Bug 117440

Summary: OpenOffice crash with malformed TTF 'names' table
Product: [Fedora] Fedora Reporter: Zuirdj <zuirdj>
Component: openoffice.orgAssignee: Dan Williams <dcbw>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: high    
Version: rawhide   
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-03-19 14:34:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 114961    
Attachments:
Description Flags
The font that crashed my OO.o
none
OOo returns to work.... none

Description Zuirdj 2004-03-03 23:48:55 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040217

Description of problem:
Everytime I try to load OOffice, it crashs immediately, selecting it
by menu or loading it in terminal. 

Version-Release number of selected component (if applicable):
openoffice.org-1.1.0-28

How reproducible:
Always

Steps to Reproduce:
1. Select OpenOffice Writer/Impress/Calc/Draw/Math by menu.
2. Fatal exception showed in a window message

    

Actual Results:  The program crashed

Additional info:

Fatal exception: Signal 11
Stack:
/usr/lib/ooo-1.1.0/program/libsal.so.3[0xbc4614]
/usr/lib/ooo-1.1.0/program/libsal.so.3[0xbc47a1]
/usr/lib/ooo-1.1.0/program/libsal.so.3[0xbc486a]
/lib/tls/libpthread.so.0[0xb82058]
/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZNK3psp16PrintFontManager25analyzeTrueTypeFamilyNameEPvRN4_STL4listIN3rtl8OUStringENS2_9allocatorIS5_EEEE+0x91)[0x5e603e7]
/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZNK3psp16PrintFontManager19analyzeTrueTypeFileEPNS0_9PrintFontE+0x10d)[0x5e6083d]
/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZN3psp16PrintFontManager11addFontFileERKN3rtl7OStringEPK10_FcPatternb+0x850)[0x5e5f9e2]
/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZN3psp16PrintFontManager15addFcSystemFontEP10_FcPattern+0x83)[0x5e60f23]
/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZN3psp16PrintFontManager18addFcSystemFontSetEP10_FcFontSet+0x3d)[0x5e60f8f]
/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZN3psp16PrintFontManager10initializeEPv+0x18b)[0x5e61127]
/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZN3psp16PrintFontManager3getEv+0x69)[0x5e5c281]
/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN11SalGraphics14GetDevFontListEP15ImplDevFontList+0x4de)[0x4ec998]
/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZNK12OutputDevice16ImplInitFontListEv+0x47)[0x3a8433]
/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN6Window24ImplUpdateGlobalSettingsER11AllSettingsh+0x4c)[0x45640c]
/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN6Window8ImplInitEPS_xP16SystemParentData+0x6c1)[0x457981]
/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN6Dialog8ImplInitEP6Windowx+0x1f1)[0x41dfc9]
/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN7MessBoxC2EP6WindowRK5ResId+0x151)[0x432fe1]
/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN8QueryBoxC1EP6WindowRK5ResId+0x3e)[0x434ad6]
/usr/lib/ooo-1.1.0/program/soffice.bin(_ZNK7desktop8Lockfile11execWarningEv+0xde)[0x806cbb6]
/usr/lib/ooo-1.1.0/program/soffice.bin(_ZN7desktop8Lockfile5checkEv+0x2d)[0x806c2f5]
/usr/lib/ooo-1.1.0/program/soffice.bin(_ZN7desktop7Desktop4MainEv+0x109)[0x806370d]
/usr/lib/ooo-1.1.0/program/libvcl645li.so(_Z6SVMainv+0x49)[0x32db57]
/usr/lib/ooo-1.1.0/program/libvcl645li.so(main+0x4c)[0x4f99f8]
/lib/tls/libc.so.6(__libc_start_main+0xe5)[0x44a8475]
/usr/lib/ooo-1.1.0/program/soffice.bin(_ZN6Window11RequestHelpERK9HelpEvent+0x31)[0x805e49d]
Abortado

Comment 1 Dan Williams 2004-03-04 15:32:35 UTC
This would most likely be a bad TrueType font, which are usually
installed in /usr/share/fonts.  It could also be a font  that is
sufficiently unusual that OOo doesn't know about its structure.

