Bug 169419 - Page size is written to DOCX outside of range allowed by Word / [MS-OI29500]
Summary: Page size is written to DOCX outside of range allowed by Word / [MS-OI29500]
Status: ASSIGNED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
unspecified
Hardware: All All
: medium normal
Assignee: Aron Budea
URL: https://learn.microsoft.com/en-us/ope...
Whiteboard:
Keywords: filter:docx
Depends on:
Blocks:
 
Reported: 2025-11-13 12:42 UTC by Mike Kaganski
Modified: 2025-12-10 09:58 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Kaganski 2025-11-13 12:42:19 UTC
Open attachment 203900 [details] (from bug 169403). It is created in Writer.

I Writer, its page's height is ~6000 mm
In Word, it's small (maybe locale-specific? I see ~220 mm).

[MS-OI29500] specifies in 2.1.220 Part 1 Section 17.6.13, pgSz (Page Size):

> The standard states that the h and w attributes can have any value in the range
> 0 to 4294967295, inclusive.
> 
> Word requires that this value is between the width of the page margins (and any
> column widths, for the w attribute) and 31680 (22 inches).

The actual markup in the document is '<w:pgSz w:w="17008" w:h="340157"/>', with the 'h' attribute more than 10 times greater than the maximum.
Comment 1 Mike Kaganski 2025-11-13 12:45:04 UTC
See [MS-OI29500]: Office Implementation Information for ISO/IEC 29500 Standards Support at https://learn.microsoft.com/en-us/openspecs/office_standards/ms-oi29500/1fd4a662-8623-49c0-82f0-18fa91b413b8
Comment 2 Aron Budea 2025-12-08 16:58:31 UTC
Curiously, Word can open a document with page size 115x115 cm as is, but 116x116 cm overflows and becomes 0.4x0.4 cm.
Comment 3 Mike Kaganski 2025-12-08 18:51:57 UTC
(In reply to Aron Budea from comment #2)
> Word can open a document with page size 115x115 cm as is, but
> 116x116 cm overflows and becomes 0.4x0.4 cm.

115 cm = 65196.85 twip
116 cm = 65763.78 twip

So obviously, there is unsigned 16-bit overflow.

65535 twip = 115.6 cm ~ 116 cm - 0.4 cm