Bug 80771 - Crash when trying to open ms pptx file
Summary: Crash when trying to open ms pptx file
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
4.2.5.1 rc
Hardware: x86-64 (AMD64) Linux (All)
: medium critical
Assignee: Not Assigned
URL:
Whiteboard: target:4.2.6 target:4.3.0 target:4.4.0
Keywords:
Depends on:
Blocks:
 
Reported: 2014-07-01 20:38 UTC by Stefan Weil
Modified: 2014-07-02 06:54 UTC (History)
2 users (show)

See Also:
Crash report or crash signature:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Weil 2014-07-01 20:38:53 UTC 
A certain pptx file (available on demand per private e-mail) crashes loimpress
on 64 bit Debian GNU Linux Jessie (libreoffice 4.2.5-1).

The same file cannot be opened on Windows 8.1 as well: LibreOffice 4.2.5.2
just hangs (neither text nor anything else is shown, only grey window).

Stack trace from Linux:

Core was generated by `/usr/lib/libreoffice/program/soffice.bin --impress xxx.pptx --splash-pipe'.
Program terminated with signal 11, Segmentation fault.
#0  sax_fastparser::FastSaxParserImpl::GetTokenWithPrefix (this=this@entry=0x26f9530, pPrefix=pPrefix@entry=0x7f3618011dfc "a:tab", nPrefixLen=nPrefixLen@entry=1, 
    pName=pName@entry=0x7f3618011dfe "tab", nNameLen=nNameLen@entry=3) at /build/libreoffice-BzYoem/libreoffice-4.2.5/sax/source/fastparser/fastparser.cxx:685
685	/build/libreoffice-BzYoem/libreoffice-4.2.5/sax/source/fastparser/fastparser.cxx: Datei oder Verzeichnis nicht gefunden.
(gdb) i s
#0  sax_fastparser::FastSaxParserImpl::GetTokenWithPrefix (this=this@entry=0x26f9530, pPrefix=pPrefix@entry=0x7f3618011dfc "a:tab", nPrefixLen=nPrefixLen@entry=1, 
    pName=pName@entry=0x7f3618011dfe "tab", nNameLen=nNameLen@entry=3) at /build/libreoffice-BzYoem/libreoffice-4.2.5/sax/source/fastparser/fastparser.cxx:685
#1  0x00007f364c5eadb3 in sax_fastparser::FastSaxParserImpl::callbackStartElement (this=0x26f9530, pwName=0x7f3618011dfc "a:tab", awAttributes=<optimized out>)
    at /build/libreoffice-BzYoem/libreoffice-4.2.5/sax/source/fastparser/fastparser.cxx:1229
#2  0x00007f366177666a in ?? () from /lib/x86_64-linux-gnu/libexpat.so.1
#3  0x00007f366177764e in ?? () from /lib/x86_64-linux-gnu/libexpat.so.1
#4  0x00007f36617795df in XML_ParseBuffer () from /lib/x86_64-linux-gnu/libexpat.so.1
#5  0x00007f364c5e581a in sax_fastparser::FastSaxParserImpl::parse (this=0x26f9530) at /build/libreoffice-BzYoem/libreoffice-4.2.5/sax/source/fastparser/fastparser.cxx:1112
#6  0x00007f364c5e598d in (anonymous namespace)::ParserThread::execute (this=0x27a4d20) at /build/libreoffice-BzYoem/libreoffice-4.2.5/sax/source/fastparser/fastparser.cxx:286
#7  0x00007f366d4e7c26 in salhelper::Thread::run() () from /usr/lib/libreoffice/program/../ure-link/lib/libuno_salhelpergcc3.so.3
#8  0x00007f366d4e7e6a in ?? () from /usr/lib/libreoffice/program/../ure-link/lib/libuno_salhelpergcc3.so.3
#9  0x00007f366f8831cf in ?? () from /usr/lib/libreoffice/program/../ure-link/lib/libuno_sal.so.3
#10 0x00007f366f03c0ca in start_thread (arg=0x7f362e330700) at pthread_create.c:309
#11 0x00007f366f33706d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

