Bug 80009 - ODF import: enormous fo:clip values on graphics result in crashes in drawinglayer
Summary: ODF import: enormous fo:clip values on graphics result in crashes in drawingl...
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: filters and storage (show other bugs)
Version:
(earliest affected)
4.2.0.4 release
Hardware: Other Linux (All)
: highest critical
Assignee: Michael Stahl (allotropia)
URL:
Whiteboard: BSA target:4.4.0 target:4.3.0.2 targe...
Keywords: bibisected, regression
Depends on:
Blocks: mab4.2
  Show dependency treegraph
 
Reported: 2014-06-14 00:17 UTC by Diarmuid O'Briain
Modified: 2015-12-17 08:23 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
Single page that causes the crash (37.85 KB, application/vnd.oasis.opendocument.text)
2014-06-14 00:17 UTC, Diarmuid O'Briain
Details
dialog appears with an 'OK' button (81.68 KB, image/png)
2014-06-14 00:46 UTC, Yousuf Philips (jay) (retired)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Diarmuid O'Briain 2014-06-14 00:17:55 UTC
Created attachment 101020 [details]
Single page that causes the crash

Problem description: Page crashed with little orange icon

Steps to reproduce:
1. Open the attached and scroll over page

Current behavior: It crashes

Expected behavior: It shouldnt

              
Operating System: Ubuntu
Version: 4.2.3.3 release
Comment 1 Yousuf Philips (jay) (retired) 2014-06-14 00:43:57 UTC
Confirmed on Linux Mint that it crashes 4.2.4, 4.2.6, and 4.4 alpha. In 4.3, it doesnt crash, but the page is not viewable though the left scrollbar works. Opens successfully in 4.1.6.
Comment 2 Yousuf Philips (jay) (retired) 2014-06-14 00:46:50 UTC
Created attachment 101025 [details]
dialog appears with an 'OK' button

Once you press the OK button, libreoffice shuts down.
Comment 3 Joel Madero 2014-06-14 01:34:02 UTC
 8aabf2aee6514311020b855a95a6e44bab3a5b0d is the first bad commit
commit 8aabf2aee6514311020b855a95a6e44bab3a5b0d
Author: Bjoern Michaelsen <bjoern.michaelsen@canonical.com>
Date:   Wed Nov 27 09:32:23 2013 +0000

    source-hash-0aa9ced531b8d85ad067c1d156a9708eea628d78
    
    commit 0aa9ced531b8d85ad067c1d156a9708eea628d78
    Author:     Tor Lillqvist <tml@collabora.com>
    AuthorDate: Wed Nov 6 00:43:06 2013 +0200
    Commit:     Tor Lillqvist <tml@collabora.com>
    CommitDate: Wed Nov 6 00:44:28 2013 +0200
    
        It's types.rdb now, not udkapi.rdb any more
    
        Change-Id: If6e8c4862ec628eb4c052e0fd237f5aef89db8eb

:100644 100644 ce5cd8dc3c3a6fdc22ae8e4f63897ab07254eddb 867d2798c91ad285850e29c0e8d0f40548dff4fb M	ccache.log
:100644 100644 405359894d6958b64eb7f2beb6f8a48550779f95 e461af99260d551289a2dd1f188119438cf1fc19 M	commitmsg
:100644 100644 0c7b842ac949f66eaa350d1ac25b0d6ccc407841 ab6adaea7a96b5d6d10dda3f10504fd1f005cfcf M	make.log
:040000 040000 216184b3333359e5a1395b47d1551dd3b61d2f04 d765efa8f9bd443222a2a557954f9dd4997fd3e7 M	opt

