Bug Hunting Session
Bug 94049 - RTF IMPORT: rtf file with OLE object crashes libreoffice every time
Summary: RTF IMPORT: rtf file with OLE object crashes libreoffice every time
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: filters and storage (show other bugs)
Version:
(earliest affected)
5.1.0.0.alpha0+ Master
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Miklos Vajna
URL:
Whiteboard: target:5.1.0 target:5.0.4
Keywords:
Depends on:
Blocks:
 
Reported: 2015-09-09 09:07 UTC by Sean Young
Modified: 2017-03-04 00:16 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
Open this file an libreoffice always crashes (80.56 KB, application/rtf)
2015-09-09 09:07 UTC, Sean Young
Details
Original Microsoft Write file (39.62 KB, application/octet-stream)
2015-10-08 12:12 UTC, Sean Young
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Sean Young 2015-09-09 09:07:09 UTC
Created attachment 118545 [details]
Open this file an libreoffice always crashes

Stack trace:

(gdb) bt
#0  0x00002aaaab2f49c8 in raise () at /lib64/libc.so.6
#1  0x00002aaaab2f665a in abort () at /lib64/libc.so.6
#2  0x00002aaaabd5e5a5 in __gnu_debug::_Error_formatter::_M_error() const ()
    at /lib64/libstdc++.so.6
#3  0x00002aaae5261dad in std::stack<writerfilter::dmapper::TextAppendContext, std::__debug::deque<writerfilter::dmapper::TextAppendContext, std::allocator<writerfilter::dmapper::TextAppendContext> > >::pop() (this=0x23237d0)
    at /usr/include/c++/5.1.1/bits/stl_stack.h:217
#4  0x00002aaae5238a77 in writerfilter::dmapper::DomainMapper_Impl::appendOLE(rtl::OUString const&, std::shared_ptr<writerfilter::dmapper::OLEHandler>) (this=0x2323780, rStreamName=..., pOLEHandler=
    std::shared_ptr (count 2, weak 0) 0x2285c80)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper_Impl.cxx:1374
#5  0x00002aaae51ef39d in writerfilter::dmapper::DomainMapper::sprmWithProps(writerfilter::Sprm&, std::shared_ptr<writerfilter::dmapper::PropertyMap>) (this=0x2224780, rSprm=..., rContext=std::shared_ptr (count 3, weak 0) 0x2287d30)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper.cxx:2278
#6  0x00002aaae51e7f84 in writerfilter::dmapper::DomainMapper::lcl_sprm(writerfilter::Sprm&) (this=0x2224780, rSprm=...)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper.cxx:1028
#7  0x00002aaae52ab6e5 in writerfilter::LoggedProperties::sprm(writerfilter::Sprm&) (this=0x2224780, rSprm=...)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/LoggedResources.cxx:340
#8  0x00002aaae51acfbf in writerfilter::rtftok::RTFReferenceProperties::resolve(writerfilter::Properties&) (this=0x1f23590, rHandler=...)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtfreferenceproperties.cxx:40
#9  0x00002aaae51f68c0 in writerfilter::dmapper::DomainMapper::lcl_props(std::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) (this=0x2224780, ref=std::shared_ptr (count 3, weak 0) 0x1f23590)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper.cxx:3196
#10 0x00002aaae52aaa33 in writerfilter::LoggedStream::props(std::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) (this=0x22247b8, ref=std::shared_ptr (count 3, weak 0) 0x1f23590)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/LoggedResources.cx---Type <return> to continue, or q <return> to quit---
x:255
#11 0x00002aaae515bcc5 in writerfilter::rtftok::RTFDocumentImpl::popState() (this=0x2107790)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtfdocumentimpl.cxx:5414
#12 0x00002aaae51c6ccd in writerfilter::rtftok::RTFTokenizer::resolveParse() (this=0x21f73e0)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtftokenizer.cxx:107
#13 0x00002aaae5141ae6 in writerfilter::rtftok::RTFDocumentImpl::resolve(writerfilter::Stream&) (this=0x2107790, rMapper=...)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtfdocumentimpl.cxx:710
#14 0x00002aaae5325886 in RtfFilter::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x22b2bd0, aDescriptor=...)
    at /home/sean/git/libreoffice/writerfilter/source/filter/RtfFilter.cxx:152

#15 0x00002aaaaec5999d in SfxObjectShell::ImportFrom(SfxMedium&, com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) (this=0x2223a50, 
    rMedium=..., xInsertPosition=...)
    at /home/sean/git/libreoffice/sfx2/source/doc/objstor.cxx:2279
#16 0x00002aaaaec51a2e in SfxObjectShell::DoLoad(SfxMedium*) (this=0x2223a50, pMed=0x1f4e2a0) at /home/sean/git/libreoffice/sfx2/source/doc/objstor.cxx:775
#17 0x00002aaaaec985e3 in SfxBaseModel::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x209baf0, seqArguments=...)
