCount = 0}, {mnIndex = 166, mnCount = 0}, {mnIndex = 167, mnCount = 0}, {mnIndex = 168, mnCount = 0}, {mnIndex = 169, mnCount = 0}, {mnIndex = 170, mnCount = 0}, {mnIndex = 171, 
    mnCount = 0}, {mnIndex = 172, mnCount = 0}, {mnIndex = 173, mnCount = 0}, {mnIndex = 174, mnCount = 0}, {mnIndex = 175, mnCount = 0}, {mnIndex = 160, mnCount = 0}, {mnIndex = 177, mnCount = 0}, {
    mnIndex = 178, mnCount = 0}, {mnIndex = 179, mnCount = 0}, {mnIndex = 180, mnCount = 0}, {mnIndex = 181, mnCount = 0}, {mnIndex = 182, mnCount = 0}, {mnIndex = 183, mnCount = 0}, {mnIndex = 184, 
    mnCount = 0}, {mnIndex = 185, mnCount = 0}, {mnIndex = 186, mnCount = 0}, {mnIndex = 187, mnCount = 0}, {mnIndex = 188, mnCount = 0}, {mnIndex = 189, mnCount = 0}, {mnIndex = 190, mnCount = 0}, {
    mnIndex = 191, mnCount = 0}, {mnIndex = 144, mnCount = 0}, {mnIndex = 129, mnCount = 0}, {mnIndex = 130, mnCount = 0}, {mnIndex = 131, mnCount = 0}, {mnIndex = 132, mnCount = 0}, {mnIndex = 133, 
    mnCount = 0}, {mnIndex = 134, mnCount = 0}, {mnIndex = 135, mnCount = 0}, {mnIndex = 136, mnCount = 0}, {mnIndex = 137, mnCount = 0}, {mnIndex = 138, mnCount = 0}, {mnIndex = 139, mnCount = 0}, {
    mnIndex = 140, mnCount = 0}, {mnIndex = 141, mnCount = 0}, {mnIndex = 142, mnCount = 0}, {mnIndex = 143, mnCount = 0}, {mnIndex = 192, mnCount = 0}, {mnIndex = 145, mnCount = 0}, {mnIndex = 146, 
    mnCount = 0}, {mnIndex = 147, mnCount = 0}, {mnIndex = 148, mnCount = 0}, {mnIndex = 149, mnCount = 0}, {mnIndex = 150, mnCount = 0}, {mnIndex = 151, mnCount = 0}, {mnIndex = 152, mnCount = 0}, {
    mnIndex = 153, mnCount = 0}, {mnIndex = 154, mnCount = 0}, {mnIndex = 155, mnCount = 0}, {mnIndex = 156, mnCount = 0}, {mnIndex = 157, mnCount = 0}, {mnIndex = 158, mnCount = 0}, {mnIndex = 159, 
    mnCount = 0}, {mnIndex = 240, mnCount = 0}, {mnIndex = 225, mnCount = 0}, {mnIndex = 226, mnCount = 0}, {mnIndex = 227, mnCount = 0}, {mnIndex = 228, mnCount = 0}, {mnIndex = 229, mnCount = 0}, {
    mnIndex = 230, mnCount = 0}, {mnIndex = 231, mnCount = 0}, {mnIndex = 232, mnCount = 0}, {mnIndex = 233, mnCount = 0}, {mnIndex = 234, mnCount = 0}, {mnIndex = 235, mnCount = 0}, {mnIndex = 236, 
    mnCount = 0}, {mnIndex = 237, mnCount = 0}, {mnIndex = 238, mnCount = 0}, {mnIndex = 239, mnCount = 0}, {mnIndex = 224, mnCount = 0}, {mnIndex = 241, mnCount = 0}, {mnIndex = 242, mnCount = 0}, {
    mnIndex = 243, mnCount = 0}, {mnIndex = 244, mnCount = 0}, {mnIndex = 245, mnCount = 0}, {mnIndex = 246, mnCount = 0}, {mnIndex = 247, mnCount = 0}, {mnIndex = 248, mnCount = 0}, {mnIndex = 249, 
    mnCount = 0}, {mnIndex = 250, mnCount = 0}, {mnIndex = 251, mnCount = 0}, {mnIndex = 252, mnCount = 0}, {mnIndex = 253, mnCount = 0}, {mnIndex = 254, mnCount = 0}, {mnIndex = 255, mnCount = 0}, {
    mnIndex = 208, mnCount = 0}, {mnIndex = 193, mnCount = 0}, {mnIndex = 194, mnCount = 0}, {mnIndex = 195, mnCount = 0}, {mnIndex = 196, mnCount = 0}, {mnIndex = 197, mnCount = 0}, {mnIndex = 198, 
    mnCount = 0}, {mnIndex = 199, mnCount = 0}, {mnIndex = 200, mnCount = 0}, {mnIndex = 201, mnCount = 0}, {mnIndex = 202, mnCount = 0}, {mnIndex = 203, mnCount = 0}, {mnIndex = 204, mnCount = 0}, {
