Bug 86879 - FILEOPEN: Hangs trying to open .DOC that MSO opens in Protected View because it detected problem and hangs on editing
Summary: FILEOPEN: Hangs trying to open .DOC that MSO opens in Protected View because ...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.3.3.2 release
Hardware: Other All
: lowest normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: filter:doc, haveBacktrace
Depends on:
Blocks: DOC-Opening
  Show dependency treegraph
 
Reported: 2014-11-30 18:55 UTC by Enrico Zini
Modified: 2024-09-18 10:03 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:


Attachments
.doc file that makes writer hang when opening it (180.50 KB, application/msword)
2014-11-30 18:55 UTC, Enrico Zini
Details
PDF output from online .doc to .pdf converter (241.12 KB, application/pdf)
2014-12-01 08:19 UTC, tommy27
Details
MS word issuing a warning before opening the file (122.46 KB, image/png)
2014-12-01 08:51 UTC, Enrico Zini
Details
MS Word opening the file after a while (84.39 KB, image/png)
2014-12-01 08:52 UTC, Enrico Zini
Details
Word complaining that the document grew too much (82.17 KB, image/png)
2014-12-01 08:55 UTC, Enrico Zini
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Enrico Zini 2014-11-30 18:55:06 UTC
Created attachment 110274 [details]
.doc file that makes writer hang when opening it

Hello,

libreoffice writer hangs forever at 100% CPU trying to open the .doc file attached to this bug report.

This is reproduced every time on my libreoffice 1:4.3.3-1 on Debian Testing, and by a number of friends with unspecified operating systems and versions of libreoffice.


Regards,

Enrico
Comment 1 tommy27 2014-11-30 21:14:53 UTC
that .doc file freezes LibO 4.5.0.0 alpha and 4.3.3.2 as well
however it freezes MS Word Viewer too.

so the question is, are you sure that it's a valid document?
does MS Word open it with no problems?
Comment 2 Enrico Zini 2014-12-01 06:55:39 UTC
I have no access to any version of Microsoft Word; I used http://convertonlinefree.com/ to convert it to PDF and it worked.

Regardless of what Microsoft Word does, I would wish LibreOffice not to freeze on it, but either to open it or to declare it an invalid or corrupted document.
Comment 3 tommy27 2014-12-01 08:16:36 UTC
I converted it to pdf aswell but all I see in the output is a bunch of xxxx xxxx xxx xxx xxx  (was that an anonymized content file?)

what we need is a screenshot of that .doc file how it should really look if opened correctly by any software
Comment 4 tommy27 2014-12-01 08:19:11 UTC
Created attachment 110284 [details]
PDF output from online .doc to .pdf converter

please compare your output with mine and tell if you see the same things
Comment 5 Enrico Zini 2014-12-01 08:51:29 UTC
Created attachment 110286 [details]
MS word issuing a warning before opening the file

The translation is:

Security alert - Validation of Office file

Warning: Office file validation found a problem while trying to open the file. This operation may put your computer at risk and allow a malicious user to take control of your computer.

 - Ask the sender to save and send the file again, and make sure, in person or over the phone, that they actually performed those operations.
[further actions]
 - Protect your computer using these tools.
[safer options]
Comment 6 Enrico Zini 2014-12-01 08:52:49 UTC
Created attachment 110287 [details]
MS Word opening the file after a while

After issuing the warning, MS Word actually managed to open the file, although I'm told "it took a long time". This is the screnshot that came out.
Comment 7 Enrico Zini 2014-12-01 08:55:08 UTC
Created attachment 110288 [details]
Word complaining that the document grew too much

The file once opened in MS Word shows the xxx anonymized text and some blank pages. The total page count increases as the document is scrolled down through an infinite sequence of blank pages. At some point Word gives up and shows this error message: "Exceeded the maximum number of pages supported by Microsoft Office Word"
Comment 8 Enrico Zini 2014-12-01 08:56:36 UTC
I confirm that the PDF that I got has the same content. The content is full of 'x' after I used a hex editor to overwrite all the text I could find with 'x'.

In the meantime, I managed to find a friend with MS Word who took a few screenshots: I've attached them, with comments and translation of the Italian messages.
Comment 9 tommy27 2014-12-01 09:12:09 UTC
ok, thanks. it seems a "problematic" file even in MS Word.

do you know eho created such a file and with which program?

anyway status --> NEW

let's see what a Writed expert developer thinks about it.
Comment 10 Enrico Zini 2014-12-01 09:22:24 UTC
Unfortunately I don't know the person who created it; the friend who received it understood that it has been created with MS Word, somehow copypasting some powerpoint slides into it.

> let's see what a Writed expert developer thinks about it.

Thanks!
Comment 11 Timur 2016-04-05 11:10:05 UTC
I'm not sure whether this bug should stay open. DOC is not valid, it hangs Office 2010. Still LO should not hang. 


