Bug 49666 - CRASH while opening RTF document
Summary: CRASH while opening RTF document
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected)
3.5.3 release
Hardware: Other All
: high critical
Assignee: Miklos Vajna
Whiteboard: BSA target:4.2.0
Depends on:
Reported: 2012-05-08 22:15 UTC by opensuse.lietuviu.kalba
Modified: 2013-11-04 09:59 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:

rtf document, causing CRASH (81.89 KB, application/rtf)
2012-05-08 22:15 UTC, opensuse.lietuviu.kalba
bt with symbols + console message (10.88 KB, text/plain)
2012-05-09 13:22 UTC, Julien Nabet
Bug 49666 - WinDbg session (13.98 KB, text/plain)
2012-05-31 23:18 UTC, bfoman (inactive)
RTF file containing image data and tables, with internal positioning and scaling control data. (202.49 KB, application/rtf)
2012-07-05 01:39 UTC, Scott Marshall

Note You need to log in before you can comment on or make changes to this bug.
Description opensuse.lietuviu.kalba 2012-05-08 22:15:00 UTC
Created attachment 61265 [details]
rtf document, causing CRASH

Problem description: 
Immediate crash in opening RTF document.

Steps to reproduce:
1. Try open attached file

Current behavior:

Expected behavior:
Document is opened

Platform (if different from the browser): 
Browser: Mozilla/5.0 (X11; Linux x86_64; rv:12.0) Gecko/20100101 Firefox/12.0
Comment 1 Julien Nabet 2012-05-09 13:22:03 UTC
Created attachment 61305 [details]
bt with symbols + console message

On pc Debian x86-64, I reproduced the problem on 3.5 branch and master (both updated today).
I attached the bt with symbols (+ console messages) from master.
Comment 2 Korrawit Pruegsanusak 2012-05-15 03:12:09 UTC
Thanks for reporting this bug, but it's not BASIC, but Writer issue.
Comment 3 bfoman (inactive) 2012-05-31 23:18:07 UTC
Created attachment 62356 [details]
Bug 49666 - WinDbg session

Confirmed with:
Build ID: own W7 debug build
Windows 7 Professional SP1 64 bit

Crash while loading.

Attached full WinDbg session with mini dump file loaded generated by procdump soffice.bin -h.
Comment 4 Julien Nabet 2012-06-18 13:13:57 UTC
On Pc Debian x86-64, with master sources updated today, I don't reproduce the crash anymore but I had "General Input/output error" popup.
Comment 5 Scott Marshall 2012-07-05 01:36:27 UTC
Also crashes in v3.5.5.2 (build id: 24b32b4-b87ec2e-85c8e98-87a4e20-9a1b8c1) under Windows 7 (x86_64).

Same RTF that crashes v3.5.5.2 does NOT crash LODEV v3.6
Comment 6 Scott Marshall 2012-07-05 01:39:51 UTC
Created attachment 63853 [details]
RTF file containing image data and tables, with internal positioning and scaling control data.

This file crashes v3.5.5.2, and does not render correctly in v3.5.4 or LODEV v3.6

File correctly renders in IBM Lotus Symphony and Microsoft Word.
Comment 7 Caolán McNamara 2012-07-05 02:05:28 UTC
don't pile up different rtf documents that crash/render incorrectly in the same bug, write different ones for each.
Comment 8 Ronildo Matsuura 2012-08-07 13:11:19 UTC
I am having the same problem! I'm tested v3.5.4, v.3.5.5 and v3.6.0.4rc
Comment 9 Caolán McNamara 2012-08-22 14:14:50 UTC doesn't crash on the original .rtf anymore, although it does fail to load, which I guess is acceptable as the format is busted.

If there are outstanding rtf crashers, please use different bugs for them.
Comment 10 Miklos Vajna 2013-11-01 20:41:39 UTC
Latest crash report points this document out once again.

Seems the problem is that the bugdoc contains a shape with type 75 (ESCHER_ShpInst_PictureFrame), which also has a shape text. Looks like this is an RTF which is generated by some 3rd-party tool: Word can open it, but it doesn't show the text on the picture frame, either -- and if I try to save it as RTF again, it crashes. ;-)

So, let's just ignore the shape text for picture frames at RTF import time as well, that should avoid the crash.
Comment 11 Commit Notification 2013-11-04 09:51:10 UTC
Miklos Vajna committed a patch related to this issue.
It has been pushed to "master":


fdo#49666 RTF import: fix crash on picture frame with shape text

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
Affected users are encouraged to test the fix and report feedback.
Comment 12 Miklos Vajna 2013-11-04 09:59:53 UTC
I don't see the problem on -4-1, so closing without backporting.