94049 – RTF IMPORT: rtf file with OLE object crashes libreoffice every time

Bug 94049 - RTF IMPORT: rtf file with OLE object crashes libreoffice every time

Summary: RTF IMPORT: rtf file with OLE object crashes libreoffice every time

Status:	RESOLVED FIXED

Alias:	None

Product:	LibreOffice
Classification:	Unclassified
Component:	filters and storage (show other bugs)
Version: (earliest affected)	5.1.0.0.alpha0+ Master
Hardware:	x86-64 (AMD64) Linux (All)

Importance:	medium normal
Assignee:	Miklos Vajna

URL:
Whiteboard:	target:5.1.0 target:5.0.4 target:25....
Keywords:

Depends on:
Blocks:

Reported:	2015-09-09 09:07 UTC by Sean Young
Modified:	2024-09-20 08:34 UTC (History)
CC List:	4 users (show)

See Also:
Crash report or crash signature:

Attachments
Open this file an libreoffice always crashes (80.56 KB, application/rtf) 2015-09-09 09:07 UTC, Sean Young	Details
Original Microsoft Write file (39.62 KB, application/octet-stream) 2015-10-08 12:12 UTC, Sean Young	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sean Young 2015-09-09 09:07:09 UTC

Created attachment 118545 [details]
Open this file an libreoffice always crashes

Stack trace:

(gdb) bt
#0  0x00002aaaab2f49c8 in raise () at /lib64/libc.so.6
#1  0x00002aaaab2f665a in abort () at /lib64/libc.so.6
#2  0x00002aaaabd5e5a5 in __gnu_debug::_Error_formatter::_M_error() const ()
    at /lib64/libstdc++.so.6
#3  0x00002aaae5261dad in std::stack<writerfilter::dmapper::TextAppendContext, std::__debug::deque<writerfilter::dmapper::TextAppendContext, std::allocator<writerfilter::dmapper::TextAppendContext> > >::pop() (this=0x23237d0)
    at /usr/include/c++/5.1.1/bits/stl_stack.h:217
#4  0x00002aaae5238a77 in writerfilter::dmapper::DomainMapper_Impl::appendOLE(rtl::OUString const&, std::shared_ptr<writerfilter::dmapper::OLEHandler>) (this=0x2323780, rStreamName=..., pOLEHandler=
    std::shared_ptr (count 2, weak 0) 0x2285c80)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper_Impl.cxx:1374
#5  0x00002aaae51ef39d in writerfilter::dmapper::DomainMapper::sprmWithProps(writerfilter::Sprm&, std::shared_ptr<writerfilter::dmapper::PropertyMap>) (this=0x2224780, rSprm=..., rContext=std::shared_ptr (count 3, weak 0) 0x2287d30)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper.cxx:2278
#6  0x00002aaae51e7f84 in writerfilter::dmapper::DomainMapper::lcl_sprm(writerfilter::Sprm&) (this=0x2224780, rSprm=...)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper.cxx:1028
#7  0x00002aaae52ab6e5 in writerfilter::LoggedProperties::sprm(writerfilter::Sprm&) (this=0x2224780, rSprm=...)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/LoggedResources.cxx:340
#8  0x00002aaae51acfbf in writerfilter::rtftok::RTFReferenceProperties::resolve(writerfilter::Properties&) (this=0x1f23590, rHandler=...)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtfreferenceproperties.cxx:40
#9  0x00002aaae51f68c0 in writerfilter::dmapper::DomainMapper::lcl_props(std::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) (this=0x2224780, ref=std::shared_ptr (count 3, weak 0) 0x1f23590)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper.cxx:3196
#10 0x00002aaae52aaa33 in writerfilter::LoggedStream::props(std::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) (this=0x22247b8, ref=std::shared_ptr (count 3, weak 0) 0x1f23590)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/LoggedResources.cx---Type <return> to continue, or q <return> to quit---
x:255
#11 0x00002aaae515bcc5 in writerfilter::rtftok::RTFDocumentImpl::popState() (this=0x2107790)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtfdocumentimpl.cxx:5414
#12 0x00002aaae51c6ccd in writerfilter::rtftok::RTFTokenizer::resolveParse() (this=0x21f73e0)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtftokenizer.cxx:107
#13 0x00002aaae5141ae6 in writerfilter::rtftok::RTFDocumentImpl::resolve(writerfilter::Stream&) (this=0x2107790, rMapper=...)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtfdocumentimpl.cxx:710
#14 0x00002aaae5325886 in RtfFilter::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x22b2bd0, aDescriptor=...)
    at /home/sean/git/libreoffice/writerfilter/source/filter/RtfFilter.cxx:152