# bad: [423a84c4f7068853974887d98442bc2a2d0cc91b] source-hash-c15927f20d4727c3b8de68497b6949e72f9e6e9e
# good: [65fd30f5cb4cdd37995a33420ed8273c0a29bf00] source-hash-d6cde02dbce8c28c6af836e2dc1120f8a6ef9932
git bisect start 'latest' 'oldest'
# good: [e02439a3d6297a1f5334fa558ddec5ef4212c574] source-hash-6b8393474974d2af7a2cb3c47b3d5c081b550bdb
git bisect good e02439a3d6297a1f5334fa558ddec5ef4212c574
# bad: [4850941efe43ae800be5c76e1102ab80ac2c085d] source-hash-980a6e552502f02f12c15bfb1c9f8e6269499f4b
git bisect bad 4850941efe43ae800be5c76e1102ab80ac2c085d
# skip: [a043626b542eb8314218d7439534dce2fc325304] source-hash-9379a922c07df3cdb7d567cc88dfaaa39ead3681
git bisect skip a043626b542eb8314218d7439534dce2fc325304
# skip: [aba65c3e4c0df07e4909aeefb758cdb688242bf6] source-hash-827524abfb4b577d08276fde40929a9adfb7ff1a
git bisect skip aba65c3e4c0df07e4909aeefb758cdb688242bf6
# skip: [aba65c3e4c0df07e4909aeefb758cdb688242bf6] source-hash-827524abfb4b577d08276fde40929a9adfb7ff1a
git bisect skip aba65c3e4c0df07e4909aeefb758cdb688242bf6
# bad: [c81a8a0dcfc1ed095a80e4485c89dd0fcaf73f31] source-hash-c69ed33628ec0b7abf6296539cf280d6c4265930
git bisect bad c81a8a0dcfc1ed095a80e4485c89dd0fcaf73f31
# bad: [c81a8a0dcfc1ed095a80e4485c89dd0fcaf73f31] source-hash-c69ed33628ec0b7abf6296539cf280d6c4265930
git bisect bad c81a8a0dcfc1ed095a80e4485c89dd0fcaf73f31
# good: [1d4980621741d3050a5fe61b247c157d769988f2] source-hash-89d01a7d8028ddb765e02c116d202a2435894217
git bisect good 1d4980621741d3050a5fe61b247c157d769988f2
# skip: [89110ca258fa7a15dfc546acfb39e76fc3eb2a44] source-hash-e450a2c506ac7cd4433b0f93fc750a89919bc03c
git bisect skip 89110ca258fa7a15dfc546acfb39e76fc3eb2a44
# good: [1cca92a409385d9288c28a54d5e3008e56728bc0] source-hash-7be7824bbbdeee6fa998b950e6046ab37fe690cb
git bisect good 1cca92a409385d9288c28a54d5e3008e56728bc0
# skip: [5fa28ce2931a35ae64ae08d3904cfb76d24459d8] source-hash-2304beaca33c63b94df99cb827716f00ce259f9a
git bisect skip 5fa28ce2931a35ae64ae08d3904cfb76d24459d8
# good: [2a9ff869c5638dc5c3aa387d0fe55c3291c86288] source-hash-01b7e04172889cbc9e4ac404b105e18ddc062d6f
git bisect good 2a9ff869c5638dc5c3aa387d0fe55c3291c86288
# good: [387dd1052972d27a3065a249b357e50e0a29829b] source-hash-35836f350861b33a0c28307a413eff76d0433d1e
git bisect good 387dd1052972d27a3065a249b357e50e0a29829b
# good: [387dd1052972d27a3065a249b357e50e0a29829b] source-hash-35836f350861b33a0c28307a413eff76d0433d1e
git bisect good 387dd1052972d27a3065a249b357e50e0a29829b
# good: [09fe6d4400fefeaa099d0deb9b77c77992ab897b] source-hash-56364430108893afbcf5d2b51c5aaa37e393e7cc
git bisect good 09fe6d4400fefeaa099d0deb9b77c77992ab897b
# good: [09fe6d4400fefeaa099d0deb9b77c77992ab897b] source-hash-56364430108893afbcf5d2b51c5aaa37e393e7cc
git bisect good 09fe6d4400fefeaa099d0deb9b77c77992ab897b
# bad: [8aabf2aee6514311020b855a95a6e44bab3a5b0d] source-hash-0aa9ced531b8d85ad067c1d156a9708eea628d78
git bisect bad 8aabf2aee6514311020b855a95a6e44bab3a5b0d
# bad: [8aabf2aee6514311020b855a95a6e44bab3a5b0d] source-hash-0aa9ced531b8d85ad067c1d156a9708eea628d78
git bisect bad 8aabf2aee6514311020b855a95a6e44bab3a5b0d
# good: [11ac44b0fb233f1f98e2f083598f6720a04e457f] source-hash-3c01203ea657b9a3538f9956591b3d4da5fce6e7
git bisect good 11ac44b0fb233f1f98e2f083598f6720a04e457f
# first bad commit: [8aabf2aee6514311020b855a95a6e44bab3a5b0d] source-hash-0aa9ced531b8d85ad067c1d156a9708eea628d78
Comment 4 Jean-Baptiste Faure 2014-06-14 05:48:59 UTC
It is strange: if you open the file with LO 4.0 and show the non-printable characters, LO 4.0 find 2 empty paragraphs more than LO 4.1 at the end of the document.
In LO 4.1 ctrl+A (Select All) does nothing, but it works in LO 4.0
In LO 4.0 ctrl+A then delete then save under another name --> the new file opens fine in LO 4.2.6.0+ you see only the first numbering (1.1) but the word count in the status bar says 29 words, 166 characters. I do not see any text in the content.xml file of the .odt archive.

I think that something went wrong when the original MS-Word file has been converted into ODF but LO should'nt crash.

Best regards. JBF
Comment 5 Yousuf Philips (jay) (retired) 2014-06-14 15:21:31 UTC
Hi Diarmuid,

Was the file originally a ms word document? And if so, can you provide us with that file.
Comment 6 Michael Stahl (allotropia) 2014-06-27 22:19:30 UTC
the reason is the image which has ridiculous 5 kilometer clipping area:

 fo:clip="rect(531404.655cm, 0cm, 0cm, 0cm)"

that causes some overflow in drawing layer, a rectangle with
negative height, an IllegalArgumentException that is not handled,
and then a crash...

it's of course also triggered by our good friend commit 2e51675

so this is related to bug 77454, presumably the document
was a WW8 doc that has been converted to ODF?

looks like we need some cut-off value there too...

fixed on master
Comment 7 Commit Notification 2014-06-27 22:21:01 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=924a28a7b1dc2f89e6940630057557f5f03494df

fdo#80009: xmloff: ignore excessive fo:clip values



The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 8 Commit Notification 2014-06-29 11:05:29 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-3":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=2387c53dba185b45b0e34beae2a8ddaa315bb689&h=libreoffice-4-3

fdo#80009: xmloff: ignore excessive fo:clip values


It will be available in LibreOffice 4.3.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 9 Commit Notification 2014-06-29 12:47:31 UTC
Michael Stahl committed a patch related to this issue.
It has been pushed to "libreoffice-4-2":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=c6fe783c0ebec2ca95463605e7758e80c17d3f7e&h=libreoffice-4-2

fdo#80009: xmloff: ignore excessive fo:clip values


It will be available in LibreOffice 4.2.6.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds
Affected users are encouraged to test the fix and report feedback.
Comment 10 Robinson Tryon (qubit) 2015-12-17 08:23:24 UTC
Migrating Whiteboard tags to Keywords: (bibisected)
[NinjaEdit]