    at /home/sean/git/libreoffice/sfx2/source/doc/sfxbasemodel.cxx:1860
#18 0x00002aaaaed9144c in (anonymous namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (this=0x20dc2d0, rArgs=..., _rTargetFrame=...)
    at /home/sean/git/libreoffice/sfx2/source/view/frmload.cxx:703
#19 0x00002aaad11173cc in framework::LoadEnv::impl_loadContent() (this=0x235bad0) at /home/sean/git/libreoffice/framework/source/loadenv/loadenv.cxx:1128
#20 0x00002aaad11136c9 in framework::LoadEnv::startLoading() (this=0x235bad0)
    at /home/sean/git/libreoffice/framework/source/loadenv/loadenv.cxx:388
#21 0x00002aaad1094bb8 in framework::LoadDispatcher::impl_dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) (this=0x235ba70, rURL=..., lArguments=..., xListener=...)
    at /home/sean/git/libreoffice/framework/source/dispatch/loaddispatcher.cxx:115
---Type <return> to continue, or q <return> to quit---
#22 0x00002aaad1094879 in framework::LoadDispatcher::dispatchWithReturnValue(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x235ba70, rURL=..., lArguments=...)
    at /home/sean/git/libreoffice/framework/source/dispatch/loaddispatcher.cxx:62
#23 0x00002aaaad0b6f18 in comphelper::SynchronousDispatch::dispatch(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (xStartPoint=..., sURL=..., sTarget=..., nFlags=0, lArguments=...)
    at /home/sean/git/libreoffice/comphelper/source/misc/synchronousdispatch.cxx:64
#24 0x00002aaaae8ff9c7 in SfxApplication::OpenDocExec_Impl(SfxRequest&) (this=
    0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/sfx2/source/appl/appopen.cxx:1063
#25 0x00002aaaae8f58cf in SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&) (pShell=0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/workdir/SdiTarget/sfx2/sdi/sfxslots.hxx:1242
#26 0x00002aaaae9ff878 in SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (this=0x13a4330, pFunc=0x2aaaae8f58ac <SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&)>, rReq=...)
    at /home/sean/git/libreoffice/include/sfx2/shell.hxx:208
#27 0x00002aaaae9f6e00 in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x195b940, rShell=..., rSlot=..., rReq=..., bRecord=false) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:259
#28 0x00002aaaae9f9d44 in SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (this=0x195b940, rShell=..., rSlot=..., rReq=..., eCallMode=SfxCallMode::SYNCHRON)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:849
#29 0x00002aaaae9fa79d in SfxDispatcher::Execute(unsigned short, SfxCallMode, unsigned short, SfxItemSet const&) (this=0x195b940, nSlot=5501, eCall=SfxCallMode::SYNCHRON, nModi=0, rArgs=...)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:1012
#30 0x00002aaaae9fa5d4 in SfxDispatcher::Execute(unsigned short, SfxCallMode, SfxItemSet const&) (this=0x195b940, nSlot=5501, eCall=SfxCallMode::SYNCHRON, rArgs=...) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:990
#31 0x00002aaaae8fde5a in SfxApplication::OpenDocExec_Impl(SfxRequest&) (this=0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/sfx2/source/appl/appopen.cxx:707
#32 0x00002aaaae8f58cf in SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRe---Type <return> to continue, or q <return> to quit---
quest&) (pShell=0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/workdir/SdiTarget/sfx2/sdi/sfxslots.hxx:1242
#33 0x00002aaaae9ff878 in SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (this=0x13a4330, pFunc=0x2aaaae8f58ac <SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&)>, rReq=...)
    at /home/sean/git/libreoffice/include/sfx2/shell.hxx:208
#34 0x00002aaaae9f6e00 in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x195b940, rShell=..., rSlot=..., rReq=..., bRecord=false) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:259
#35 0x00002aaaae9f9d44 in SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (this=0x195b940, rShell=..., rSlot=..., rReq=..., eCallMode=(SfxCallMode::SYNCHRON | SfxCallMode::API))
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:849
#36 0x00002aaaae9faa69 in SfxDispatcher::Execute(unsigned short, SfxCallMode, SfxPoolItem const*, ...) (this=0x195b940, nSlot=5501, eCall=(SfxCallMode::SYNCHRON | SfxCallMode::API), pArg1=0x7fffffff3570)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:1067
#37 0x00002aaad56d85f7 in SwDocShell::Execute(SfxRequest&) (this=0x18b6d50, rReq=...) at /home/sean/git/libreoffice/sw/source/uibase/app/docsh2.cxx:1143
#38 0x00002aaad56cc0a3 in SfxStubSwDocShellExecute(SfxShell*, SfxRequest&) (pShell=0x18b6d50, rReq=...)
    at /home/sean/git/libreoffice/workdir/SdiTarget/sw/sdi/swslots.hxx:1347
#39 0x00002aaaae9ff878 in SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (this=0x18b6d50, pFunc=0x2aaad56cc080 <SfxStubSwDocShellExecute(SfxShell*, SfxRequest&)>, rReq=...)