#15 0x00002aaaaec5999d in SfxObjectShell::ImportFrom(SfxMedium&, com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) (this=0x2223a50, 
    rMedium=..., xInsertPosition=...)
    at /home/sean/git/libreoffice/sfx2/source/doc/objstor.cxx:2279
#16 0x00002aaaaec51a2e in SfxObjectShell::DoLoad(SfxMedium*) (this=0x2223a50, pMed=0x1f4e2a0) at /home/sean/git/libreoffice/sfx2/source/doc/objstor.cxx:775
#17 0x00002aaaaec985e3 in SfxBaseModel::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x209baf0, seqArguments=...)
    at /home/sean/git/libreoffice/sfx2/source/doc/sfxbasemodel.cxx:1860
#18 0x00002aaaaed9144c in (anonymous namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (this=0x20dc2d0, rArgs=..., _rTargetFrame=...)
    at /home/sean/git/libreoffice/sfx2/source/view/frmload.cxx:703
#19 0x00002aaad11173cc in framework::LoadEnv::impl_loadContent() (this=0x235bad0) at /home/sean/git/libreoffice/framework/source/loadenv/loadenv.cxx:1128
#20 0x00002aaad11136c9 in framework::LoadEnv::startLoading() (this=0x235bad0)
    at /home/sean/git/libreoffice/framework/source/loadenv/loadenv.cxx:388
#21 0x00002aaad1094bb8 in framework::LoadDispatcher::impl_dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) (this=0x235ba70, rURL=..., lArguments=..., xListener=...)
    at /home/sean/git/libreoffice/framework/source/dispatch/loaddispatcher.cxx:115
---Type <return> to continue, or q <return> to quit---
#22 0x00002aaad1094879 in framework::LoadDispatcher::dispatchWithReturnValue(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x235ba70, rURL=..., lArguments=...)
    at /home/sean/git/libreoffice/framework/source/dispatch/loaddispatcher.cxx:62
#23 0x00002aaaad0b6f18 in comphelper::SynchronousDispatch::dispatch(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (xStartPoint=..., sURL=..., sTarget=..., nFlags=0, lArguments=...)
    at /home/sean/git/libreoffice/comphelper/source/misc/synchronousdispatch.cxx:64
#24 0x00002aaaae8ff9c7 in SfxApplication::OpenDocExec_Impl(SfxRequest&) (this=
    0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/sfx2/source/appl/appopen.cxx:1063
#25 0x00002aaaae8f58cf in SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&) (pShell=0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/workdir/SdiTarget/sfx2/sdi/sfxslots.hxx:1242
#26 0x00002aaaae9ff878 in SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (this=0x13a4330, pFunc=0x2aaaae8f58ac <SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&)>, rReq=...)
    at /home/sean/git/libreoffice/include/sfx2/shell.hxx:208
#27 0x00002aaaae9f6e00 in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x195b940, rShell=..., rSlot=..., rReq=..., bRecord=false) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:259
#28 0x00002aaaae9f9d44 in SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (this=0x195b940, rShell=..., rSlot=..., rReq=..., eCallMode=SfxCallMode::SYNCHRON)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:849
#29 0x00002aaaae9fa79d in SfxDispatcher::Execute(unsigned short, SfxCallMode, unsigned short, SfxItemSet const&) (this=0x195b940, nSlot=5501, eCall=SfxCallMode::SYNCHRON, nModi=0, rArgs=...)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:1012
#30 0x00002aaaae9fa5d4 in SfxDispatcher::Execute(unsigned short, SfxCallMode, SfxItemSet const&) (this=0x195b940, nSlot=5501, eCall=SfxCallMode::SYNCHRON, rArgs=...) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:990
#31 0x00002aaaae8fde5a in SfxApplication::OpenDocExec_Impl(SfxRequest&) (this=0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/sfx2/source/appl/appopen.cxx:707
#32 0x00002aaaae8f58cf in SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRe---Type <return> to continue, or q <return> to quit---
quest&) (pShell=0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/workdir/SdiTarget/sfx2/sdi/sfxslots.hxx:1242
#33 0x00002aaaae9ff878 in SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (this=0x13a4330, pFunc=0x2aaaae8f58ac <SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&)>, rReq=...)
    at /home/sean/git/libreoffice/include/sfx2/shell.hxx:208
#34 0x00002aaaae9f6e00 in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x195b940, rShell=..., rSlot=..., rReq=..., bRecord=false) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:259
#35 0x00002aaaae9f9d44 in SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (this=0x195b940, rShell=..., rSlot=..., rReq=..., eCallMode=(SfxCallMode::SYNCHRON | SfxCallMode::API))
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:849
#36 0x00002aaaae9faa69 in SfxDispatcher::Execute(unsigned short, SfxCallMode, SfxPoolItem const*, ...) (this=0x195b940, nSlot=5501, eCall=(SfxCallMode::SYNCHRON | SfxCallMode::API), pArg1=0x7fffffff3570)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:1067
#37 0x00002aaad56d85f7 in SwDocShell::Execute(SfxRequest&) (this=0x18b6d50, rReq=...) at /home/sean/git/libreoffice/sw/source/uibase/app/docsh2.cxx:1143
#38 0x00002aaad56cc0a3 in SfxStubSwDocShellExecute(SfxShell*, SfxRequest&) (pShell=0x18b6d50, rReq=...)
