Bug 98088 - Writer crashes when importing MathML formula with specified fontweight attribute
Summary: Writer crashes when importing MathML formula with specified fontweight attribute
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
5.0.4.2 release
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard: target:5.2.0 target:5.1.4
Keywords: haveBacktrace
Depends on:
Blocks:
 
Reported: 2016-02-22 18:39 UTC by Anton S
Modified: 2016-10-25 19:02 UTC (History)
4 users (show)

See Also:
Crash report or crash signature:


Attachments
MathML file that causes Writer to crash (462 bytes, application/mathml+xml)
2016-02-22 18:39 UTC, Anton S
Details
MathML file that causes Writer not to crash (405 bytes, application/mathml+xml)
2016-02-22 18:41 UTC, Anton S
Details
bt with debug symbols (5.37 KB, text/plain)
2016-02-22 19:50 UTC, Julien Nabet
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Anton S 2016-02-22 18:39:54 UTC
Created attachment 122887 [details]
MathML file that causes Writer to crash

When importing a formula where the fontwheigt attribute is specified Writer crashes. Specifically this causes writer to crash when trying to import formulas from Maplesoft Maple 18. 

This bug is always reproducible.

How to reproduce:
Possibility a:
Insert->Object->Formula->Tools->InsertFormula->choose crash.mml file
Possibility b:
Doubble click on the crash.mml file

The crash.mml file looks like this
...
   <mi ... fontweight='normal'>a</mi>
...

Expected result:
Writer ignores the fontweight attribute
Actual result:
Writer crashes

See the attached *.mml files.

Additional Info:
Suse Linux LEAP
Comment 1 Anton S 2016-02-22 18:41:06 UTC
Created attachment 122888 [details]
MathML file that causes Writer not to crash

only diffrence to the crash.mml is the missing fontweight attribute
Comment 2 Julien Nabet 2016-02-22 19:50:55 UTC
Created attachment 122891 [details]
bt with debug symbols

On pc Debian x86-64 with master sources updated yesterday, I could reproduce this.
Comment 3 Commit Notification 2016-02-27 21:28:02 UTC
Oliver Specht committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=529e06a1b855ac83468230a15903aeafe1ac89a7

tdf#98088: prevent access to invalid sub node

It will be available in 5.2.0.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.
Comment 4 Commit Notification 2016-05-13 11:59:26 UTC
Oliver Specht committed a patch related to this issue.
It has been pushed to "libreoffice-5-1":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=cda827958eefb636a4dbe57e1df7d21b5878171f&h=libreoffice-5-1

tdf#98088: prevent access to invalid sub node

It will be available in 5.1.4.

The patch should be included in the daily builds available at
http://dev-builds.libreoffice.org/daily/ in the next 24-48 hours. More
information about daily builds can be found at:
http://wiki.documentfoundation.org/Testing_Daily_Builds

Affected users are encouraged to test the fix and report feedback.