    mnIndex = 205, mnCount = 0}, {mnIndex = 206, mnCount = 0}, {mnIndex = 207, mnCount = 0}, {mnIndex = 128, mnCount = 0}, {mnIndex = 209, mnCount = 0}, {mnIndex = 210, mnCount = 0}, {mnIndex = 211, 
    mnCount = 0}, {mnIndex = 212, mnCount = 0}, {mnIndex = 213, mnCount = 0}, {mnIndex = 214, mnCount = 0}, {mnIndex = 215, mnCount = 0}, {mnIndex = 216, mnCount = 0}, {mnIndex = 217, mnCount = 0}, {
    mnIndex = 218, mnCount = 0}, {mnIndex = 219, mnCount = 0}, {mnIndex = 220, mnCount = 0}, {mnIndex = 221, mnCount = 0}, {mnIndex = 222, mnCount = 0}, {mnIndex = 223, mnCount = 0}, {mnIndex = 68, 
    mnCount = 0}, {mnIndex = 56, mnCount = 0}, {mnIndex = 57, mnCount = 0}, {mnIndex = 58, mnCount = 0}, {mnIndex = 59, mnCount = 0}, {mnIndex = 60, mnCount = 0}, {mnIndex = 61, mnCount = 0}, {mnIndex = 62, 
    mnCount = 0}, {mnIndex = 63, mnCount = 0}, {mnIndex = 64, mnCount = 0}, {mnIndex = 65, mnCount = 0}, {mnIndex = 66, mnCount = 0}, {mnIndex = 67, mnCount = 0}, {mnIndex = 55, mnCount = 0}, {mnIndex = 69, 
    mnCount = 0}, {mnIndex = 70, mnCount = 0}, {mnIndex = 71, mnCount = 0}, {mnIndex = 72, mnCount = 0}, {mnIndex = 73, mnCount = 0}, {mnIndex = 74, mnCount = 0}, {mnIndex = 75, mnCount = 0}, {mnIndex = 76, 
    mnCount = 0}, {mnIndex = 77, mnCount = 0}, {mnIndex = 78, mnCount = 0}, {mnIndex = 79, mnCount = 0}, {mnIndex = 43, mnCount = 0}, {mnIndex = 32, mnCount = 0}, {mnIndex = 33, mnCount = 0}, {mnIndex = 34, 
    mnCount = 0}, {mnIndex = 35, mnCount = 0}, {mnIndex = 36, mnCount = 0}, {mnIndex = 37, mnCount = 0}, {mnIndex = 38, mnCount = 0}, {mnIndex = 39, mnCount = 0}, {mnIndex = 40, mnCount = 0}, {mnIndex = 41, 
    mnCount = 0}, {mnIndex = 42, mnCount = 0}, {mnIndex = 127, mnCount = 0}, {mnIndex = 44, mnCount = 0}, {mnIndex = 45, mnCount = 0}, {mnIndex = 46, mnCount = 0}, {mnIndex = 47, mnCount = 0}, {mnIndex = 48, 
    mnCount = 0}, {mnIndex = 49, mnCount = 0}, {mnIndex = 50, mnCount = 0}, {mnIndex = 51, mnCount = 0}, {mnIndex = 52, mnCount = 0}, {mnIndex = 53, mnCount = 0}, {mnIndex = 54, mnCount = 0}, {mnIndex = 115, 
    mnCount = 0}, {mnIndex = 104, mnCount = 0}, {mnIndex = 105, mnCount = 0}, {mnIndex = 106, mnCount = 0}, {mnIndex = 107, mnCount = 0}, {mnIndex = 108, mnCount = 0}, {mnIndex = 109, mnCount = 0}, {
    mnIndex = 110, mnCount = 0}, {mnIndex = 111, mnCount = 0}, {mnIndex = 112, mnCount = 0}, {mnIndex = 113, mnCount = 0}, {mnIndex = 114, mnCount = 0}, {mnIndex = 81, mnCount = 0}, {mnIndex = 116, 
    mnCount = 0}, {mnIndex = 117, mnCount = 0}, {mnIndex = 118, mnCount = 0}, {mnIndex = 119, mnCount = 0}, {mnIndex = 120, mnCount = 0}, {mnIndex = 121, mnCount = 0}, {mnIndex = 122, mnCount = 0}, {
    mnIndex = 123, mnCount = 0}, {mnIndex = 124, mnCount = 0}, {mnIndex = 125, mnCount = 0}...}
Comment 3 Julien Nabet 2022-09-16 15:59:32 UTC 
Noel: thought you might be interested in this one.
I wonder if the sort is ok, ie if this:
57             std::sort(aPopArtTable.begin(), aPopArtTable.end(),
58                       [](const PopArtEntry& lhs, const PopArtEntry& rhs) {
59                           return lhs.mnCount < rhs.mnCount;
60                       });