    at /home/sean/git/libreoffice/workdir/SdiTarget/sw/sdi/swslots.hxx:1347
#39 0x00002aaaae9ff878 in SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (this=0x18b6d50, pFunc=0x2aaad56cc080 <SfxStubSwDocShellExecute(SfxShell*, SfxRequest&)>, rReq=...)
    at /home/sean/git/libreoffice/include/sfx2/shell.hxx:208
#40 0x00002aaaae9f6e00 in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x195b940, rShell=..., rSlot=..., rReq=..., bRecord=true) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:259
#41 0x00002aaaae9f9d44 in SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (this=0x195b940, rShell=..., rSlot=..., rReq=..., eCallMode=SfxCallMode::RECORD)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:849
#42 0x00002aaaae9e2c37 in SfxBindings::Execute_Impl(SfxRequest&, SfxSlot const*, SfxShell*) (this=0x194cf30, aReq=..., pSlot=0x2aaad663ee60 <aSwDocShellSlots_Impl+1920>, pShell=0x18b6d50)
    at /home/sean/git/libreoffice/sfx2/source/control/bindings.cxx:1280
#43 0x00002aaaaea6eac7 in SfxDispatchController_Impl::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResu---Type <return> to continue, or q <return> to quit---
ltListener> const&) (this=0x1f12630, aURL=..., aArgs=..., rListener=...)
    at /home/sean/git/libreoffice/sfx2/source/control/unoctitm.cxx:844
#44 0x00002aaaaea6c937 in SfxOfficeDispatch::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x1f12790, aURL=..., aArgs=...)
    at /home/sean/git/libreoffice/sfx2/source/control/unoctitm.cxx:359
#45 0x00002aaaafef5ceb in svt::ToolboxController::execute(short) (this=0x1b11920, KeyModifier=0)
    at /home/sean/git/libreoffice/svtools/source/uno/toolboxcontroller.cxx:362
#46 0x00002aaaaed827d3 in SfxToolBoxControl::Select(unsigned short) (this=0x1b11920, nSelectModifier=0)
    at /home/sean/git/libreoffice/sfx2/source/toolbox/tbxitem.cxx:727
#47 0x00002aaaaed81d38 in SfxToolBoxControl::execute(short) (this=0x1b11920, KeyModifier=0) at /home/sean/git/libreoffice/sfx2/source/toolbox/tbxitem.cxx:587
#48 0x00002aaad125690e in framework::ToolBarManager::Select(ToolBox*) (this=0x1a9cc50)
    at /home/sean/git/libreoffice/framework/source/uielement/toolbarmanager.cxx:2046
#49 0x00002aaad12567b7 in framework::ToolBarManager::LinkStubSelect(void*, ToolBox*) (instance=0x1a9cc50, data=0x1a9bcc0)
    at /home/sean/git/libreoffice/framework/source/uielement/toolbarmanager.cxx:2032
#50 0x00002aaab1b85df5 in Link<ToolBox*, void>::Call(ToolBox*) const (this=0x1a9c1f8, data=0x1a9bcc0) at /home/sean/git/libreoffice/include/tools/link.hxx:127
#51 0x00002aaab1b7e42e in ToolBox::Select() (this=0x1a9bcc0)
    at /home/sean/git/libreoffice/vcl/source/window/toolbox2.cxx:444
#52 0x00002aaab1b9a87c in ToolBox::ImplHandleMouseButtonUp(MouseEvent const&, bool) (this=0x1a9bcc0, rMEvt=..., bCancel=false)
    at /home/sean/git/libreoffice/vcl/source/window/toolbox.cxx:3537
#53 0x00002aaab1b9c669 in ToolBox::Tracking(TrackingEvent const&) (this=0x1a9bcc0, rTEvt=...) at /home/sean/git/libreoffice/vcl/source/window/toolbox.cxx:4044
#54 0x00002aaab1badd99 in vcl::Window::EndTracking(TrackingEventFlags) (this=0x1a9bcc0, nFlags=TrackingEventFlags::NONE)
    at /home/sean/git/libreoffice/vcl/source/window/window2.cxx:368
#55 0x00002aaab1bdb1c8 in ImplHandleMouseEvent(vcl::Window*, MouseNotifyEvent, bool, long, long, unsigned long, unsigned short, MouseEventModifiers) (pWindow=0x12e1ce0, nSVEvent=MouseNotifyEvent::MOUSEBUTTONUP, bMouseLeave=false, nX=69, nY=42, nMsgTime=3622313, nCode=1, nMode=(MouseEventModifiers::SIMPLECLICK | MouseEventModifiers::SELECT))
    at /home/sean/git/libreoffice/vcl/source/window/winproc.cxx:730
---Type <return> to continue, or q <return> to quit---
#56 0x00002aaab1be22b7 in ImplHandleSalMouseButtonUp(vcl::Window*, SalMouseEvent*) (pWindow=0x12e1ce0, pEvent=0x7fffffff4650)
    at /home/sean/git/libreoffice/vcl/source/window/winproc.cxx:2090
#57 0x00002aaab1be09a1 in ImplWindowFrameProc(vcl::Window*, SalFrame*, unsigned short, void const*) (_pWindow=0x12e1ce0, nEvent=4, pEvent=0x7fffffff4650)
    at /home/sean/git/libreoffice/vcl/source/window/winproc.cxx:2425
#58 0x00002aaac89ff6c9 in SalFrame::CallCallback(unsigned short, void const*) const (this=0x12e22a0, nEvent=4, pEvent=0x7fffffff4650)
    at /home/sean/git/libreoffice/vcl/inc/salframe.hxx:247
#59 0x00002aaac89fb029 in GtkSalFrame::signalButton(_GtkWidget*, _GdkEventButton*, void*) (pEvent=0x2147290, frame=0x12e22a0)
    at /home/sean/git/libreoffice/vcl/unx/gtk3/window/../../gtk/window/gtksalframe.cxx:3471
#60 0x00002aaac8e8202d in _gtk_marshal_BOOLEAN__BOXED ()
    at /lib64/libgtk-3.so.0
#61 0x00002aaab89c4cd5 in g_closure_invoke () at /lib64/libgobject-2.0.so.0
#62 0x00002aaab89d6539 in signal_emit_unlocked_R ()
    at /lib64/libgobject-2.0.so.0
#63 0x00002aaab89deae2 in g_signal_emit_valist () at /lib64/libgobject-2.0.so.0
#64 0x00002aaab89df29f in g_signal_emit () at /lib64/libgobject-2.0.so.0
#65 0x00002aaac8fbb6a4 in gtk_widget_event_internal () at /lib64/libgtk-3.so.0