(gdb) p *this
$1 = {mpFront = 0x26f8910, maMutex = {mutex = 0x26a6260}, mxDocumentLocator = {m_pBody = 0x26f86b0}, maNamespaceMap = {
    table_ = {<boost::unordered::detail::table<boost::unordered::detail::map<std::allocator<std::pair<rtl::OUString const, int> >, rtl::OUString, int, rtl::OUStringHash, std::equal_to<rtl::OUString> > >> = {<boost::unordered::detail::functions<rtl::OUStringHash, std::equal_to<rtl::OUString> >> = {static nothrow_move_assignable = true, 
          static nothrow_move_constructible = <optimized out>, current_ = false, funcs_ = {{data_ = {buf = "", align_ = 0 '\000'}}, {data_ = {buf = "", align_ = 0 '\000'}}}}, 
        allocators_ = {<boost::unordered::detail::compressed_base<std::allocator<boost::unordered::detail::ptr_bucket>, 1>> = {<std::allocator<boost::unordered::detail::ptr_bucket>> = {<__gnu_cxx::new_allocator<boost::unordered::detail::ptr_bucket>> = {<No data fields>}, <No data fields>}, <No data fields>}, <boost::unordered::detail::compressed_base<std::allocator<boost::unordered::detail::ptr_node<std::pair<rtl::OUString const, int> > >, 2>> = {<std::allocator<boost::unordered::detail::ptr_node<std::pair<rtl::OUString const, int> > >> = {<__gnu_cxx::new_allocator<boost::unordered::detail::ptr_node<std::pair<rtl::OUString const, int> > >> = {<No data fields>}, <No data fields>}, <No data fields>}, <No data fields>}, bucket_count_ = 32, size_ = 29, mlf_ = 1, max_load_ = 32, buckets_ = 0x26faad0}, <No data fields>}}, maData = {
    mxDocumentHandler = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x29d6040}, <No data fields>}, mxTokenHandler = {<com::sun::star::uno::BaseReference> = {
        _pInterface = 0x26f9900}, <No data fields>}, mpTokenHandler = 0x26f9908, mxErrorHandler = {<com::sun::star::uno::BaseReference> = {
        _pInterface = 0x0}, <No data fields>}, mxEntityResolver = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>}, maLocale = {Language = {
        pData = 0x7f366f8ac0c0}, Country = {pData = 0x7f366f8ac0c0}, Variant = {pData = 0x7f366f8ac0c0}}}, mpTop = 0x27adae0, 
  maEntities = std::stack wrapping: std::deque with 3 elements = {{<(anonymous namespace)::ParserData> = {mxDocumentHandler = {<com::sun::star::uno::BaseReference> = {
            _pInterface = 0x2750b70}, <No data fields>}, mxTokenHandler = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x26f9900}, <No data fields>}, 
        mpTokenHandler = 0x26f9908, mxErrorHandler = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>}, 
        mxEntityResolver = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x0}, <No data fields>}, maLocale = {Language = {pData = 0x7f366f8ac0c0}, Country = {
            pData = 0x7f366f8ac0c0}, Variant = {pData = 0x7f366f8ac0c0}}}, static mnEventListSize = <optimized out>, mnProducedEventsSize = 0, mpProducedEvents = 0x0, 
      maPendingEvents = std::queue wrapping: std::deque with 0 elements, maUsedEvents = std::queue wrapping: std::deque with 0 elements, maEventProtector = {
        mutex = 0x2756d30}, static mnEventLowWater = <optimized out>, static mnEventHighWater = <optimized out>, maConsumeResume = {condition = 0x2742830}, maProduceResume = {
        condition = 0x274c490}, maSharedEvent = {maType = (anonymous namespace)::INVALID, mnElementToken = 1246600, msNamespace = {pData = 0x7f366f8ac0c0}, msElementName = {
          pData = 0x7f366f8ac0c0}, mxAttributes = {m_pBody = 0x274f7d0}, msChars = {pData = 0x7f366f8ac0c0}}, mbEnableThreads = false, maStructSource = {
        aInputStream = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x27582b8}, <No data fields>}, sEncoding = {pData = 0x7f366f8ac0c0}, sPublicId = {
