Bug Hunting Session
Bug 79139 - Crash in SwDropCapCache::CalcFontSize
Summary: Crash in SwDropCapCache::CalcFontSize
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
4.3.0.0.beta1
Hardware: Other All
: medium critical
Assignee: Julien Nabet
URL:
Whiteboard: target:4.4.0 target:4.2.5 target:4.3....
Keywords:
Depends on:
Blocks:
 
Reported: 2014-05-23 15:57 UTC by nicolas.gregoire
Modified: 2014-05-26 11:55 UTC (History)
0 users

See Also:
Crash report or crash signature:


Attachments
Repro file (23.49 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2014-05-23 15:57 UTC, nicolas.gregoire
Details
Original file (27.93 KB, application/vnd.openxmlformats-officedocument.wordprocessingml.document)
2014-05-23 15:57 UTC, nicolas.gregoire
Details

Note You need to log in before you can comment on or make changes to this bug.
Description nicolas.gregoire 2014-05-23 15:57:30 UTC
Created attachment 99662 [details]
Repro file

When opening a mutated DOCX file, an ASan build of LO 4.4.0.0 alpha0 will crash:

Program received signal SIGFPE, Arithmetic exception.
0x00007fffa9746e9b in SwDropCapCache::CalcFontSize (this=<optimized out>, pDrop=<optimized out>, rInf=...) at /home/moggi/devel/libo7/sw/source/core/text/txtdrop.cxx:717

rax            0xbd740  776000
rbx            0xf200f2f2f200f201       -1008539191274835455
rcx            0x7ffffffe2280   140737488233088
rdx            0x0      0
rsi            0x10007fff4308   17594333479688
rdi            0x7ffffffe1860   140737488230496
rbp            0x7ffffffe2670   0x7ffffffe2670
rsp            0x7ffffffe18c0   0x7ffffffe18c0

   0x00007fffa9746e93 <SwDropCapCache::CalcFontSize(SwDropPortion*, SwTxtFormatInfo&)+6451>:    mov    0x710(%rsp),%rcx
=> 0x00007fffa9746e9b <SwDropCapCache::CalcFontSize(SwDropPortion*, SwTxtFormatInfo&)+6459>:    idivq  (%rcx)
   0x00007fffa9746e9e <SwDropCapCache::CalcFontSize(SwDropPortion*, SwTxtFormatInfo&)+6462>:    mov    0x738(%rsp),%rdx

Original OO file: www.asep.org%2Fasep%2Fasep%2FEvery_Day_Is_Another_Day.docx
Mutated OO file (repro file): crash-30894.docx

Modified XML file: word/styles.xml
Modifications:
- in tag "w:rFonts", attribute "w:eastAsiaTheme" was switched from "minorHAnsi" to "%s%n%s%n%s%n%s%n%s%n"
- in tag "w:sz", attribute "w:val" was switched from "22" to "PPPPPPPPPPPPPPPPPPPPPPPPPPPPPP..."
- in tag "w:lsdException", attribute "w:qFormat" was switched from "1" to "0"
Comment 1 nicolas.gregoire 2014-05-23 15:57:45 UTC
Created attachment 99663 [details]
Original file
Comment 2 Commit Notification 2014-05-23 21:00:05 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=06afd4067f7bc321d7dd0a4e8c235b0b21e3d49a

Resolves: fdo#79139 Crash in SwDropCapCache::CalcFontSize



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 3 Julien Nabet 2014-05-23 21:30:53 UTC
for 4.3: https://gerrit.libreoffice.org/#/c/9457/
for 4.2: https://gerrit.libreoffice.org/9458
Comment 4 Commit Notification 2014-05-26 09:21:52 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-4-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=9732b4a0045c1e72493f16d03f60a048d5fbfa9d&h=libreoffice-4-2

Resolves: fdo#79139 Crash in SwDropCapCache::CalcFontSize


It will be available in LibreOffice 4.2.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 5 Commit Notification 2014-05-26 09:22:06 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "libreoffice-4-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c172eb71bbd725d6ddca9255a288c47534bb9113&h=libreoffice-4-3

Resolves: fdo#79139 Crash in SwDropCapCache::CalcFontSize


It will be available in LibreOffice 4.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 6 Julien Nabet 2014-05-26 11:55:19 UTC
Thanks to Caolan review for 4.2 and 4.3, we can put this as FIXED now.