Bug 86879 - FILEOPEN: Hangs trying to open .DOC that MSO opens in Protected View because it detected problem and hangs on editing
Summary: FILEOPEN: Hangs trying to open .DOC that MSO opens in Protected View because ...
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
(earliest affected) release
Hardware: Other All
: lowest major
Assignee: Not Assigned
Keywords: filter:doc, haveBacktrace
Depends on:
Blocks: DOC-Opening
  Show dependency treegraph
Reported: 2014-11-30 18:55 UTC by Enrico Zini
Modified: 2022-09-08 19:32 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:

.doc file that makes writer hang when opening it (180.50 KB, application/msword)
2014-11-30 18:55 UTC, Enrico Zini
PDF output from online .doc to .pdf converter (241.12 KB, application/pdf)
2014-12-01 08:19 UTC, tommy27
MS word issuing a warning before opening the file (122.46 KB, image/png)
2014-12-01 08:51 UTC, Enrico Zini
MS Word opening the file after a while (84.39 KB, image/png)
2014-12-01 08:52 UTC, Enrico Zini
Word complaining that the document grew too much (82.17 KB, image/png)
2014-12-01 08:55 UTC, Enrico Zini

Note You need to log in before you can comment on or make changes to this bug.
Description Enrico Zini 2014-11-30 18:55:06 UTC
Created attachment 110274 [details]
.doc file that makes writer hang when opening it


libreoffice writer hangs forever at 100% CPU trying to open the .doc file attached to this bug report.

This is reproduced every time on my libreoffice 1:4.3.3-1 on Debian Testing, and by a number of friends with unspecified operating systems and versions of libreoffice.


Comment 1 tommy27 2014-11-30 21:14:53 UTC
that .doc file freezes LibO alpha and as well
however it freezes MS Word Viewer too.

so the question is, are you sure that it's a valid document?
does MS Word open it with no problems?
Comment 2 Enrico Zini 2014-12-01 06:55:39 UTC
I have no access to any version of Microsoft Word; I used http://convertonlinefree.com/ to convert it to PDF and it worked.

Regardless of what Microsoft Word does, I would wish LibreOffice not to freeze on it, but either to open it or to declare it an invalid or corrupted document.
Comment 3 tommy27 2014-12-01 08:16:36 UTC
I converted it to pdf aswell but all I see in the output is a bunch of xxxx xxxx xxx xxx xxx  (was that an anonymized content file?)

what we need is a screenshot of that .doc file how it should really look if opened correctly by any software
Comment 4 tommy27 2014-12-01 08:19:11 UTC
Created attachment 110284 [details]
PDF output from online .doc to .pdf converter

please compare your output with mine and tell if you see the same things
Comment 5 Enrico Zini 2014-12-01 08:51:29 UTC
Created attachment 110286 [details]
MS word issuing a warning before opening the file

The translation is:

Security alert - Validation of Office file

Warning: Office file validation found a problem while trying to open the file. This operation may put your computer at risk and allow a malicious user to take control of your computer.

 - Ask the sender to save and send the file again, and make sure, in person or over the phone, that they actually performed those operations.
[further actions]
 - Protect your computer using these tools.
[safer options]
Comment 6 Enrico Zini 2014-12-01 08:52:49 UTC
Created attachment 110287 [details]
MS Word opening the file after a while

After issuing the warning, MS Word actually managed to open the file, although I'm told "it took a long time". This is the screnshot that came out.
Comment 7 Enrico Zini 2014-12-01 08:55:08 UTC
Created attachment 110288 [details]
Word complaining that the document grew too much

The file once opened in MS Word shows the xxx anonymized text and some blank pages. The total page count increases as the document is scrolled down through an infinite sequence of blank pages. At some point Word gives up and shows this error message: "Exceeded the maximum number of pages supported by Microsoft Office Word"
Comment 8 Enrico Zini 2014-12-01 08:56:36 UTC
I confirm that the PDF that I got has the same content. The content is full of 'x' after I used a hex editor to overwrite all the text I could find with 'x'.

