How to reproduce: 1. Insert any animated gif image (menu Insert > Image) 2. Insert > Media > Animated Image => a dialog pops up 3. Select "Group Object" radiobutton 4. Click "Apply objects individually" icon button (2nd from left) => notice that the preview of the animated gif image appears in the dialog 5. Click "Delete current image" icon button (3rd from left) => Kaboom! Impress crashes
Created attachment 119928 [details] console logs + bt with debug symbols On pc Debian x86-64 with master sources updated today, I could reproduce the crash. I attached console logs + bt with debug symbols
Reproduced on LO 5.0.2.2 Debian testing package.
Also reproduced with LO 5.1.0.0.alpha1+ Build ID: 186f32f63434e16ff5776251657f902d5808ed3d TinderBox: Win-x86@39, Branch:master, Time: 2015-10-16_09:42:47 under Windows 7 Home
ALG: Taking a look...
Problem was that the var to express the current frame (m_nCurrentFrame) uses a state EMPTY_FRAMELIST which is (of course) max integer and that it was partially used as array/vector access index without testing. Needed to add these missing tests and also corrections when the frame deleted was the last frame. Checked that this works now when deleting first/last frame, all frames and others. Checked and secured more places in the source, too. Preparing commit.
Armin Le Grand committed a patch related to this issue. It has been pushed to "master": http://cgit.freedesktop.org/libreoffice/core/commit/?id=f0cef70cd4164342b218fbee34bf57eedc22c998 tdf#95298: corrected some out-of-bound accesses to array It will be available in 5.1.0. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.
integrated to master, done
Armin Le Grand committed a patch related to this issue. It has been pushed to "libreoffice-5-0": http://cgit.freedesktop.org/libreoffice/core/commit/?id=6b3b080f8cedc1b496022b18e477af0c7361fba3&h=libreoffice-5-0 tdf#95298: corrected some out-of-bound accesses to array It will be available in 5.0.4. The patch should be included in the daily builds available at http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More information about daily builds can be found at: http://wiki.documentfoundation.org/Testing_Daily_Builds Affected users are encouraged to test the fix and report feedback.