SYMBOL_NAME:  swlo!std::_Move<SwTextAttr * &>+6
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: swlo
IMAGE_NAME:  swlo.dll
DEBUG_FLR_IMAGE_TIMESTAMP:  56f69ed9
STACK_COMMAND:  dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s; .ecxr ; kb
FAILURE_BUCKET_ID:  STATUS_BREAKPOINT_80000003_swlo.dll!std::_Move_SwTextAttr_*___
BUCKET_ID:  APPLICATION_FAULT_STATUS_BREAKPOINT_swlo!std::_Move_SwTextAttr_*___+6
ANALYSIS_SOURCE:  UM
FAILURE_ID_HASH_STRING:  um:status_breakpoint_80000003_swlo.dll!std::_move_swtextattr_*___
FAILURE_ID_HASH:  {de62de0d-0802-0c61-1bb9-c58b8651555b}
Comment 12 QA Administrators 2017-12-11 08:54:35 UTC Comment hidden (obsolete)
Comment 13 XTR 2017-12-12 04:15:30 UTC
still repro with
Version: 6.0.0.0.beta2 (x64)
Build ID: 13edaaa12f25de343fce136064e27da66c1c4fa4
CPU threads: 2; OS: Windows 6.1; UI render: default; 
Locale: ru-RU (ru_RU); Calc: group threaded
Comment 14 QA Administrators 2018-12-13 03:50:34 UTC Comment hidden (obsolete)
Comment 15 Enrico Zini 2018-12-13 08:52:28 UTC
Hello.

I tried to open the document with libreoffice-writer 1:6.1.3-1 from Debian Buster by just running 'lowriter crash.doc', and it still hangs on startup.

I am not a libreoffice developer, and I'm not able to do more than that. Any libreoffice developer can do that in seconds on their system, by the way.

I am quite miffed that this bug is still open, that it is still a bug, that 4 years later I am still asked to try and reproduce it, that there was even argument on whether this was a valid bug.

To summarise the current situation, here's a document, found in the wild, that reproducibly hangs on startup any version of libreoffice writer from the last 4 years.


Enrico
Comment 16 Julien Nabet 2019-02-13 21:12:20 UTC
On pc Debian x86-64 with master sources updated some days ago, there's a nonending loop here:
#13 0x00007fffda16dc79 in SwWW8ImplReader::ReadChar(long, long) (this=0x55555ac8d980, nPosCp=3370, nCpOfs=0)
    at /home/julien/lo/libreoffice/sw/source/filter/ww8/ww8par.cxx:3558
#14 0x00007fffda16d772 in SwWW8ImplReader::ReadChars(int&, int, long, long) (this=0x55555ac8d980, rPos=@0x7ffffffef3c0: 3370, nNextAttr=123763, nTextEnd=124060, nCpOfs=0)
    at /home/julien/lo/libreoffice/sw/source/filter/ww8/ww8par.cxx:3475
Comment 17 Julien Nabet 2019-02-13 21:16:38 UTC
The pb is here precisely
https://opengrok.libreoffice.org/xref/core/sw/source/filter/ww8/ww8par.cxx?r=30c0134c#3102
3101      sal_Int32 nL2;
3102      for (nL2 = 0; nL2 < nStrLen; ++nL2)
3103      {
...
3118  
3119          if ((32 > nUCode) || (0xa0 == nUCode))
3120          {
3121              m_pStrm->SeekRel( m_bIsUnicode ? -2 : -1 );
3122              break; // Special character < 32, == 0xa0 found
3123          }
3124  
We enter at nL2 = 0, we enter in "if" condition because of something wrong in the file.
So we go backward in the file with call to m_pStrm->SeekRel with negative value.
Comment 18 Julien Nabet 2019-02-13 21:21:31 UTC
I submitted a patch to review here:
https://gerrit.libreoffice.org/#/c/67794/

Hope it's ok, at least, I could open the doc.
Comment 19 Timur 2019-02-14 08:42:54 UTC
MSO 2016 opens in Protected View because it detected problem but also hangs on editing.
Comment 20 Julien Nabet 2019-02-14 21:02:29 UTC
The patch makes the QA tests fail and I don’t know why. I gave up the patch
Comment 21 QA Administrators 2021-02-14 04:04:34 UTC Comment hidden (obsolete, spam)
Comment 22 QA Administrators 2024-09-08 03:16:41 UTC Comment hidden (obsolete)
Comment 23 Enrico Zini 2024-09-18 10:03:50 UTC
I can still reproduce the issue with the version of Libreoffice in Debian Bookworm, and I have no access to newer versions:

Version: 7.4.7.2 / LibreOffice Community
Build ID: 40(Build:2)
CPU threads: 4; OS: Linux 6.1; UI render: default; VCL: gtk3
Locale: en-IE (en_IE.UTF-8); UI: en-US
Debian package version: 4:7.4.7-1+deb12u4
Calc: threaded

Reproducing this issue is trivial: run lowriter crash.doc

Even if the .doc file is invalid, libreoffice should refuse to open it instead of entering an infinite busy-loop.

This could potentially be remotely exploited for DoS attacks for sites that use libreoffice as a backend for conversion of user-provided documents, as it can be reproduced with:

loffice --headless --convert-to txt:Text crash.doc

I am not however knowledgeable enough of the triaging process to make this an issue of major importance.

It's becoming rather frustrating to revalidate this issue, trivially reproducible after 10 years, while the bot regularly attempts to close it.