Description: leak on loading a specific docx Steps to Reproduce: 1. valgrind --leak-check=full ./instdir/program/soffice.bin --headless --convert-to pdf ~/clusterfuzz-testcase-minimized-docxfuzzer-6677783406837760.docx Actual Results: ==3842426== ==3842426== 739,036 (48 direct, 738,988 indirect) bytes in 1 blocks are definitely lost in loss record 10,130 of 10,131 ==3842426== at 0x4845FF5: operator new(unsigned long) (vg_replace_malloc.c:422) ==3842426== by 0x97C726C: std::__new_allocator<std::_Rb_tree_node<std::pair<rtl::OUString const, svx::diagram::Point*> > >::allocate(unsigned long, void const*) (new_allocator.h:137) ==3842426== by 0x97C7200: std::allocator_traits<std::allocator<std::_Rb_tree_node<std::pair<rtl::OUString const, svx::diagram::Point*> > > >::allocate(std::allocator<std::_Rb_tree_node<std::pair<rtl::OUString const, svx::diagram::Point*> > >&, unsigned long) (alloc_traits.h:464) ==3842426== by 0x97C70F1: std::_Rb_tree<rtl::OUString, std::pair<rtl::OUString const, svx::diagram::Point*>, std::_Select1st<std::pair<rtl::OUString const, svx::diagram::Point*> >, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, svx::diagram::Point*> > >::_M_get_node() (stl_tree.h:561) ==3842426== by 0x97CA4BC: std::_Rb_tree_node<std::pair<rtl::OUString const, svx::diagram::Point*> >* std::_Rb_tree<rtl::OUString, std::pair<rtl::OUString const, svx::diagram::Point*>, std::_Select1st<std::pair<rtl::OUString const, svx::diagram::Point*> >, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, svx::diagram::Point*> > >::_M_create_node<std::pair<rtl::OUString, svx::diagram::Point*> >(std::pair<rtl::OUString, svx::diagram::Point*>&&) (stl_tree.h:611) ==3842426== by 0x97CA47F: std::_Rb_tree<rtl::OUString, std::pair<rtl::OUString const, svx::diagram::Point*>, std::_Select1st<std::pair<rtl::OUString const, svx::diagram::Point*> >, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, svx::diagram::Point*> > >::_Auto_node::_Auto_node<std::pair<rtl::OUString, svx::diagram::Point*> >(std::_Rb_tree<rtl::OUString, std::pair<rtl::OUString const, svx::diagram::Point*>, std::_Select1st<std::pair<rtl::OUString const, svx::diagram::Point*> >, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, svx::diagram::Point*> > >&, std::pair<rtl::OUString, svx::diagram::Point*>&&) (stl_tree.h:1636) ==3842426== by 0x97CA31E: std::_Rb_tree_iterator<std::pair<rtl::OUString const, svx::diagram::Point*> > std::_Rb_tree<rtl::OUString, std::pair<rtl::OUString const, svx::diagram::Point*>, std::_Select1st<std::pair<rtl::OUString const, svx::diagram::Point*> >, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, svx::diagram::Point*> > >::_M_emplace_hint_unique<std::pair<rtl::OUString, svx::diagram::Point*> >(std::_Rb_tree_const_iterator<std::pair<rtl::OUString const, svx::diagram::Point*> >, std::pair<rtl::OUString, svx::diagram::Point*>&&) (stl_tree.h:2461) ==3842426== by 0x97CA249: std::_Rb_tree_iterator<std::pair<rtl::OUString const, svx::diagram::Point*> > std::__cxx1998::map<rtl::OUString, svx::diagram::Point*, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, svx::diagram::Point*> > >::emplace_hint<std::pair<rtl::OUString, svx::diagram::Point*> >(std::_Rb_tree_const_iterator<std::pair<rtl::OUString const, svx::diagram::Point*> >, std::pair<rtl::OUString, svx::diagram::Point*>&&) (stl_map.h:638) ==3842426== by 0x97CA0C9: std::enable_if<is_constructible<std::pair<rtl::OUString const, svx::diagram::Point*>, std::pair<rtl::OUString, svx::diagram::Point*> >::value, std::pair<std::_Rb_tree_iterator<std::pair<rtl::OUString const, svx::diagram::Point*> >, bool> >::type std::__cxx1998::map<rtl::OUString, svx::diagram::Point*, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, svx::diagram::Point*> > >::insert<std::pair<rtl::OUString, svx::diagram::Point*> >(std::pair<rtl::OUString, svx::diagram::Point*>&&) (stl_map.h:858) ==3842426== by 0x97AA512: std::pair<__gnu_debug::_Safe_iterator<std::_Rb_tree_iterator<std::pair<rtl::OUString const, svx::diagram::Point*> >, std::__debug::map<rtl::OUString, svx::diagram::Point*, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, svx::diagram::Point*> > >, std::bidirectional_iterator_tag>, bool> std::__debug::map<rtl::OUString, svx::diagram::Point*, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, svx::diagram::Point*> > >::insert<std::pair<rtl::OUString, svx::diagram::Point*>, void>(std::pair<rtl::OUString, svx::diagram::Point*>&&) (map.h:285) ==3842426== by 0x97A3D9B: svx::diagram::DiagramData::buildDiagramDataModel(bool) (datamodel.cxx:408) ==3842426== by 0x2BBFB22F: oox::drawingml::DiagramData::buildDiagramDataModel(bool) (datamodel.cxx:450) ==3842426== ==3842426== 