#66 0x00002aaac8e7f61e in propagate_event () at /lib64/libgtk-3.so.0
#67 0x00002aaac8e8127e in gtk_main_do_event () at /lib64/libgtk-3.so.0
#68 0x00002aaac95bb772 in gdk_event_source_dispatch () at /lib64/libgdk-3.so.0
#69 0x00002aaab8c50a8a in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#70 0x00002aaab8c50e20 in g_main_context_iterate.isra ()
    at /lib64/libglib-2.0.so.0
#71 0x00002aaab8c50ecc in g_main_context_iteration ()
    at /lib64/libglib-2.0.so.0
#72 0x00002aaac8999803 in GtkData::Yield(bool, bool) (this=
    0x64fa30, bWait=true, bHandleAllCurrentEvents=false)
    at /home/sean/git/libreoffice/vcl/unx/gtk3/app/../../gtk/app/gtkdata.cxx:604
#73 0x00002aaac899c9a1 in GtkInstance::DoYield(bool, bool, unsigned long) (this=0x64f8f0, bWait=true, bHandleAllCurrentEvents=false, nReleased=0)
    at /home/sean/git/libreoffice/vcl/unx/gtk3/app/../../gtk/app/gtkinst.cxx:406
#74 0x00002aaab203ad2d in ImplYield(bool, bool, unsigned long) (i_bWait=true, i_bAllEvents=false, nReleased=0)
    at /home/sean/git/libreoffice/vcl/source/app/svapp.cxx:362
---Type <return> to continue, or q <return> to quit---
#75 0x00002aaab20370e2 in Application::Yield() ()
    at /home/sean/git/libreoffice/vcl/source/app/svapp.cxx:391
#76 0x00002aaab2037094 in Application::Execute() ()
    at /home/sean/git/libreoffice/vcl/source/app/svapp.cxx:337
#77 0x00002aaaaaf9d4ed in desktop::Desktop::Main() (this=0x7fffffff5370)
    at /home/sean/git/libreoffice/desktop/source/app/app.cxx:1590
#78 0x00002aaab20400ca in ImplSVMain() ()
    at /home/sean/git/libreoffice/vcl/source/app/svmain.cxx:169
#79 0x00002aaab204020c in SVMain() ()
    at /home/sean/git/libreoffice/vcl/source/app/svmain.cxx:206
#80 0x00002aaaaafe8e9c in soffice_main() ()
    at /home/sean/git/libreoffice/desktop/source/app/sofficemain.cxx:96
#81 0x000000000040095e in sal_main ()
    at /home/sean/git/libreoffice/desktop/source/app/main.c:48
#82 0x0000000000400944 in main (argc=4, argv=0x7fffffff5698)
    at /home/sean/git/libreoffice/desktop/source/app/main.c:47
(gdb) bt
#0  0x00002aaaab2f49c8 in raise () at /lib64/libc.so.6
#1  0x00002aaaab2f665a in abort () at /lib64/libc.so.6
#2  0x00002aaaabd5e5a5 in __gnu_debug::_Error_formatter::_M_error() const ()
    at /lib64/libstdc++.so.6
#3  0x00002aaae5261dad in std::stack<writerfilter::dmapper::TextAppendContext, std::__debug::deque<writerfilter::dmapper::TextAppendContext, std::allocator<writerfilter::dmapper::TextAppendContext> > >::pop() (this=0x23237d0)
    at /usr/include/c++/5.1.1/bits/stl_stack.h:217
#4  0x00002aaae5238a77 in writerfilter::dmapper::DomainMapper_Impl::appendOLE(rtl::OUString const&, std::shared_ptr<writerfilter::dmapper::OLEHandler>) (this=0x2323780, rStreamName=..., pOLEHandler=
    std::shared_ptr (count 2, weak 0) 0x2285c80)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper_Impl.cxx:1374
#5  0x00002aaae51ef39d in writerfilter::dmapper::DomainMapper::sprmWithProps(writerfilter::Sprm&, std::shared_ptr<writerfilter::dmapper::PropertyMap>) (this=0x2224780, rSprm=..., rContext=std::shared_ptr (count 3, weak 0) 0x2287d30)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper.cxx:2278
#6  0x00002aaae51e7f84 in writerfilter::dmapper::DomainMapper::lcl_sprm(writerfilter::Sprm&) (this=0x2224780, rSprm=...)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper.cxx:1028
#7  0x00002aaae52ab6e5 in writerfilter::LoggedProperties::sprm(writerfilter::Sprm&) (this=0x2224780, rSprm=...)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/LoggedResources.cxx:340
#8  0x00002aaae51acfbf in writerfilter::rtftok::RTFReferenceProperties::resolve(writerfilter::Properties&) (this=0x1f23590, rHandler=...)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtfreferenceproperties.cxx:40
#9  0x00002aaae51f68c0 in writerfilter::dmapper::DomainMapper::lcl_props(std::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) (this=0x2224780, ref=std::shared_ptr (count 3, weak 0) 0x1f23590)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper.cxx:3196
#10 0x00002aaae52aaa33 in writerfilter::LoggedStream::props(std::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) (this=0x22247b8, ref=std::shared_ptr (count 3, weak 0) 0x1f23590)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/LoggedResources.cx---Type <return> to continue, or q <return> to quit---
x:255
#11 0x00002aaae515bcc5 in writerfilter::rtftok::RTFDocumentImpl::popState() (this=0x2107790)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtfdocumentimpl.cxx:5414
#12 0x00002aaae51c6ccd in writerfilter::rtftok::RTFTokenizer::resolveParse() (this=0x21f73e0)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtftokenizer.cxx:107
#13 0x00002aaae5141ae6 in writerfilter::rtftok::RTFDocumentImpl::resolve(writerfilter::Stream&) (this=0x2107790, rMapper=...)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtfdocumentimpl.cxx:710
#14 0x00002aaae5325886 in RtfFilter::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x22b2bd0, aDescriptor=...)
    at /home/sean/git/libreoffice/writerfilter/source/filter/RtfFilter.cxx:152