    at /home/sean/git/libreoffice/include/sfx2/shell.hxx:208
#40 0x00002aaaae9f6e00 in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x195b940, rShell=..., rSlot=..., rReq=..., bRecord=true) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:259
#41 0x00002aaaae9f9d44 in SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (this=0x195b940, rShell=..., rSlot=..., rReq=..., eCallMode=SfxCallMode::RECORD)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:849
#42 0x00002aaaae9e2c37 in SfxBindings::Execute_Impl(SfxRequest&, SfxSlot const*, SfxShell*) (this=0x194cf30, aReq=..., pSlot=0x2aaad663ee60 <aSwDocShellSlots_Impl+1920>, pShell=0x18b6d50)
    at /home/sean/git/libreoffice/sfx2/source/control/bindings.cxx:1280
#43 0x00002aaaaea6eac7 in SfxDispatchController_Impl::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResu---Type <return> to continue, or q <return> to quit---
ltListener> const&) (this=0x1f12630, aURL=..., aArgs=..., rListener=...)
    at /home/sean/git/libreoffice/sfx2/source/control/unoctitm.cxx:844
#44 0x00002aaaaea6c937 in SfxOfficeDispatch::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x1f12790, aURL=..., aArgs=...)
    at /home/sean/git/libreoffice/sfx2/source/control/unoctitm.cxx:359
#45 0x00002aaaafef5ceb in svt::ToolboxController::execute(short) (this=0x1b11920, KeyModifier=0)
    at /home/sean/git/libreoffice/svtools/source/uno/toolboxcontroller.cxx:362
#46 0x00002aaaaed827d3 in SfxToolBoxControl::Select(unsigned short) (this=0x1b11920, nSelectModifier=0)
    at /home/sean/git/libreoffice/sfx2/source/toolbox/tbxitem.cxx:727
#47 0x00002aaaaed81d38 in SfxToolBoxControl::execute(short) (this=0x1b11920, KeyModifier=0) at /home/sean/git/libreoffice/sfx2/source/toolbox/tbxitem.cxx:587
#48 0x00002aaad125690e in framework::ToolBarManager::Select(ToolBox*) (this=0x1a9cc50)
    at /home/sean/git/libreoffice/framework/source/uielement/toolbarmanager.cxx:2046
#49 0x00002aaad12567b7 in framework::ToolBarManager::LinkStubSelect(void*, ToolBox*) (instance=0x1a9cc50, data=0x1a9bcc0)
    at /home/sean/git/libreoffice/framework/source/uielement/toolbarmanager.cxx:2032
#50 0x00002aaab1b85df5 in Link<ToolBox*, void>::Call(ToolBox*) const (this=0x1a9c1f8, data=0x1a9bcc0) at /home/sean/git/libreoffice/include/tools/link.hxx:127
#51 0x00002aaab1b7e42e in ToolBox::Select() (this=0x1a9bcc0)
    at /home/sean/git/libreoffice/vcl/source/window/toolbox2.cxx:444
#52 0x00002aaab1b9a87c in ToolBox::ImplHandleMouseButtonUp(MouseEvent const&, bool) (this=0x1a9bcc0, rMEvt=..., bCancel=false)
    at /home/sean/git/libreoffice/vcl/source/window/toolbox.cxx:3537
#53 0x00002aaab1b9c669 in ToolBox::Tracking(TrackingEvent const&) (this=0x1a9bcc0, rTEvt=...) at /home/sean/git/libreoffice/vcl/source/window/toolbox.cxx:4044
#54 0x00002aaab1badd99 in vcl::Window::EndTracking(TrackingEventFlags) (this=0x1a9bcc0, nFlags=TrackingEventFlags::NONE)
    at /home/sean/git/libreoffice/vcl/source/window/window2.cxx:368
#55 0x00002aaab1bdb1c8 in ImplHandleMouseEvent(vcl::Window*, MouseNotifyEvent, bool, long, long, unsigned long, unsigned short, MouseEventModifiers) (pWindow=0x12e1ce0, nSVEvent=MouseNotifyEvent::MOUSEBUTTONUP, bMouseLeave=false, nX=69, nY=42, nMsgTime=3622313, nCode=1, nMode=(MouseEventModifiers::SIMPLECLICK | MouseEventModifiers::SELECT))
    at /home/sean/git/libreoffice/vcl/source/window/winproc.cxx:730
---Type <return> to continue, or q <return> to quit---
#56 0x00002aaab1be22b7 in ImplHandleSalMouseButtonUp(vcl::Window*, SalMouseEvent*) (pWindow=0x12e1ce0, pEvent=0x7fffffff4650)
    at /home/sean/git/libreoffice/vcl/source/window/winproc.cxx:2090
#57 0x00002aaab1be09a1 in ImplWindowFrameProc(vcl::Window*, SalFrame*, unsigned short, void const*) (_pWindow=0x12e1ce0, nEvent=4, pEvent=0x7fffffff4650)
    at /home/sean/git/libreoffice/vcl/source/window/winproc.cxx:2425
#58 0x00002aaac89ff6c9 in SalFrame::CallCallback(unsigned short, void const*) const (this=0x12e22a0, nEvent=4, pEvent=0x7fffffff4650)
