Created attachment 203164 [details] A document and data source that can be to force this crash, as well as screenshots for the reproduction steps This bug was filed from the crash reporting server and is br-a1a70df3-fcc7-4533-b449-4321885b75dc. ========================================= I have a problem with sending form letter via mail. I get this crash 100% of the time and have prodvided a small reproducer and attached it to this report. I am using a german windows install and a german LibreOffice installation, so all the Screenshots will be in german. Here are the steps I took to get it to crash. All Steps also have screenshots (see the attached zip folder): 1. Open the document 2. Open the "Serienbrief-Assistent" (I belive it is called form letter assistent in english) 3. Press "Datenbanken austauschen" (Exchange Database) while "Aktuelles Dokument verwenden" (Use current document) is selected 4. Search for the Reproducer Data Soruce and Select Tabelle 1 as the Datasource 5. Close the "Serienbrief-Assistent" using the Abbrechen (cancel) Button 6. Click on "Nächster Serienbriefeintrag" (the arrow button, next form letter entry) to populate the fields and check they are correctly filled 7. Click on "E-Mail Nachrichten senden" (Send E-Mail messages) to open the "Serienbriefdokument als E-Mail senden" Window (Send Form Letter as E-Mail) 8. Change "Senden als" (Send as) to PDF-Dokument 9. Click on "Eigenschaften" (Properties) 10. Check "Eine Briefanrede in die E-Mail Nachricht einfügen" (Add a heading to the E-Mail message) 11. Select anything for the female and male adress rows 12. Select "Anrede" for the "Spaltentitle" (Row title) for female recipients and select keep the default "Frau" as Feldinhalt (field content) 13. Click OK - The application will crash now This bug means I have to export all pages as PDF-Documents and manually send the documents 1 by 1, which takes a long time for many recipients!
The problem is in [1] (a call to aAssignment.realloc with wrong size). See commit 36df0b837b398f1011cb6f9fdf978a24125eee89, which fixed the same problem in the same file, several lines above. [1] https://opengrok.libreoffice.org/xref/core/sw/source/ui/dbui/mmgreetingspage.cxx?r=b9f9493b43f89ad1560e9779796ade7854aa2b74#407
https://gerrit.libreoffice.org/c/core/+/191981
Mike Kaganski committed a patch related to this issue. It has been pushed to "master": https://git.libreoffice.org/core/commit/014612657286b8042580245773934c5a9433503b tdf#168723: realloc should create the _correct_ size before access ;-) It will be available in 26.2.0. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Mike Kaganski committed a patch related to this issue. It has been pushed to "libreoffice-25-2": https://git.libreoffice.org/core/commit/a0fabe5b853cb34c4646ce9b025ab9f34d46f4cd tdf#168723: realloc should create the _correct_ size before access ;-) It will be available in 25.2.8. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Mike Kaganski committed a patch related to this issue. It has been pushed to "libreoffice-25-8": https://git.libreoffice.org/core/commit/1ef44db022c76ea28aa63aa3243a8660fb5d061c tdf#168723: realloc should create the _correct_ size before access ;-) It will be available in 25.8.3. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Mike Kaganski committed a patch related to this issue. It has been pushed to "libreoffice-25-2-7": https://git.libreoffice.org/core/commit/99b724db3f6693e03beeec9de9dc6aa213b70ee5 tdf#168723: realloc should create the _correct_ size before access ;-) It will be available in 25.2.7. The patch should be included in the daily builds available at https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: https://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.