#15 0x00002aaaaec5999d in SfxObjectShell::ImportFrom(SfxMedium&, com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) (this=0x2223a50, 
    rMedium=..., xInsertPosition=...)
    at /home/sean/git/libreoffice/sfx2/source/doc/objstor.cxx:2279
#16 0x00002aaaaec51a2e in SfxObjectShell::DoLoad(SfxMedium*) (this=0x2223a50, pMed=0x1f4e2a0) at /home/sean/git/libreoffice/sfx2/source/doc/objstor.cxx:775
#17 0x00002aaaaec985e3 in SfxBaseModel::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x209baf0, seqArguments=...)
    at /home/sean/git/libreoffice/sfx2/source/doc/sfxbasemodel.cxx:1860
#18 0x00002aaaaed9144c in (anonymous namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (this=0x20dc2d0, rArgs=..., _rTargetFrame=...)
    at /home/sean/git/libreoffice/sfx2/source/view/frmload.cxx:703
#19 0x00002aaad11173cc in framework::LoadEnv::impl_loadContent() (this=0x235bad0) at /home/sean/git/libreoffice/framework/source/loadenv/loadenv.cxx:1128
#20 0x00002aaad11136c9 in framework::LoadEnv::startLoading() (this=0x235bad0)
    at /home/sean/git/libreoffice/framework/source/loadenv/loadenv.cxx:388
#21 0x00002aaad1094bb8 in framework::LoadDispatcher::impl_dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) (this=0x235ba70, rURL=..., lArguments=..., xListener=...)
    at /home/sean/git/libreoffice/framework/source/dispatch/loaddispatcher.cxx:115
---Type <return> to continue, or q <return> to quit---
#22 0x00002aaad1094879 in framework::LoadDispatcher::dispatchWithReturnValue(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x235ba70, rURL=..., lArguments=...)
    at /home/sean/git/libreoffice/framework/source/dispatch/loaddispatcher.cxx:62
#23 0x00002aaaad0b6f18 in comphelper::SynchronousDispatch::dispatch(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (xStartPoint=..., sURL=..., sTarget=..., nFlags=0, lArguments=...)
    at /home/sean/git/libreoffice/comphelper/source/misc/synchronousdispatch.cxx:64
#24 0x00002aaaae8ff9c7 in SfxApplication::OpenDocExec_Impl(SfxRequest&) (this=
    0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/sfx2/source/appl/appopen.cxx:1063
#25 0x00002aaaae8f58cf in SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&) (pShell=0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/workdir/SdiTarget/sfx2/sdi/sfxslots.hxx:1242
#26 0x00002aaaae9ff878 in SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (this=0x13a4330, pFunc=0x2aaaae8f58ac <SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&)>, rReq=...)
    at /home/sean/git/libreoffice/include/sfx2/shell.hxx:208
#27 0x00002aaaae9f6e00 in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x195b940, rShell=..., rSlot=..., rReq=..., bRecord=false) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:259
#28 0x00002aaaae9f9d44 in SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (this=0x195b940, rShell=..., rSlot=..., rReq=..., eCallMode=SfxCallMode::SYNCHRON)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:849
#29 0x00002aaaae9fa79d in SfxDispatcher::Execute(unsigned short, SfxCallMode, unsigned short, SfxItemSet const&) (this=0x195b940, nSlot=5501, eCall=SfxCallMode::SYNCHRON, nModi=0, rArgs=...)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:1012
#30 0x00002aaaae9fa5d4 in SfxDispatcher::Execute(unsigned short, SfxCallMode, SfxItemSet const&) (this=0x195b940, nSlot=5501, eCall=SfxCallMode::SYNCHRON, rArgs=...) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:990
#31 0x00002aaaae8fde5a in SfxApplication::OpenDocExec_Impl(SfxRequest&) (this=0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/sfx2/source/appl/appopen.cxx:707
#32 0x00002aaaae8f58cf in SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRe---Type <return> to continue, or q <return> to quit---
quest&) (pShell=0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/workdir/SdiTarget/sfx2/sdi/sfxslots.hxx:1242
#33 0x00002aaaae9ff878 in SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (this=0x13a4330, pFunc=0x2aaaae8f58ac <SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&)>, rReq=...)