In the meantime, I managed to find a friend with MS Word who took a few screenshots: I've attached them, with comments and translation of the Italian messages.
Comment 9 tommy27 2014-12-01 09:12:09 UTC
ok, thanks. it seems a "problematic" file even in MS Word.

do you know eho created such a file and with which program?

anyway status --> NEW

let's see what a Writed expert developer thinks about it.
Comment 10 Enrico Zini 2014-12-01 09:22:24 UTC
Unfortunately I don't know the person who created it; the friend who received it understood that it has been created with MS Word, somehow copypasting some powerpoint slides into it.

> let's see what a Writed expert developer thinks about it.

Comment 11 Timur 2016-04-05 11:10:05 UTC
I'm not sure whether this bug should stay open. DOC is not valid, it hangs Office 2010. Still LO should not hang. 

SYMBOL_NAME:  swlo!std::_Move<SwTextAttr * &>+6
FOLLOWUP_NAME:  MachineOwner
IMAGE_NAME:  swlo.dll
STACK_COMMAND:  dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s; .ecxr ; kb
FAILURE_BUCKET_ID:  STATUS_BREAKPOINT_80000003_swlo.dll!std::_Move_SwTextAttr_*___
FAILURE_ID_HASH_STRING:  um:status_breakpoint_80000003_swlo.dll!std::_move_swtextattr_*___
FAILURE_ID_HASH:  {de62de0d-0802-0c61-1bb9-c58b8651555b}
Comment 12 QA Administrators 2017-12-11 08:54:35 UTC Comment hidden (obsolete)
Comment 13 XTR 2017-12-12 04:15:30 UTC
still repro with
Version: (x64)
Build ID: 13edaaa12f25de343fce136064e27da66c1c4fa4
CPU threads: 2; OS: Windows 6.1; UI render: default; 
Locale: ru-RU (ru_RU); Calc: group threaded
Comment 14 QA Administrators 2018-12-13 03:50:34 UTC Comment hidden (obsolete)
Comment 15 Enrico Zini 2018-12-13 08:52:28 UTC

I tried to open the document with libreoffice-writer 1:6.1.3-1 from Debian Buster by just running 'lowriter crash.doc', and it still hangs on startup.

I am not a libreoffice developer, and I'm not able to do more than that. Any libreoffice developer can do that in seconds on their system, by the way.

I am quite miffed that this bug is still open, that it is still a bug, that 4 years later I am still asked to try and reproduce it, that there was even argument on whether this was a valid bug.

To summarise the current situation, here's a document, found in the wild, that reproducibly hangs on startup any version of libreoffice writer from the last 4 years.

Comment 16 Julien Nabet 2019-02-13 21:12:20 UTC
On pc Debian x86-64 with master sources updated some days ago, there's a nonending loop here:
#13 0x00007fffda16dc79 in SwWW8ImplReader::ReadChar(long, long) (this=0x55555ac8d980, nPosCp=3370, nCpOfs=0)
    at /home/julien/lo/libreoffice/sw/source/filter/ww8/ww8par.cxx:3558
#14 0x00007fffda16d772 in SwWW8ImplReader::ReadChars(int&, int, long, long) (this=0x55555ac8d980, rPos=@0x7ffffffef3c0: 3370, nNextAttr=123763, nTextEnd=124060, nCpOfs=0)
    at /home/julien/lo/libreoffice/sw/source/filter/ww8/ww8par.cxx:3475
Comment 17 Julien Nabet 2019-02-13 21:16:38 UTC
The pb is here precisely
3101      sal_Int32 nL2;
3102      for (nL2 = 0; nL2 < nStrLen; ++nL2)
3103      {
3119          if ((32 > nUCode) || (0xa0 == nUCode))
3120          {
3121              m_pStrm->SeekRel( m_bIsUnicode ? -2 : -1 );
3122              break; // Special character < 32, == 0xa0 found
3123          }
We enter at nL2 = 0, we enter in "if" condition because of something wrong in the file.
So we go backward in the file with call to m_pStrm->SeekRel with negative value.
Comment 18 Julien Nabet 2019-02-13 21:21:31 UTC
I submitted a patch to review here:

Hope it's ok, at least, I could open the doc.
Comment 19 Timur 2019-02-14 08:42:54 UTC
MSO 2016 opens in Protected View because it detected problem but also hangs on editing.
Comment 20 Julien Nabet 2019-02-14 21:02:29 UTC
The patch makes the QA tests fail and I don’t know why. I gave up the patch
Comment 21 QA Administrators 2021-02-14 04:04:34 UTC Comment hidden (spam)