shouldn't be replaced with:
57             std::sort(aPopArtTable.begin(), aPopArtTable.end(),
58                       [](const PopArtEntry& lhs, const PopArtEntry& rhs) {
59                           return lhs.mnCount > rhs.mnCount;
60                       });

See https://opengrok.libreoffice.org/xref/core/vcl/source/bitmap/BitmapPopArtFilter.cxx?r=fbe169fa#57
Comment 4 Commit Notification 2022-09-19 15:13:26 UTC 
Julien Nabet committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/b0ad8a9175d5a9dddb9b853721905943c5cd8d59

tdf#150992: fix crash popart filter to an SVG image

It will be available in 7.5.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 5 Julien Nabet 2022-09-19 15:17:02 UTC 
Patch waiting for review for 7.4 branch:
https://gerrit.libreoffice.org/c/core/+/140160
Comment 6 Julien Nabet 2022-09-19 15:18:27 UTC 
*** Bug 136827 has been marked as a duplicate of this bug. ***
Comment 7 Commit Notification 2022-09-19 19:16:45 UTC 
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-7-4":

https://git.libreoffice.org/core/commit/2c7052a76e5348981883ca95cf3c0b079ded5068

tdf#150992: fix crash popart filter to an SVG image

It will be available in 7.4.2.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 8 Kevin Suo 2022-09-20 02:01:21 UTC 
The bug also appears in 7.3 branch.
Comment 9 Commit Notification 2022-09-20 11:21:10 UTC 
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-7-3":

https://git.libreoffice.org/core/commit/d0c6b4f7a326fc1d3177f88cde4431e56cae2e66

tdf#150992: fix crash popart filter to an SVG image

It will be available in 7.3.7.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 10 csongor 2022-09-20 12:06:44 UTC 
Guys, you are awesome, thank you for the quick fix. I will check it as soon as I can.