    at /home/sean/git/libreoffice/vcl/inc/salframe.hxx:247
#59 0x00002aaac89fb029 in GtkSalFrame::signalButton(_GtkWidget*, _GdkEventButton*, void*) (pEvent=0x2147290, frame=0x12e22a0)
    at /home/sean/git/libreoffice/vcl/unx/gtk3/window/../../gtk/window/gtksalframe.cxx:3471
#60 0x00002aaac8e8202d in _gtk_marshal_BOOLEAN__BOXED ()
    at /lib64/libgtk-3.so.0
#61 0x00002aaab89c4cd5 in g_closure_invoke () at /lib64/libgobject-2.0.so.0
#62 0x00002aaab89d6539 in signal_emit_unlocked_R ()
    at /lib64/libgobject-2.0.so.0
#63 0x00002aaab89deae2 in g_signal_emit_valist () at /lib64/libgobject-2.0.so.0
#64 0x00002aaab89df29f in g_signal_emit () at /lib64/libgobject-2.0.so.0
#65 0x00002aaac8fbb6a4 in gtk_widget_event_internal () at /lib64/libgtk-3.so.0
#66 0x00002aaac8e7f61e in propagate_event () at /lib64/libgtk-3.so.0
#67 0x00002aaac8e8127e in gtk_main_do_event () at /lib64/libgtk-3.so.0
#68 0x00002aaac95bb772 in gdk_event_source_dispatch () at /lib64/libgdk-3.so.0
#69 0x00002aaab8c50a8a in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#70 0x00002aaab8c50e20 in g_main_context_iterate.isra ()
    at /lib64/libglib-2.0.so.0
#71 0x00002aaab8c50ecc in g_main_context_iteration ()
    at /lib64/libglib-2.0.so.0
#72 0x00002aaac8999803 in GtkData::Yield(bool, bool) (this=
    0x64fa30, bWait=true, bHandleAllCurrentEvents=false)
    at /home/sean/git/libreoffice/vcl/unx/gtk3/app/../../gtk/app/gtkdata.cxx:604
#73 0x00002aaac899c9a1 in GtkInstance::DoYield(bool, bool, unsigned long) (this=0x64f8f0, bWait=true, bHandleAllCurrentEvents=false, nReleased=0)
    at /home/sean/git/libreoffice/vcl/unx/gtk3/app/../../gtk/app/gtkinst.cxx:406
#74 0x00002aaab203ad2d in ImplYield(bool, bool, unsigned long) (i_bWait=true, i_bAllEvents=false, nReleased=0)
    at /home/sean/git/libreoffice/vcl/source/app/svapp.cxx:362
---Type <return> to continue, or q <return> to quit---
#75 0x00002aaab20370e2 in Application::Yield() ()
    at /home/sean/git/libreoffice/vcl/source/app/svapp.cxx:391
#76 0x00002aaab2037094 in Application::Execute() ()
    at /home/sean/git/libreoffice/vcl/source/app/svapp.cxx:337
#77 0x00002aaaaaf9d4ed in desktop::Desktop::Main() (this=0x7fffffff5370)
    at /home/sean/git/libreoffice/desktop/source/app/app.cxx:1590
#78 0x00002aaab20400ca in ImplSVMain() ()
    at /home/sean/git/libreoffice/vcl/source/app/svmain.cxx:169
#79 0x00002aaab204020c in SVMain() ()
    at /home/sean/git/libreoffice/vcl/source/app/svmain.cxx:206
#80 0x00002aaaaafe8e9c in soffice_main() ()
    at /home/sean/git/libreoffice/desktop/source/app/sofficemain.cxx:96
#81 0x000000000040095e in sal_main ()
    at /home/sean/git/libreoffice/desktop/source/app/main.c:48
#82 0x0000000000400944 in main (argc=4, argv=0x7fffffff5698)
    at /home/sean/git/libreoffice/desktop/source/app/main.c:47
(gdb) bt
#0  0x00002aaaab2f49c8 in raise () at /lib64/libc.so.6
#1  0x00002aaaab2f665a in abort () at /lib64/libc.so.6
#2  0x00002aaaabd5e5a5 in __gnu_debug::_Error_formatter::_M_error() const ()
    at /lib64/libstdc++.so.6
#3  0x00002aaae5261dad in std::stack<writerfilter::dmapper::TextAppendContext, std::__debug::deque<writerfilter::dmapper::TextAppendContext, std::allocator<writerfilter::dmapper::TextAppendContext> > >::pop() (this=0x23237d0)
    at /usr/include/c++/5.1.1/bits/stl_stack.h:217
#4  0x00002aaae5238a77 in writerfilter::dmapper::DomainMapper_Impl::appendOLE(rtl::OUString const&, std::shared_ptr<writerfilter::dmapper::OLEHandler>) (this=0x2323780, rStreamName=..., pOLEHandler=
    std::shared_ptr (count 2, weak 0) 0x2285c80)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper_Impl.cxx:1374
#5  0x00002aaae51ef39d in writerfilter::dmapper::DomainMapper::sprmWithProps(writerfilter::Sprm&, std::shared_ptr<writerfilter::dmapper::PropertyMap>) (this=0x2224780, rSprm=..., rContext=std::shared_ptr (count 3, weak 0) 0x2287d30)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper.cxx:2278