So, could you:
1) From a terminal, type "strace /usr/bin/oowriter" without the quotes
and hit return
2) Take the last 100 lines or so, and post them to this bug report

Thanks!
Dan

Comment 2 Zuirdj 2004-03-04 17:59:28 UTC
I tried it and terminal showed showed this message:


ioctl(6, FIONREAD, [0])                 = 0
write(6, "\2\6\4\0\27\0\200\3\0@\0\0\23\0\200\3", 16) = 16
select(7, [4 6], NULL, [6], NULL)       = 1 (in [6])
select(7, [6], NULL, [], {0, 0})        = 1 (in [6], left {0, 0})
ioctl(6, FIONREAD, [32])                = 0
read(6, "\4\1\216\33\32\241\206\1}\0\0\0\27\0\200\3\0\0\0\0\f\2"...,
32) = 32
gettimeofday({1078422960, 855597}, NULL) = 0
write(5, "\0", 1)                       = 1
write(6,
"\33\6\2\0\0\0\0\0;\3\5\0%\0\200\3\0\0\0\0\227\0Y\0F\0\31"..., 640) = 640
read(6, 0xbff86c64, 32)                 = -1 EAGAIN (Resource
temporarily unavailable)
select(7, [6], NULL, NULL, NULL)        = 1 (in [6])
read(6, "\1\0\252\33\0\0\0\0x\330\356\277\223\307\v\10p\264\237"...,
32) = 32
gettimeofday({1078422960, 900165}, NULL) = 0
write(6, "\2\6\4\0\27\0\200\3\0@\0\0\23\0\200\3\36\0\4\0\23\0\200"...,
32) = 32
select(7, [4 6], NULL, [6], NULL)       = 1 (in [4])
read(4, "\0", 4)                        = 1
read(4, 0xbff87240, 4)                  = -1 EAGAIN (Resource
temporarily unavailable)
select(7, [4 6], NULL, [6], NULL)       = 1 (in [6])
select(7, [6], NULL, [], {0, 0})        = 1 (in [6], left {0, 0})
ioctl(6, FIONREAD, [32])                = 0
read(6, "\5\1\254\33\252\241\206\1}\0\0\0\27\0\200\3\0\0\0\0\f\2"...,
32) = 32
gettimeofday({1078422961, 7422}, NULL)  = 0
write(6, "\33\6\2\0\0\0\0\0\33@\2\0\0\0\0\0", 16) = 16
write(5, "\0", 1)                       = 1
rt_sigaction(SIGABRT, {SIG_DFL}, NULL, 8) = 0
write(2, "\n\nFatal exception: Signal 11\n", 29
 