    at /home/sean/git/libreoffice/include/sfx2/shell.hxx:208
#34 0x00002aaaae9f6e00 in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x195b940, rShell=..., rSlot=..., rReq=..., bRecord=false) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:259
#35 0x00002aaaae9f9d44 in SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (this=0x195b940, rShell=..., rSlot=..., rReq=..., eCallMode=(SfxCallMode::SYNCHRON | SfxCallMode::API))
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:849
#36 0x00002aaaae9faa69 in SfxDispatcher::Execute(unsigned short, SfxCallMode, SfxPoolItem const*, ...) (this=0x195b940, nSlot=5501, eCall=(SfxCallMode::SYNCHRON | SfxCallMode::API), pArg1=0x7fffffff3570)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:1067
#37 0x00002aaad56d85f7 in SwDocShell::Execute(SfxRequest&) (this=0x18b6d50, rReq=...) at /home/sean/git/libreoffice/sw/source/uibase/app/docsh2.cxx:1143
#38 0x00002aaad56cc0a3 in SfxStubSwDocShellExecute(SfxShell*, SfxRequest&) (pShell=0x18b6d50, rReq=...)
    at /home/sean/git/libreoffice/workdir/SdiTarget/sw/sdi/swslots.hxx:1347
#39 0x00002aaaae9ff878 in SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (this=0x18b6d50, pFunc=0x2aaad56cc080 <SfxStubSwDocShellExecute(SfxShell*, SfxRequest&)>, rReq=...)
    at /home/sean/git/libreoffice/include/sfx2/shell.hxx:208
#40 0x00002aaaae9f6e00 in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x195b940, rShell=..., rSlot=..., rReq=..., bRecord=true) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:259
#41 0x00002aaaae9f9d44 in SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (this=0x195b940, rShell=..., rSlot=..., rReq=..., eCallMode=SfxCallMode::RECORD)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:849
#42 0x00002aaaae9e2c37 in SfxBindings::Execute_Impl(SfxRequest&, SfxSlot const*, SfxShell*) (this=0x194cf30, aReq=..., pSlot=0x2aaad663ee60 <aSwDocShellSlots_Impl+1920>, pShell=0x18b6d50)
    at /home/sean/git/libreoffice/sfx2/source/control/bindings.cxx:1280
#43 0x00002aaaaea6eac7 in SfxDispatchController_Impl::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResu---Type <return> to continue, or q <return> to quit---
ltListener> const&) (this=0x1f12630, aURL=..., aArgs=..., rListener=...)
    at /home/sean/git/libreoffice/sfx2/source/control/unoctitm.cxx:844
#44 0x00002aaaaea6c937 in SfxOfficeDispatch::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x1f12790, aURL=..., aArgs=...)
    at /home/sean/git/libreoffice/sfx2/source/control/unoctitm.cxx:359
#45 0x00002aaaafef5ceb in svt::ToolboxController::execute(short) (this=0x1b11920, KeyModifier=0)
    at /home/sean/git/libreoffice/svtools/source/uno/toolboxcontroller.cxx:362
#46 0x00002aaaaed827d3 in SfxToolBoxControl::Select(unsigned short) (this=0x1b11920, nSelectModifier=0)
    at /home/sean/git/libreoffice/sfx2/source/toolbox/tbxitem.cxx:727
#47 0x00002aaaaed81d38 in SfxToolBoxControl::execute(short) (this=0x1b11920, KeyModifier=0) at /home/sean/git/libreoffice/sfx2/source/toolbox/tbxitem.cxx:587
#48 0x00002aaad125690e in framework::ToolBarManager::Select(ToolBox*) (this=0x1a9cc50)
    at /home/sean/git/libreoffice/framework/source/uielement/toolbarmanager.cxx:2046
#49 0x00002aaad12567b7 in framework::ToolBarManager::LinkStubSelect(void*, ToolBox*) (instance=0x1a9cc50, data=0x1a9bcc0)
    at /home/sean/git/libreoffice/framework/source/uielement/toolbarmanager.cxx:2032
#50 0x00002aaab1b85df5 in Link<ToolBox*, void>::Call(ToolBox*) const (this=0x1a9c1f8, data=0x1a9bcc0) at /home/sean/git/libreoffice/include/tools/link.hxx:127
#51 0x00002aaab1b7e42e in ToolBox::Select() (this=0x1a9bcc0)
    at /home/sean/git/libreoffice/vcl/source/window/toolbox2.cxx:444
#52 0x00002aaab1b9a87c in ToolBox::ImplHandleMouseButtonUp(MouseEvent const&, bool) (this=0x1a9bcc0, rMEvt=..., bCancel=false)
    at /home/sean/git/libreoffice/vcl/source/window/toolbox.cxx:3537
#53 0x00002aaab1b9c669 in ToolBox::Tracking(TrackingEvent const&) (this=0x1a9bcc0, rTEvt=...) at /home/sean/git/libreoffice/vcl/source/window/toolbox.cxx:4044