#6  0x00002aaae51e7f84 in writerfilter::dmapper::DomainMapper::lcl_sprm(writerfilter::Sprm&) (this=0x2224780, rSprm=...)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper.cxx:1028
#7  0x00002aaae52ab6e5 in writerfilter::LoggedProperties::sprm(writerfilter::Sprm&) (this=0x2224780, rSprm=...)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/LoggedResources.cxx:340
#8  0x00002aaae51acfbf in writerfilter::rtftok::RTFReferenceProperties::resolve(writerfilter::Properties&) (this=0x1f23590, rHandler=...)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtfreferenceproperties.cxx:40
#9  0x00002aaae51f68c0 in writerfilter::dmapper::DomainMapper::lcl_props(std::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) (this=0x2224780, ref=std::shared_ptr (count 3, weak 0) 0x1f23590)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/DomainMapper.cxx:3196
#10 0x00002aaae52aaa33 in writerfilter::LoggedStream::props(std::shared_ptr<writerfilter::Reference<writerfilter::Properties> >) (this=0x22247b8, ref=std::shared_ptr (count 3, weak 0) 0x1f23590)
    at /home/sean/git/libreoffice/writerfilter/source/dmapper/LoggedResources.cx---Type <return> to continue, or q <return> to quit---
x:255
#11 0x00002aaae515bcc5 in writerfilter::rtftok::RTFDocumentImpl::popState() (this=0x2107790)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtfdocumentimpl.cxx:5414
#12 0x00002aaae51c6ccd in writerfilter::rtftok::RTFTokenizer::resolveParse() (this=0x21f73e0)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtftokenizer.cxx:107
#13 0x00002aaae5141ae6 in writerfilter::rtftok::RTFDocumentImpl::resolve(writerfilter::Stream&) (this=0x2107790, rMapper=...)
    at /home/sean/git/libreoffice/writerfilter/source/rtftok/rtfdocumentimpl.cxx:710
#14 0x00002aaae5325886 in RtfFilter::filter(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x22b2bd0, aDescriptor=...)
    at /home/sean/git/libreoffice/writerfilter/source/filter/RtfFilter.cxx:152

#15 0x00002aaaaec5999d in SfxObjectShell::ImportFrom(SfxMedium&, com::sun::star::uno::Reference<com::sun::star::text::XTextRange> const&) (this=0x2223a50, 
    rMedium=..., xInsertPosition=...)
    at /home/sean/git/libreoffice/sfx2/source/doc/objstor.cxx:2279
#16 0x00002aaaaec51a2e in SfxObjectShell::DoLoad(SfxMedium*) (this=0x2223a50, pMed=0x1f4e2a0) at /home/sean/git/libreoffice/sfx2/source/doc/objstor.cxx:775
#17 0x00002aaaaec985e3 in SfxBaseModel::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x209baf0, seqArguments=...)
    at /home/sean/git/libreoffice/sfx2/source/doc/sfxbasemodel.cxx:1860
#18 0x00002aaaaed9144c in (anonymous namespace)::SfxFrameLoader_Impl::load(com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XFrame> const&) (this=0x20dc2d0, rArgs=..., _rTargetFrame=...)
    at /home/sean/git/libreoffice/sfx2/source/view/frmload.cxx:703
#19 0x00002aaad11173cc in framework::LoadEnv::impl_loadContent() (this=0x235bad0) at /home/sean/git/libreoffice/framework/source/loadenv/loadenv.cxx:1128
#20 0x00002aaad11136c9 in framework::LoadEnv::startLoading() (this=0x235bad0)
    at /home/sean/git/libreoffice/framework/source/loadenv/loadenv.cxx:388
#21 0x00002aaad1094bb8 in framework::LoadDispatcher::impl_dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResultListener> const&) (this=0x235ba70, rURL=..., lArguments=..., xListener=...)
    at /home/sean/git/libreoffice/framework/source/dispatch/loaddispatcher.cxx:115
---Type <return> to continue, or q <return> to quit---
#22 0x00002aaad1094879 in framework::LoadDispatcher::dispatchWithReturnValue(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x235ba70, rURL=..., lArguments=...)
    at /home/sean/git/libreoffice/framework/source/dispatch/loaddispatcher.cxx:62
#23 0x00002aaaad0b6f18 in comphelper::SynchronousDispatch::dispatch(com::sun::star::uno::Reference<com::sun::star::uno::XInterface> const&, rtl::OUString const&, rtl::OUString const&, int, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (xStartPoint=..., sURL=..., sTarget=..., nFlags=0, lArguments=...)