Fatal exception: Signal 11
) = 29
write(2, "Stack:\n", 7Stack:
)                 = 7
writev(2, [{"/usr/lib/ooo-1.1.0/program/libsa"..., 38}, {"[0x", 3},
{"bc4614", 6}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/libsal.so.3[0xbc4614]
) = 49
writev(2, [{"/usr/lib/ooo-1.1.0/program/libsa"..., 38}, {"[0x", 3},
{"bc47a1", 6}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/libsal.so.3[0xbc47a1]
) = 49
writev(2, [{"/usr/lib/ooo-1.1.0/program/libsa"..., 38}, {"[0x", 3},
{"bc486a", 6}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/libsal.so.3[0xbc486a]
) = 49
writev(2, [{"/lib/tls/libpthread.so.0", 24}, {"[0x", 3}, {"b82058",
6}, {"]\n", 2}], 4/lib/tls/libpthread.so.0[0xb82058]
) = 35
writev(2, [{"/usr/lib/ooo-1.1.0/program/libps"..., 41}, {"(", 1},
{"_ZNK3psp16PrintFontManager25anal"..., 106}, {"+0x", 3}, {"91", 2},
{")", 1}, {"[0x", 3}, {"86d03e7", 7}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZNK3psp16PrintFontManager25analyzeTrueTypeFamilyNameEPvRN4_STL4listIN3rtl8OUStringENS2_9allocatorIS5_EEEE+0x91)[0x86d03e7]
) = 166
writev(2, [{"/usr/lib/ooo-1.1.0/program/libps"..., 41}, {"(", 1},
{"_ZNK3psp16PrintFontManager19anal"..., 64}, {"+0x", 3}, {"10d", 3},
{")", 1}, {"[0x", 3}, {"86d083d", 7}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZNK3psp16PrintFontManager19analyzeTrueTypeFileEPNS0_9PrintFontE+0x10d)[0x86d083d]
) = 125
writev(2, [{"/usr/lib/ooo-1.1.0/program/libps"..., 41}, {"(", 1},
{"_ZN3psp16PrintFontManager11addFo"..., 70}, {"+0x", 3}, {"850", 3},
{")", 1}, {"[0x", 3}, {"86cf9e2", 7}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZN3psp16PrintFontManager11addFontFileERKN3rtl7OStringEPK10_FcPatternb+0x850)[0x86cf9e2]
) = 131
writev(2, [{"/usr/lib/ooo-1.1.0/program/libps"..., 41}, {"(", 1},
{"_ZN3psp16PrintFontManager15addFc"..., 56}, {"+0x", 3}, {"83", 2},
{")", 1}, {"[0x", 3}, {"86d0f23", 7}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZN3psp16PrintFontManager15addFcSystemFontEP10_FcPattern+0x83)[0x86d0f23]
) = 116
writev(2, [{"/usr/lib/ooo-1.1.0/program/libps"..., 41}, {"(", 1},
{"_ZN3psp16PrintFontManager18addFc"..., 59}, {"+0x", 3}, {"3d", 2},
{")", 1}, {"[0x", 3}, {"86d0f8f", 7}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZN3psp16PrintFontManager18addFcSystemFontSetEP10_FcFontSet+0x3d)[0x86d0f8f]
) = 119
writev(2, [{"/usr/lib/ooo-1.1.0/program/libps"..., 41}, {"(", 1},
{"_ZN3psp16PrintFontManager10initi"..., 40}, {"+0x", 3}, {"18b", 3},
{")", 1}, {"[0x", 3}, {"86d1127", 7}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZN3psp16PrintFontManager10initializeEPv+0x18b)[0x86d1127]
) = 101
writev(2, [{"/usr/lib/ooo-1.1.0/program/libps"..., 41}, {"(", 1},
{"_ZN3psp16PrintFontManager3getEv", 31}, {"+0x", 3}, {"69", 2}, {")",
1}, {"[0x", 3}, {"86cc281", 7}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libpsp645li.so(_ZN3psp16PrintFontManager3getEv+0x69)[0x86cc281]
) = 91
writev(2, [{"/usr/lib/ooo-1.1.0/program/libvc"..., 41}, {"(", 1},
{"_ZN11SalGraphics14GetDevFontList"..., 51}, {"+0x", 3}, {"4de", 3},
{")", 1}, {"[0x", 3}, {"3a1998", 6}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN11SalGraphics14GetDevFontListEP15ImplDevFontList+0x4de)[0x3a1998]
) = 111
writev(2, [{"/usr/lib/ooo-1.1.0/program/libvc"..., 41}, {"(", 1},
{"_ZNK12OutputDevice16ImplInitFont"..., 38}, {"+0x", 3}, {"47", 2},
{")", 1}, {"[0x", 3}, {"25d433", 6}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZNK12OutputDevice16ImplInitFontListEv+0x47)[0x25d433]
) = 97
writev(2, [{"/usr/lib/ooo-1.1.0/program/libvc"..., 41}, {"(", 1},
{"_ZN6Window24ImplUpdateGlobalSett"..., 52}, {"+0x", 3}, {"4c", 2},
{")", 1}, {"[0x", 3}, {"30b40c", 6}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN6Window24ImplUpdateGlobalSettingsER11AllSettingsh+0x4c)[0x30b40c]
) = 111
writev(2, [{"/usr/lib/ooo-1.1.0/program/libvc"..., 41}, {"(", 1},
{"_ZN6Window8ImplInitEPS_xP16Syste"..., 43}, {"+0x", 3}, {"6c1", 3},
{")", 1}, {"[0x", 3}, {"30c981", 6}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN6Window8ImplInitEPS_xP16SystemParentData+0x6c1)[0x30c981]
) = 103
writev(2, [{"/usr/lib/ooo-1.1.0/program/libvc"..., 41}, {"(", 1},
{"_ZN16ImplBorderWindow8ImplInitEP"..., 60}, {"+0x", 3}, {"10d", 3},
{")", 1}, {"[0x", 3}, {"2c862b", 6}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN16ImplBorderWindow8ImplInitEP6WindowxtP16SystemParentData+0x10d)[0x2c862b]
) = 120
writev(2, [{"/usr/lib/ooo-1.1.0/program/libvc"..., 41}, {"(", 1},
