found this bug loading attachment 107279 [details] from Bug 84640 tested under Win7x64 with LibO 4.3.0.4 and above including 4.4.0.0.alpha0+ Build ID: 268b9c10c9ff27c74678ace99762f28d58d33012 TinderBox: Win-x86@42, Branch:master, Time: 2014-10-02_23:35:24 in my computer LibO 4.2.6.2 and older release can open the file with no "bad allocation fatal error" I add regression to keywords and set status to NEW since another user reproduced it with Linux 4.3.3.0+ and 4.4.0.0.alpha0+ see comment here: https://bugs.freedesktop.org/show_bug.cgi?id=84640#c1
@raal please retest with LibO 4.2.6.2 under Linux and tell me if the bug affects 4.2.x on Linux as well as in 4.3.x and 4.4.x in my Win7x64 computer the 4.2.x branch is unaffected.
Bad alloc means out of memory.
@Markus can you open that file on your computer?
(In reply to tommy27 from comment #3) > @Markus > can you open that file on your computer? I'm still on vacation until October, 20th and have no access to a computer before that point. I'm just commenting from a smartphone based on the error message.
Doesn't work under linux, mint 16/17 x64 & ubuntu 14.04 x64 with v4.2.6.3 too. Still std::bad alloc When opening it with LO 3.3.4 and saving it to xls again, there's no problem with opening it with newer versions. So for now, setting it to v4.2.6.3 Should we set the importance to critical or even blocker ?
Created attachment 107376 [details] valgrind log Crash with LO 4.3.3, 4.4
Bibisect results from windows installers on-hand. Setting version accordingly. But, there are about 1500 commits in the range between 2014-03-24 and 2014-04-09 when the regression in import filter handling of XLS files occurs. see cgit range http://cgit.freedesktop.org/libreoffice/core/log/?qt=range&q=aeab0183e86fe011d32058864c02b2de4da32dc9..20fb1bfc72e626251b435bcff2339e1e425c7130 If someone would care to refine it please do. Working on a back trace. bibisect -=OK=-these builds of LibreOffice master 4.3.0.0alpha0+ open the .XLS Version: 4.3.0.0.alpha0+ (11/23/2013) Build ID: e3b7e62b0dc34787f66c504230252b2c5edd18c3 TinderBox: Win-x86@39, Branch:master, Time: 2013-11-23_14:43:54 Version: 4.3.0.0.alpha0+ Build ID: d84ccb39b744457cd47125beb4291c84223d5219 TinderBox: Win-x86@39, Branch:master, Time: 2014-02-22_10:05:06 Version: 4.3.0.0.alpha0+ Build ID: aeab0183e86fe011d32058864c02b2de4da32dc9 TinderBox: Win-x86@39, Branch:master, Time: 2014-03-24_05:49:26 -=BAD=- the .XLS does not open --> fatal error bad_alloc=- Version: 4.3.0.0.alpha0+ Build ID: 20fb1bfc72e626251b435bcff2339e1e425c7130 TinderBox: Win-x86@47-TDF, Branch:MASTER, Time: 2014-04-09_12:09:54 Version: 4.3.0.0.alpha1 (4/21/2014) Build ID: 46cfcd5a05aa1d13fecd73f5a25b64b8d8dd6781 Version: 4.3.0.4 (7/26/2014) Build ID: 62ad5818884a2fc2e5780dd45466868d41009ec0
Created attachment 107383 [details] Stack during bad allocation Stack (ProcessMonitor on Windows 7 sp1, 64-bit) of LODev 4.3.0.0alpha0+ 2014-04-09 during bad allocation
since Markus is on vacation I put Eike on CC list. maybe he can take a look at this.
Created attachment 107433 [details] Stack during bad allocation, 2014-04-16 build I've been unable to get a clean WinDbg stack trace. But, here is another Stack (ProcessMonitor on Windows 7 sp1, 64-bit) for Version: 4.3.0.0.alpha0+ Build ID: 087a79db1272858f107656c5ca3c6efb45680986 TinderBox: Win-x86@39, Branch:master, Time: 2014-04-16_01:43:37 Interesting item in the msfilterlo.dll!?GetDrawingGroupContainerData and its memory allocation Continue to see the same memory allocation error through current buildss of master (4.4.0.0alpha0+). Might the issue be work on msdffimp.hxx and/or msdffimp.cxx?
The issue (bad allocation exception) is reproducible on 32-bit Linux, too. In filter/source/msfilter/msdffimp.cxx in SvxMSDffManager::GetDrawingGroupContainerData() function the value of nLength becomes unrealistically high: 4066730684, and it is not possible to seek to this position in the stream. On 64-bit it is not fatal. In older versions of LibreOffice the exception does not occur, but the pictures on sheet 2 are not loaded. So it would be better to fix parsing of OfficeArtDggContainer. Even xls-dump.py from mso-dumper cannot parse this part of the file, it says: Error: reading 1063605644 bytes from position 116 would exceed the current size of 502937 Excel 2010 has no problem with the file, so I suspect that we need to fix LibreOffice and mso-dumper.
Andras Timar committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=6945971c79d70d77c5c8bb6593b3f25ef46b0887 fdo#84686 prevent std::bad_alloc exception by stricter input check It will be available in 4.5.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Andras Timar committed a patch related to this issue. It has been pushed to "libreoffice-4-4": http://cgit.freedesktop.org/libreoffice/core/commit/?id=544ad733b8a97b62a68c7d0f60f13c8f699407dd&h=libreoffice-4-4 fdo#84686 prevent std::bad_alloc exception by stricter input check It will be available in 4.4.0.0.beta2. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Andras Timar committed a patch related to this issue. It has been pushed to "libreoffice-4-3": http://cgit.freedesktop.org/libreoffice/core/commit/?id=a88078f6574057b7b54c25a8b0fc65bdb88dd2b1&h=libreoffice-4-3 fdo#84686 prevent std::bad_alloc exception by stricter input check It will be available in 4.3.6. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
Migrating Whiteboard tags to Keywords: (bibisected) [NinjaEdit]