    at /home/sean/git/libreoffice/comphelper/source/misc/synchronousdispatch.cxx:64
#24 0x00002aaaae8ff9c7 in SfxApplication::OpenDocExec_Impl(SfxRequest&) (this=
    0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/sfx2/source/appl/appopen.cxx:1063
#25 0x00002aaaae8f58cf in SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&) (pShell=0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/workdir/SdiTarget/sfx2/sdi/sfxslots.hxx:1242
#26 0x00002aaaae9ff878 in SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (this=0x13a4330, pFunc=0x2aaaae8f58ac <SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&)>, rReq=...)
    at /home/sean/git/libreoffice/include/sfx2/shell.hxx:208
#27 0x00002aaaae9f6e00 in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x195b940, rShell=..., rSlot=..., rReq=..., bRecord=false) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:259
#28 0x00002aaaae9f9d44 in SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (this=0x195b940, rShell=..., rSlot=..., rReq=..., eCallMode=SfxCallMode::SYNCHRON)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:849
#29 0x00002aaaae9fa79d in SfxDispatcher::Execute(unsigned short, SfxCallMode, unsigned short, SfxItemSet const&) (this=0x195b940, nSlot=5501, eCall=SfxCallMode::SYNCHRON, nModi=0, rArgs=...)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:1012
#30 0x00002aaaae9fa5d4 in SfxDispatcher::Execute(unsigned short, SfxCallMode, SfxItemSet const&) (this=0x195b940, nSlot=5501, eCall=SfxCallMode::SYNCHRON, rArgs=...) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:990
#31 0x00002aaaae8fde5a in SfxApplication::OpenDocExec_Impl(SfxRequest&) (this=0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/sfx2/source/appl/appopen.cxx:707
#32 0x00002aaaae8f58cf in SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRe---Type <return> to continue, or q <return> to quit---
quest&) (pShell=0x13a4330, rReq=...)
    at /home/sean/git/libreoffice/workdir/SdiTarget/sfx2/sdi/sfxslots.hxx:1242
#33 0x00002aaaae9ff878 in SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (this=0x13a4330, pFunc=0x2aaaae8f58ac <SfxStubSfxApplicationOpenDocExec_Impl(SfxShell*, SfxRequest&)>, rReq=...)
    at /home/sean/git/libreoffice/include/sfx2/shell.hxx:208
#34 0x00002aaaae9f6e00 in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x195b940, rShell=..., rSlot=..., rReq=..., bRecord=false) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:259
#35 0x00002aaaae9f9d44 in SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (this=0x195b940, rShell=..., rSlot=..., rReq=..., eCallMode=(SfxCallMode::SYNCHRON | SfxCallMode::API))
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:849
#36 0x00002aaaae9faa69 in SfxDispatcher::Execute(unsigned short, SfxCallMode, SfxPoolItem const*, ...) (this=0x195b940, nSlot=5501, eCall=(SfxCallMode::SYNCHRON | SfxCallMode::API), pArg1=0x7fffffff3570)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:1067
#37 0x00002aaad56d85f7 in SwDocShell::Execute(SfxRequest&) (this=0x18b6d50, rReq=...) at /home/sean/git/libreoffice/sw/source/uibase/app/docsh2.cxx:1143
#38 0x00002aaad56cc0a3 in SfxStubSwDocShellExecute(SfxShell*, SfxRequest&) (pShell=0x18b6d50, rReq=...)
    at /home/sean/git/libreoffice/workdir/SdiTarget/sw/sdi/swslots.hxx:1347
#39 0x00002aaaae9ff878 in SfxShell::CallExec(void (*)(SfxShell*, SfxRequest&), SfxRequest&) (this=0x18b6d50, pFunc=0x2aaad56cc080 <SfxStubSwDocShellExecute(SfxShell*, SfxRequest&)>, rReq=...)
    at /home/sean/git/libreoffice/include/sfx2/shell.hxx:208
#40 0x00002aaaae9f6e00 in SfxDispatcher::Call_Impl(SfxShell&, SfxSlot const&, SfxRequest&, bool) (this=0x195b940, rShell=..., rSlot=..., rReq=..., bRecord=true) at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:259
#41 0x00002aaaae9f9d44 in SfxDispatcher::_Execute(SfxShell&, SfxSlot const&, SfxRequest&, SfxCallMode) (this=0x195b940, rShell=..., rSlot=..., rReq=..., eCallMode=SfxCallMode::RECORD)
    at /home/sean/git/libreoffice/sfx2/source/control/dispatch.cxx:849
#42 0x00002aaaae9e2c37 in SfxBindings::Execute_Impl(SfxRequest&, SfxSlot const*, SfxShell*) (this=0x194cf30, aReq=..., pSlot=0x2aaad663ee60 <aSwDocShellSlots_Impl+1920>, pShell=0x18b6d50)
    at /home/sean/git/libreoffice/sfx2/source/control/bindings.cxx:1280
#43 0x00002aaaaea6eac7 in SfxDispatchController_Impl::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&, com::sun::star::uno::Reference<com::sun::star::frame::XDispatchResu---Type <return> to continue, or q <return> to quit---
ltListener> const&) (this=0x1f12630, aURL=..., aArgs=..., rListener=...)
