Bug 86008 - FILEOPEN: Writer crash when try open attached .doc file
Summary: FILEOPEN: Writer crash when try open attached .doc file
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected) rc
Hardware: All Linux (All)
: high major
Assignee: Julien Nabet
Whiteboard: target:4.4.0 target:4.3.5
Keywords: haveBacktrace
Depends on:
Reported: 2014-11-07 15:33 UTC by Alexander
Modified: 2014-11-11 16:55 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:

crash file (517.00 KB, application/msword)
2014-11-07 15:33 UTC, Alexander
segfault back trace SWW8Implreader::StopApo (10.63 KB, text/plain)
2014-11-07 17:29 UTC, V Stuart Foote

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander 2014-11-07 15:33:50 UTC
Created attachment 109092 [details]
crash file

When try open attached file Writer crash. My OS: Debian GNU/Linux Sid.
Comment 1 V Stuart Foote 2014-11-07 17:29:22 UTC
Created attachment 109096 [details]
segfault back trace SWW8Implreader::StopApo

Confirmed, setting NEW.

Crashing in W8 filter with SIGSEGV, Segmentation fault.

0x00007f9f1d1e559a in SwWW8ImplReader::StopApo (this=0x2921f20)
    at /home/buildslave/source/libo-core/sw/source/filter/ww8/ww8par6.cxx:2513
2513	/home/buildslave/source/libo-core/sw/source/filter/ww8/ww8par6.cxx: No such file or directory.

BT attached.
Comment 2 V Stuart Foote 2014-11-07 17:37:40 UTC
@Lubos, Miklos one for you guys?

A 7 page Word document with several illustrations and a couple of tables.
Comment 3 Julien Nabet 2014-11-07 22:02:13 UTC
I could reproduce the crash with master sources updated today.

With this patch, no crash:
diff --git a/sw/source/filter/ww8/ww8par6.cxx b/sw/source/filter/ww8/ww8par6.cxx
index 4ecf0d5..6f99566 100644
--- a/sw/source/filter/ww8/ww8par6.cxx
+++ b/sw/source/filter/ww8/ww8par6.cxx
@@ -2505,7 +2505,7 @@ void SwWW8ImplReader::StopApo()
         // function, the extension of the SW-fly has to be set
         // manually as the SW fly has no auto function to adjust the
         // frame´s size.
-        if( pSFlyPara->nNewNetWidth > MINFLY )    // BoxUpWidth ?
+        if( pSFlyPara->nNewNetWidth > MINFLY && pSFlyPara->pFlyFmt )    // BoxUpWidth ?
             long nW = pSFlyPara->nNewNetWidth;
             nW += pSFlyPara->nWidth - pSFlyPara->nNetWidth;   // Rand dazu

Miklos: is it ok or am I just hiding the root cause of this crash?
Comment 4 Julien Nabet 2014-11-07 22:02:48 UTC
increase a bit the importance since there's a crash.
Comment 5 Commit Notification 2014-11-10 21:50:29 UTC
Julien Nabet committed a patch related to this issue.
It has been pushed to "master":


Resolves fdo#86008: fix a crash when open doc file

It will be available in 4.4.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
Affected users are encouraged to test the fix and report feedback.
Comment 6 Julien Nabet 2014-11-10 21:54:41 UTC
I pushed the patch because, as I indicated in the comment of the patch, I realized that the other blocks in this part of code, were doing the check I quoted in my previous comment.
Comment 7 Julien Nabet 2014-11-10 22:06:01 UTC
gerrit for 4.3: https://gerrit.libreoffice.org/12356
Comment 8 Julien Nabet 2014-11-11 16:55:05 UTC
The patch has been pushed for 4.3 branch (too late however for 4.3.4 but will be ok for 4.3.5).
Let's put this one to FIXED.