Bug 94831 - crashes with an image from a https hyperlink
Summary: crashes with an image from a https hyperlink
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.3.0.0.alpha1
Hardware: All Linux (All)
: highest critical
Assignee: Matúš Kukan
URL:
Whiteboard: target:5.2.0 target:5.1.0.2 target:5...
Keywords: bibisectRequest, haveBacktrace, regression
: 95740 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-10-06 17:46 UTC by Rpnpif
Modified: 2016-10-25 19:11 UTC (History)
6 users (show)

See Also:
Crash report or crash signature:


Attachments
File that crash LO (9.06 KB, application/vnd.oasis.opendocument.text)
2015-10-06 17:46 UTC, Rpnpif
Details
gdbtrace (2.77 KB, application/x-7z-compressed)
2015-10-07 16:36 UTC, raal
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Rpnpif 2015-10-06 17:46:02 UTC
Created attachment 119362 [details]
File that crash LO

A file containing an image from an https link does crashing LO.
The link is
https://encrypted-tbn3.gstatic.com/images?q=tbn:ANd9GcS7_QMxg7C5S4Cs50FWt7Mg0J4vnPePxRLmWZNXAd3hfSXYB9t-QA

More, the image cannot be displayed in LO.

The image is from an old LO or OpenOffice but a copy-paste works fine with this empty frame.

To crash click-right on the empty image frame and try to compress the image. Yes this image does not exists in LO but LO must not crashed.

Regards.
Comment 1 Rpnpif 2015-10-06 17:53:55 UTC
All works fine in Microsoft Windows.
So this issue seems to be specific to Linux (Debian Jessie 8).
Comment 2 Julien Nabet 2015-10-06 19:54:10 UTC
On pc Debian testing (updated today) x86-64 with LO Debian package 5.0.2.2, I don't reproduce the crash and can see the image (DC Volts...)

With master sources updated today, I don't have crash but can't see the image.
I noticed these kind of logs:
(pkix_CacheCert_Add: PKIX_PL_HashTable_Add for Certs skipped: entry existed
warn:ucb.ucp.webdav:12592:9:ucb/source/ucp/webdav-neon/NeonSession.cxx:1660: Neon received http error: 'Server certificate verification failed: issuer is not trusted'
warn:legacy.osl:12592:1:sw/source/core/graphic/ndgrf.cxx:594: Cannot swap in graphic
warn:legacy.osl:12592:1:sw/source/core/graphic/ndgrf.cxx:594: Cannot swap in graphic
Comment 3 Julien Nabet 2015-10-06 19:55:20 UTC
Forgot to indicate this one too:
warn:sfx.appl:12592:1:sfx2/source/appl/fileobj.cxx:326: Graphic error [1] - [] URL[https://encrypted-tbn3.gstatic.com/images?q=tbn:ANd9GcS7_QMxg7C5S4Cs50FWt7Mg0J4vnPePxRLmWZNXAd3hfSXYB9t-QA]
Comment 4 raal 2015-10-07 16:24:09 UTC
I can confirm crash with Version: 5.1.0.0.alpha1+
Build ID: 83ef294dddf3b1ab5cd5f91a792a7d9413a08f1f
TinderBox: Linux-rpm_deb-x86_64@70-TDF, Branch:master, Time: 2015-09-20_07:00:46
Comment 5 raal 2015-10-07 16:36:22 UTC
Created attachment 119396 [details]
gdbtrace
Comment 6 raal 2015-10-07 16:42:46 UTC
No crash in LO 4.4.2, after compression I can see picture ->regression
Comment 7 Julien Nabet 2015-10-07 16:58:52 UTC
Thank you Raal for your very quick feedback.

bt shows:
#0  0x00007ffff62729f1 in JPEGWriter::Write(Graphic const&) ()
   from /opt/libreofficedev5.1/program/libmergedlo.so
#1  0x00007ffff6270722 in ExportJPEG(SvStream&, Graphic const&, com::sun::star::uno::Sequence<com::sun::star::beans::PropertyValue> const*, bool*) ()
   from /opt/libreofficedev5.1/program/libmergedlo.so

 --enable-mergedlibs related?
Indeed, I tried again with master sources updated today, no image but no crash.
Comment 8 Björn Michaelsen 2015-10-13 09:49:52 UTC
Already crashing on 50max tag oldest (source-hash-2851ce5afd0f37764cbbc2c2a9a63c7adc844311) -- thus not a regression introduced in 50 => setting version to 4.4.0~beta1.

Might still be bibisectable with e.g. a 44max repo.
Comment 9 Rpnpif 2015-11-14 20:03:42 UTC
*** Bug 95740 has been marked as a duplicate of this bug. ***
Comment 10 raal 2015-11-17 14:36:36 UTC
bibisect-44max: I can reproduce crash with oldest version in bibisect repo:  Version: 4.3.0.0.alpha1+
Build ID: c15927f20d4727c3b8de68497b6949e72f9e6e9e
Comment 11 Joel Madero 2015-12-14 02:55:00 UTC
Does this crash still happen with 5.0 or better 5.2? I can't crash with either versions.
Comment 12 Robinson Tryon (qubit) 2015-12-14 05:32:35 UTC Comment hidden (obsolete)
Comment 13 Rpnpif 2015-12-14 10:45:53 UTC
(In reply to Joel Madero from comment #11)
> Does this crash still happen with 5.0 or better 5.2? I can't crash with
> either versions.

Yes Joel, 5.0.3.2 still do crash.
Comment 14 Joel Madero 2015-12-19 22:35:34 UTC
Raal - can you try to bibisect this one with 44all? I can't crash it for the life of me (tested on a variety of packages)
Comment 15 Commit Notification 2016-01-11 20:42:55 UTC
Matúš Kukan committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=d5dcfe40ff3774d82a7b8f9f3d75b5b3cdac78ba

tdf#94831: Check for null mpReadAccess before first use

It will be available in 5.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 16 Commit Notification 2016-01-12 08:01:33 UTC
Matúš Kukan committed a patch related to this issue.
It has been pushed to "libreoffice-5-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=4b2007997fd6b061702515e5d708ccbe5f03c161&h=libreoffice-5-1

tdf#94831: Check for null mpReadAccess before first use

It will be available in 5.1.0.2.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 17 Commit Notification 2016-01-12 08:03:34 UTC
Matúš Kukan committed a patch related to this issue.
It has been pushed to "libreoffice-5-0":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=39f0277ba71c8f3834579003c046d12fa4650e8f&h=libreoffice-5-0

tdf#94831: Check for null mpReadAccess before first use

It will be available in 5.0.5.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.