1,289,078 (48 direct, 1,289,030 indirect) bytes in 1 blocks are definitely lost in loss record 10,131 of 10,131 ==3842426== at 0x4845FF5: operator new(unsigned long) (vg_replace_malloc.c:422) ==3842426== by 0x2BC1DB2C: std::__new_allocator<std::_Rb_tree_node<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > > >::allocate(unsigned long, void const*) (new_allocator.h:137) ==3842426== by 0x2BC1DAC0: std::allocator_traits<std::allocator<std::_Rb_tree_node<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > > > >::allocate(std::allocator<std::_Rb_tree_node<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > > >&, unsigned long) (alloc_traits.h:464) ==3842426== by 0x2BC1D9B1: std::_Rb_tree<rtl::OUString, std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> >, std::_Select1st<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > >, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > > >::_M_get_node() (stl_tree.h:561) ==3842426== by 0x2BC1D934: std::_Rb_tree_node<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > >* std::_Rb_tree<rtl::OUString, std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> >, std::_Select1st<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > >, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > > >::_M_create_node<std::piecewise_construct_t const&, std::tuple<rtl::OUString const&>, std::tuple<> >(std::piecewise_construct_t const&, std::tuple<rtl::OUString const&>&&, std::tuple<>&&) (stl_tree.h:611) ==3842426== by 0x2BC1D489: std::_Rb_tree<rtl::OUString, std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> >, std::_Select1st<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > >, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > > >::_Auto_node::_Auto_node<std::piecewise_construct_t const&, std::tuple<rtl::OUString const&>, std::tuple<> >(std::_Rb_tree<rtl::OUString, std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> >, std::_Select1st<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > >, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > > >&, std::piecewise_construct_t const&, std::tuple<rtl::OUString const&>&&, std::tuple<>&&) (stl_tree.h:1636) ==3842426== by 0x2BC1D037: std::_Rb_tree_iterator<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > > std::_Rb_tree<rtl::OUString, std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> >, std::_Select1st<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > >, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > > >::_M_emplace_hint_unique<std::piecewise_construct_t const&, std::tuple<rtl::OUString const&>, std::tuple<> >(std::_Rb_tree_const_iterator<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > >, std::piecewise_construct_t const&, std::tuple<rtl::OUString const&>&&, std::tuple<>&&) (stl_tree.h:2461) ==3842426== by 0x2BC1CDC1: std::__cxx1998::map<rtl::OUString, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument>, std::less<rtl::OUString>, std::allocator<std::pair<rtl::OUString const, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> > > >::operator[](rtl::OUString const&) (stl_map.h:511) ==3842426== by 0x2BC0E8E6: oox::drawingml::importFragment(oox::core::XmlFilterBase&, com::sun::star::uno::Reference<com::sun::star::xml::dom::XDocument> const&, rtl::OUString const&, std::shared_ptr<oox::drawingml::Diagram> const&, rtl::Reference<oox::core::FragmentHandler> const&) (diagram.cxx:245) ==3842426== by 0x2BC0D78E: oox::drawingml::loadDiagram(std::shared_ptr<oox::drawingml::Shape> const&, oox::core::XmlFilterBase&, rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, rtl::OUString const&, oox::core::Relations const&) (diagram.cxx:323) ==3842426== by 0x2BCA0B9D: oox::drawingml::DiagramGraphicDataContext::onCreateContext(int, oox::AttributeList const&) (graphicshapecontext.cxx:285) ==3842426== by 0x2BCA1504: non-virtual thunk to oox::drawingml::DiagramGraphicDataContext::onCreateContext(int, oox::AttributeList const&) (graphicshapecontext.cxx:0) Expected Results: no leak Reproducible: Always User Profile Reset: No Additional Info: oss-fuzz number 48580
Created attachment 183432 [details] input file
I feel this leak is some corner case in the relatively new Advanced Diagram support
The attached file cannot be opened, neither with Word 365 nor with "Open XML SDK 2.5 Productivity Tool". Trying to open it in LO gives: The error details are: SAXException: [word/document.xml line 2]: Specification mandates value for attribute :pMxmpr
that is correct, still leaks though
this spontaneously got better, maybe due to: commit af8fdba1194e657237f9abc460381a1c4bc49982 Date: Thu Jan 5 13:12:34 2023 +0900 support theme color for lines + oox support + tests