#54 0x00002aaab1badd99 in vcl::Window::EndTracking(TrackingEventFlags) (this=0x1a9bcc0, nFlags=TrackingEventFlags::NONE)
    at /home/sean/git/libreoffice/vcl/source/window/window2.cxx:368
#55 0x00002aaab1bdb1c8 in ImplHandleMouseEvent(vcl::Window*, MouseNotifyEvent, bool, long, long, unsigned long, unsigned short, MouseEventModifiers) (pWindow=0x12e1ce0, nSVEvent=MouseNotifyEvent::MOUSEBUTTONUP, bMouseLeave=false, nX=69, nY=42, nMsgTime=3622313, nCode=1, nMode=(MouseEventModifiers::SIMPLECLICK | MouseEventModifiers::SELECT))
    at /home/sean/git/libreoffice/vcl/source/window/winproc.cxx:730
---Type <return> to continue, or q <return> to quit---
#56 0x00002aaab1be22b7 in ImplHandleSalMouseButtonUp(vcl::Window*, SalMouseEvent*) (pWindow=0x12e1ce0, pEvent=0x7fffffff4650)
    at /home/sean/git/libreoffice/vcl/source/window/winproc.cxx:2090
#57 0x00002aaab1be09a1 in ImplWindowFrameProc(vcl::Window*, SalFrame*, unsigned short, void const*) (_pWindow=0x12e1ce0, nEvent=4, pEvent=0x7fffffff4650)
    at /home/sean/git/libreoffice/vcl/source/window/winproc.cxx:2425
#58 0x00002aaac89ff6c9 in SalFrame::CallCallback(unsigned short, void const*) const (this=0x12e22a0, nEvent=4, pEvent=0x7fffffff4650)
    at /home/sean/git/libreoffice/vcl/inc/salframe.hxx:247
#59 0x00002aaac89fb029 in GtkSalFrame::signalButton(_GtkWidget*, _GdkEventButton*, void*) (pEvent=0x2147290, frame=0x12e22a0)
    at /home/sean/git/libreoffice/vcl/unx/gtk3/window/../../gtk/window/gtksalframe.cxx:3471
#60 0x00002aaac8e8202d in _gtk_marshal_BOOLEAN__BOXED ()
    at /lib64/libgtk-3.so.0
#61 0x00002aaab89c4cd5 in g_closure_invoke () at /lib64/libgobject-2.0.so.0
#62 0x00002aaab89d6539 in signal_emit_unlocked_R ()
    at /lib64/libgobject-2.0.so.0
#63 0x00002aaab89deae2 in g_signal_emit_valist () at /lib64/libgobject-2.0.so.0
#64 0x00002aaab89df29f in g_signal_emit () at /lib64/libgobject-2.0.so.0
#65 0x00002aaac8fbb6a4 in gtk_widget_event_internal () at /lib64/libgtk-3.so.0
#66 0x00002aaac8e7f61e in propagate_event () at /lib64/libgtk-3.so.0
#67 0x00002aaac8e8127e in gtk_main_do_event () at /lib64/libgtk-3.so.0
#68 0x00002aaac95bb772 in gdk_event_source_dispatch () at /lib64/libgdk-3.so.0
#69 0x00002aaab8c50a8a in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#70 0x00002aaab8c50e20 in g_main_context_iterate.isra ()
    at /lib64/libglib-2.0.so.0
#71 0x00002aaab8c50ecc in g_main_context_iteration ()
    at /lib64/libglib-2.0.so.0
#72 0x00002aaac8999803 in GtkData::Yield(bool, bool) (this=
    0x64fa30, bWait=true, bHandleAllCurrentEvents=false)
    at /home/sean/git/libreoffice/vcl/unx/gtk3/app/../../gtk/app/gtkdata.cxx:604
#73 0x00002aaac899c9a1 in GtkInstance::DoYield(bool, bool, unsigned long) (this=0x64f8f0, bWait=true, bHandleAllCurrentEvents=false, nReleased=0)
    at /home/sean/git/libreoffice/vcl/unx/gtk3/app/../../gtk/app/gtkinst.cxx:406
#74 0x00002aaab203ad2d in ImplYield(bool, bool, unsigned long) (i_bWait=true, i_bAllEvents=false, nReleased=0)
    at /home/sean/git/libreoffice/vcl/source/app/svapp.cxx:362
---Type <return> to continue, or q <return> to quit---
#75 0x00002aaab20370e2 in Application::Yield() ()
    at /home/sean/git/libreoffice/vcl/source/app/svapp.cxx:391
#76 0x00002aaab2037094 in Application::Execute() ()
    at /home/sean/git/libreoffice/vcl/source/app/svapp.cxx:337
#77 0x00002aaaaaf9d4ed in desktop::Desktop::Main() (this=0x7fffffff5370)
    at /home/sean/git/libreoffice/desktop/source/app/app.cxx:1590
#78 0x00002aaab20400ca in ImplSVMain() ()
    at /home/sean/git/libreoffice/vcl/source/app/svmain.cxx:169
#79 0x00002aaab204020c in SVMain() ()
    at /home/sean/git/libreoffice/vcl/source/app/svmain.cxx:206
#80 0x00002aaaaafe8e9c in soffice_main() ()
    at /home/sean/git/libreoffice/desktop/source/app/sofficemain.cxx:96
#81 0x000000000040095e in sal_main ()
    at /home/sean/git/libreoffice/desktop/source/app/main.c:48
#82 0x0000000000400944 in main (argc=4, argv=0x7fffffff5698)
    at /home/sean/git/libreoffice/desktop/source/app/main.c:47

