Bug 48961 - [PPTX] crash when trying to create insanely large pixmap
Summary: [PPTX] crash when trying to create insanely large pixmap
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Impress (show other bugs)
Version:
(earliest affected)
Master old -3.6
Hardware: Other All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard: target:3.6.0
Keywords:
Depends on:
Blocks:
 
Reported: 2012-04-20 03:27 UTC by Caolán McNamara
Modified: 2014-12-18 17:15 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:


Attachments
sample .pptx (504.05 KB, application/vnd.openxmlformats-officedocument.presentationml.presentation)
2012-04-20 03:27 UTC, Caolán McNamara
Details
debugging patch (4.03 KB, text/plain)
2012-04-20 03:28 UTC, Caolán McNamara
Details
debugging log (73.96 KB, text/x-log)
2012-04-20 03:29 UTC, Caolán McNamara
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Caolán McNamara 2012-04-20 03:27:14 UTC
Created attachment 60380 [details]
sample .pptx

So, with the attached .pptx around slide 20 we end up doing...

XCreatePixmap (dpy=0x202e400, d=<optimized out>,width=187690, height=187580,

which will fail cause that's just way too large

I'm stumped by this one, but I attach a debugging patch and some debugging output and I think the massive numbers come from Shape::createAndInsert
Comment 1 Caolán McNamara 2012-04-20 03:28:09 UTC
Created attachment 60381 [details]
debugging patch
Comment 2 Caolán McNamara 2012-04-20 03:29:49 UTC
Created attachment 60382 [details]
debugging log

debugging log, grep for "this is getting suspicious" and "HUGE"

caolan->rodo: I'm guessing you know how the transformation stuff is supposed to work to be able to see if its working like it supposed to
Comment 3 Not Assigned 2012-05-09 03:36:35 UTC
Caolan McNamara committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=107f8447818e50ba61221ca2ab0871347b7d6596

Related: fdo#48961 don't crash on silly pixmap sizes
Comment 4 Michael Stahl (allotropia) 2012-06-29 14:40:05 UTC
Comment on attachment 60381 [details]
debugging patch

this patch is just for debugging so i'll remove the "patch" flag; also it looks like something has been committed, is this bug FIXED?
Comment 5 Caolán McNamara 2012-06-29 15:14:43 UTC
No, not fixed. I just clipped stupid pixmap sizes to max legal sizes (like happens in the vcl-only code already). The debugging patch shows where they come from but I don't quite understand the logic of the transformations there to know which (if any) are wrong.
Comment 6 A (Andy) 2013-04-26 20:40:47 UTC
If I open the file with LO 4.0.2.2 (Win7 Home, 64bit) and compare it with MSO 2007 then I can recognize several bugs: slide 2 (text effects), slide 3 (rectangle effects), slide 14 (picture inverted), slide 20/35 (text inverted and displaced), slide 24/27/28/30/31 (charts totally messed up), slide 25 (color of the lines), slide 40 (text effects)
Comment 7 Caolán McNamara 2014-12-18 17:15:31 UTC
I don't get my warning anymore, so seems fixed