    at /home/sean/git/libreoffice/sfx2/source/control/unoctitm.cxx:844
#44 0x00002aaaaea6c937 in SfxOfficeDispatch::dispatch(com::sun::star::util::URL const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const&) (this=0x1f12790, aURL=..., aArgs=...)
    at /home/sean/git/libreoffice/sfx2/source/control/unoctitm.cxx:359
#45 0x00002aaaafef5ceb in svt::ToolboxController::execute(short) (this=0x1b11920, KeyModifier=0)
    at /home/sean/git/libreoffice/svtools/source/uno/toolboxcontroller.cxx:362
#46 0x00002aaaaed827d3 in SfxToolBoxControl::Select(unsigned short) (this=0x1b11920, nSelectModifier=0)
    at /home/sean/git/libreoffice/sfx2/source/toolbox/tbxitem.cxx:727
#47 0x00002aaaaed81d38 in SfxToolBoxControl::execute(short) (this=0x1b11920, KeyModifier=0) at /home/sean/git/libreoffice/sfx2/source/toolbox/tbxitem.cxx:587
#48 0x00002aaad125690e in framework::ToolBarManager::Select(ToolBox*) (this=0x1a9cc50)
    at /home/sean/git/libreoffice/framework/source/uielement/toolbarmanager.cxx:2046
#49 0x00002aaad12567b7 in framework::ToolBarManager::LinkStubSelect(void*, ToolBox*) (instance=0x1a9cc50, data=0x1a9bcc0)
    at /home/sean/git/libreoffice/framework/source/uielement/toolbarmanager.cxx:2032
#50 0x00002aaab1b85df5 in Link<ToolBox*, void>::Call(ToolBox*) const (this=0x1a9c1f8, data=0x1a9bcc0) at /home/sean/git/libreoffice/include/tools/link.hxx:127
#51 0x00002aaab1b7e42e in ToolBox::Select() (this=0x1a9bcc0)
    at /home/sean/git/libreoffice/vcl/source/window/toolbox2.cxx:444
#52 0x00002aaab1b9a87c in ToolBox::ImplHandleMouseButtonUp(MouseEvent const&, bool) (this=0x1a9bcc0, rMEvt=..., bCancel=false)
    at /home/sean/git/libreoffice/vcl/source/window/toolbox.cxx:3537
#53 0x00002aaab1b9c669 in ToolBox::Tracking(TrackingEvent const&) (this=0x1a9bcc0, rTEvt=...) at /home/sean/git/libreoffice/vcl/source/window/toolbox.cxx:4044
#54 0x00002aaab1badd99 in vcl::Window::EndTracking(TrackingEventFlags) (this=0x1a9bcc0, nFlags=TrackingEventFlags::NONE)
    at /home/sean/git/libreoffice/vcl/source/window/window2.cxx:368
#55 0x00002aaab1bdb1c8 in ImplHandleMouseEvent(vcl::Window*, MouseNotifyEvent, bool, long, long, unsigned long, unsigned short, MouseEventModifiers) (pWindow=0x12e1ce0, nSVEvent=MouseNotifyEvent::MOUSEBUTTONUP, bMouseLeave=false, nX=69, nY=42, nMsgTime=3622313, nCode=1, nMode=(MouseEventModifiers::SIMPLECLICK | MouseEventModifiers::SELECT))
    at /home/sean/git/libreoffice/vcl/source/window/winproc.cxx:730
---Type <return> to continue, or q <return> to quit---
#56 0x00002aaab1be22b7 in ImplHandleSalMouseButtonUp(vcl::Window*, SalMouseEvent*) (pWindow=0x12e1ce0, pEvent=0x7fffffff4650)
    at /home/sean/git/libreoffice/vcl/source/window/winproc.cxx:2090
#57 0x00002aaab1be09a1 in ImplWindowFrameProc(vcl::Window*, SalFrame*, unsigned short, void const*) (_pWindow=0x12e1ce0, nEvent=4, pEvent=0x7fffffff4650)
    at /home/sean/git/libreoffice/vcl/source/window/winproc.cxx:2425
#58 0x00002aaac89ff6c9 in SalFrame::CallCallback(unsigned short, void const*) const (this=0x12e22a0, nEvent=4, pEvent=0x7fffffff4650)
    at /home/sean/git/libreoffice/vcl/inc/salframe.hxx:247
#59 0x00002aaac89fb029 in GtkSalFrame::signalButton(_GtkWidget*, _GdkEventButton*, void*) (pEvent=0x2147290, frame=0x12e22a0)
    at /home/sean/git/libreoffice/vcl/unx/gtk3/window/../../gtk/window/gtksalframe.cxx:3471
#60 0x00002aaac8e8202d in _gtk_marshal_BOOLEAN__BOXED ()
    at /lib64/libgtk-3.so.0
#61 0x00002aaab89c4cd5 in g_closure_invoke () at /lib64/libgobject-2.0.so.0
#62 0x00002aaab89d6539 in signal_emit_unlocked_R ()
    at /lib64/libgobject-2.0.so.0
#63 0x00002aaab89deae2 in g_signal_emit_valist () at /lib64/libgobject-2.0.so.0
#64 0x00002aaab89df29f in g_signal_emit () at /lib64/libgobject-2.0.so.0