          pData = 0x7f366f8ac0c0}, sSystemId = {pData = 0x27510d0}}, mpParser = 0x274b1e0, maConverter = {m_in = {<com::sun::star::uno::BaseReference> = {
            _pInterface = 0x27582b8}, <No data fields>}, m_bStarted = 1 '\001', m_sEncoding = {pData = 0x7f366f8abbe4}, m_pText2Unicode = 0x0, m_pUnicode2Text = 0x0}, 
      maSavedException = {<_uno_Any> = {pType = 0x16707a0, pData = 0x26f97a8, pReserved = 0x0}, <No data fields>}, 
      maNamespaceStack = std::stack wrapping: std::deque with 0 elements, maContextStack = std::stack wrapping: std::deque with 0 elements, 
      maNamespaceCount = std::stack wrapping: std::deque with 0 elements, maNamespaceDefines = std::vector of length 64, capacity 64 = {{px = 0x274d070, pn = {
            pi_ = 0x274f7b0}}, {px = 0x2768c20, pn = {pi_ = 0x2768c40}}, {px = 0x2768d20, pn = {pi_ = 0x2768d40}}, {px = 0x2768e10, pn = {pi_ = 0x2768e30}}, {px = 0x0, pn = {
            pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, 
        {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {
            pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, 
        {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {
            pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, 
        {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {
            pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, 
        {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {
            pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, 
        {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {
            pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}, {px = 0x0, pn = {pi_ = 0x0}}}}, 
    {<(anonymous namespace)::ParserData> = {mxDocumentHandler = {<com::sun::star::uno::BaseReference> = {_pInterface = 0x29b0f50}, <No data fields>}, 
---Type <return> to continue, or q <return> to quit---q
Comment 1 Julien Nabet 2014-07-01 20:52:33 UTC 
According to the provided backtrace, it's fixed with http://cgit.freedesktop.org/libreoffice/core/commit/?h=libreoffice-4-2&id=8f59c9b4858cde1352eb60b2a3fe22853813b287
This patch should be included in 4.2.6 for 4.2 branch, 4.3.0 for 4.3 branch and of course future 4.4.0

If you desperately need to open it to retrieve something in it, you can give a try to daily builds (see http://dev-builds.libreoffice.org/daily/).
Comment 2 Julien Nabet 2014-07-01 20:55:00 UTC 
Have in mind that a commit on a branch is in a daily build of this branch after 24 to 48 hours. So since the commit i indicated has been done 11 hours ago, you must still wait max between 13 and 37 hours.
Comment 3 Stefan Weil 2014-07-01 21:10:51 UTC 
Thanks for this information. I'll test a new version as soon as it is available.

Is there any action necessary for the windows version? Not to fix the concrete bug, but to give a better feedback to users when other similar bugs occur?

I'd expect at least some message box which tells me that the program crashed and which allows me to close the application.

Instead of this, I had to kill it using the task manager (after I had waited some minutes to see whether anything would happen). Should I file a new bug for this or what would be the appropriate action to take?
Comment 4 Julien Nabet 2014-07-02 05:38:51 UTC 
Stefan: I must recognize I don't know enough LO internals to answer.
You can submit a new bugtracker about it if you want.
Comment 5 Stefan Weil 2014-07-02 06:54:17 UTC 
I submitted a new bug for LibreOffice on Windows, see https://bugs.freedesktop.org/show_bug.cgi?id=80789.