Comment 1 raal 2015-09-10 12:52:13 UTC

LO  5.0.1.2
ID sestavení: 81898c9f5c0d43f3473ba111d7b351050be20261, win7
Error message when openning:
General Error.
General input/output error.
but not crash. The same message without crash in LO Version 4.0.0.3 (Build ID: 7545bee9c2a0782548772a21bc84a9dcc583b89)

I can open file in word2010, setting to new.

Comment 2 Miklos Vajna 2015-10-08 12:01:17 UTC

The first OLE object is kind of broken, and instead of just ignoring it, we crash.

Comment 3 Sean Young 2015-10-08 12:10:46 UTC

Nothing wrong with ole object. I created this file while writing Microsoft Write conversion. I've attached the original .wri file which opens fine in LibreOffice master; the rtf is simply the write -> rtf by Microsoft's own converter.

Comment 4 Sean Young 2015-10-08 12:12:07 UTC

Created attachment 119417 [details]
Original Microsoft Write file

Comment 5 Commit Notification 2015-10-08 12:30:53 UTC

Miklos Vajna committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=0d79e4c07a7a7328cc0bed1d7998317b634543d8

tdf#94049 RTF import: add missing check for empty shape when popping state

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Comment 6 Commit Notification 2015-10-15 16:25:28 UTC

Miklos Vajna committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4bfde7402dee4f3639bd23c1dc987ceafea87cfc&h=libreoffice-5-0

tdf#94049 RTF import: add missing check for empty shape when popping state

It will be available in 5.0.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Comment 7 vihsa 2017-02-28 14:06:48 UTC

verified.  Version: 5.4.0.0.alpha0+
Build ID: febc116

rtf file with ole object opens properly.

Comment 8 Commit Notification 2024-09-19 20:33:41 UTC

Caolán McNamara committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/core/commit/cb08fb797c58a4d21e7ae3a700b0e9ed30524a90

null-deref seen on rtf2pdf with tdf94049-1.rtf

It will be available in 25.2.0.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.

Comment 9 Commit Notification 2024-09-20 08:34:06 UTC

Caolán McNamara committed a patch related to this issue.
It has been pushed to "libreoffice-24-8":

https://git.libreoffice.org/core/commit/76bc1304ffc937d8a38471119694b1d9d64d7070

null-deref seen on rtf2pdf with tdf94049-1.rtf

It will be available in 24.8.2.

The patch should be included in the daily builds available at
https://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
https://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.