#65 0x00002aaac8fbb6a4 in gtk_widget_event_internal () at /lib64/libgtk-3.so.0
#66 0x00002aaac8e7f61e in propagate_event () at /lib64/libgtk-3.so.0
#67 0x00002aaac8e8127e in gtk_main_do_event () at /lib64/libgtk-3.so.0
#68 0x00002aaac95bb772 in gdk_event_source_dispatch () at /lib64/libgdk-3.so.0
#69 0x00002aaab8c50a8a in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#70 0x00002aaab8c50e20 in g_main_context_iterate.isra ()
    at /lib64/libglib-2.0.so.0
#71 0x00002aaab8c50ecc in g_main_context_iteration ()
    at /lib64/libglib-2.0.so.0
#72 0x00002aaac8999803 in GtkData::Yield(bool, bool) (this=
    0x64fa30, bWait=true, bHandleAllCurrentEvents=false)
    at /home/sean/git/libreoffice/vcl/unx/gtk3/app/../../gtk/app/gtkdata.cxx:604
#73 0x00002aaac899c9a1 in GtkInstance::DoYield(bool, bool, unsigned long) (this=0x64f8f0, bWait=true, bHandleAllCurrentEvents=false, nReleased=0)
    at /home/sean/git/libreoffice/vcl/unx/gtk3/app/../../gtk/app/gtkinst.cxx:406
#74 0x00002aaab203ad2d in ImplYield(bool, bool, unsigned long) (i_bWait=true, i_bAllEvents=false, nReleased=0)
    at /home/sean/git/libreoffice/vcl/source/app/svapp.cxx:362
---Type <return> to continue, or q <return> to quit---
#75 0x00002aaab20370e2 in Application::Yield() ()
    at /home/sean/git/libreoffice/vcl/source/app/svapp.cxx:391
#76 0x00002aaab2037094 in Application::Execute() ()
    at /home/sean/git/libreoffice/vcl/source/app/svapp.cxx:337
#77 0x00002aaaaaf9d4ed in desktop::Desktop::Main() (this=0x7fffffff5370)
    at /home/sean/git/libreoffice/desktop/source/app/app.cxx:1590
#78 0x00002aaab20400ca in ImplSVMain() ()
    at /home/sean/git/libreoffice/vcl/source/app/svmain.cxx:169
#79 0x00002aaab204020c in SVMain() ()
    at /home/sean/git/libreoffice/vcl/source/app/svmain.cxx:206
#80 0x00002aaaaafe8e9c in soffice_main() ()
    at /home/sean/git/libreoffice/desktop/source/app/sofficemain.cxx:96
#81 0x000000000040095e in sal_main ()
    at /home/sean/git/libreoffice/desktop/source/app/main.c:48
#82 0x0000000000400944 in main (argc=4, argv=0x7fffffff5698)
    at /home/sean/git/libreoffice/desktop/source/app/main.c:47
Comment 1 raal 2015-09-10 12:52:13 UTC
LO  5.0.1.2
ID sestavení: 81898c9f5c0d43f3473ba111d7b351050be20261, win7
Error message when openning:
General Error.
General input/output error.
but not crash. The same message without crash in LO Version 4.0.0.3 (Build ID: 7545bee9c2a0782548772a21bc84a9dcc583b89)

I can open file in word2010, setting to new.
Comment 2 Miklos Vajna 2015-10-08 12:01:17 UTC
The first OLE object is kind of broken, and instead of just ignoring it, we crash.
Comment 3 Sean Young 2015-10-08 12:10:46 UTC
Nothing wrong with ole object. I created this file while writing Microsoft Write conversion. I've attached the original .wri file which opens fine in LibreOffice master; the rtf is simply the write -> rtf by Microsoft's own converter.
Comment 4 Sean Young 2015-10-08 12:12:07 UTC
Created attachment 119417 [details]
Original Microsoft Write file
Comment 5 Commit Notification 2015-10-08 12:30:53 UTC
Miklos Vajna committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=0d79e4c07a7a7328cc0bed1d7998317b634543d8

tdf#94049 RTF import: add missing check for empty shape when popping state

It will be available in 5.1.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 6 Commit Notification 2015-10-15 16:25:28 UTC
Miklos Vajna committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4bfde7402dee4f3639bd23c1dc987ceafea87cfc&h=libreoffice-5-0

tdf#94049 RTF import: add missing check for empty shape when popping state

It will be available in 5.0.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 7 vihsa 2017-02-28 14:06:48 UTC
verified.  Version: 5.4.0.0.alpha0+
Build ID: febc116

rtf file with ole object opens properly.