{"_ZN16ImplBorderWindowC1EP6Window"..., 53}, {"+0x", 3}, {"70", 2},
{")", 1}, {"[0x", 3}, {"2c87d0", 6}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN16ImplBorderWindowC1EP6WindowP16SystemParentDataxt+0x70)[0x2c87d0]
) = 112
writev(2, [{"/usr/lib/ooo-1.1.0/program/libvc"..., 41}, {"(", 1},
{"_ZN10WorkWindow8ImplInitEP6Windo"..., 53}, {"+0x", 3}, {"7d", 2},
{")", 1}, {"[0x", 3}, {"326d57", 6}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN10WorkWindow8ImplInitEP6WindowxP16SystemParentData+0x7d)[0x326d57]
) = 112
writev(2, [{"/usr/lib/ooo-1.1.0/program/libvc"..., 41}, {"(", 1},
{"_ZN11IntroWindowC2Ev", 20}, {"+0x", 3}, {"65", 2}, {")", 1}, {"[0x",
3}, {"327983", 6}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libvcl645li.so(_ZN11IntroWindowC2Ev+0x65)[0x327983]
) = 79
writev(2, [{"/usr/lib/ooo-1.1.0/program/libsp"..., 41}, {"[0x", 3},
{"840b215", 7}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/libspl645li.so[0x840b215]
) = 53
writev(2, [{"/usr/lib/ooo-1.1.0/program/libsp"..., 41}, {"[0x", 3},
{"840c36f", 7}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/libspl645li.so[0x840c36f]
) = 53
writev(2, [{"/usr/lib/ooo-1.1.0/program/libcp"..., 49}, {"[0x", 3},
{"b311e9", 6}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/libcppuhelpergcc3.so.3[0xb311e9]
) = 60
writev(2, [{"/usr/lib/ooo-1.1.0/program/libcp"..., 49}, {"[0x", 3},
{"b3139a", 6}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/libcppuhelpergcc3.so.3[0xb3139a]
) = 60
writev(2, [{"/usr/lib/ooo-1.1.0/program/libcp"..., 49}, {"[0x", 3},
{"b31f08", 6}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/libcppuhelpergcc3.so.3[0xb31f08]
) = 60
writev(2, [{"/usr/lib/ooo-1.1.0/program/libcp"..., 49}, {"[0x", 3},
{"b313fe", 6}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/libcppuhelpergcc3.so.3[0xb313fe]
) = 60
writev(2, [{"/usr/lib/ooo-1.1.0/program/libcp"..., 49}, {"[0x", 3},
{"b3204d", 6}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/libcppuhelpergcc3.so.3[0xb3204d]
) = 60
writev(2, [{"/usr/lib/ooo-1.1.0/program/libcp"..., 49}, {"[0x", 3},
{"b32b3d", 6}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/libcppuhelpergcc3.so.3[0xb32b3d]
) = 60
writev(2, [{"/usr/lib/ooo-1.1.0/program/servi"..., 44}, {"[0x", 3},
{"5bd927c", 7}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/servicemgr.uno.so[0x5bd927c]
) = 56
writev(2, [{"/usr/lib/ooo-1.1.0/program/servi"..., 44}, {"[0x", 3},
{"5bd9832", 7}, {"]\n", 2}],
4/usr/lib/ooo-1.1.0/program/servicemgr.uno.so[0x5bd9832]
) = 56
writev(2, [{"/usr/lib/ooo-1.1.0/program/soffi"..., 38}, {"(", 1},
{"_ZN7desktop7Desktop16OpenSplashS"..., 39}, {"+0x", 3}, {"201", 3},
{")", 1}, {"[0x", 3}, {"806b0c7", 7}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/soffice.bin(_ZN7desktop7Desktop16OpenSplashScreenEv+0x201)[0x806b0c7]
) = 97
writev(2, [{"/usr/lib/ooo-1.1.0/program/soffi"..., 38}, {"(", 1},
{"_ZN7desktop7Desktop4MainEv", 26}, {"+0x", 3}, {"340", 3}, {")", 1},
{"[0x", 3}, {"8063944", 7}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/soffice.bin(_ZN7desktop7Desktop4MainEv+0x340)[0x8063944]
) = 84
writev(2, [{"/usr/lib/ooo-1.1.0/program/libvc"..., 41}, {"(", 1},
{"_Z6SVMainv", 10}, {"+0x", 3}, {"49", 2}, {")", 1}, {"[0x", 3},
{"1e2b57", 6}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libvcl645li.so(_Z6SVMainv+0x49)[0x1e2b57]
) = 69
writev(2, [{"/usr/lib/ooo-1.1.0/program/libvc"..., 41}, {"(", 1},
{"main", 4}, {"+0x", 3}, {"4c", 2}, {")", 1}, {"[0x", 3}, {"3ae9f8",
6}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/libvcl645li.so(main+0x4c)[0x3ae9f8]
) = 63
writev(2, [{"/lib/tls/libc.so.6", 18}, {"(", 1}, {"__libc_start_main",
17}, {"+0x", 3}, {"e5", 2}, {")", 1}, {"[0x", 3}, {"47e3475", 7},
{"]\n", 2}], 9/lib/tls/libc.so.6(__libc_start_main+0xe5)[0x47e3475]
) = 54
writev(2, [{"/usr/lib/ooo-1.1.0/program/soffi"..., 38}, {"(", 1},
{"_ZN6Window11RequestHelpERK9HelpE"..., 36}, {"+0x", 3}, {"31", 2},
{")", 1}, {"[0x", 3}, {"805e49d", 7}, {"]\n", 2}],
9/usr/lib/ooo-1.1.0/program/soffice.bin(_ZN6Window11RequestHelpERK9HelpEvent+0x31)[0x805e49d]
) = 93
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
tgkill(12502, 12502, SIGABRT)           = 0
--- SIGABRT (Aborted) @ 0 (0) ---
+++ killed by SIGABRT +++

I removed all fonts at /home/~/.fonts and OOffice started OK. 

How can I know which font(s) is/are causing the problem?

Comment 3 Sigge Kotliar 2004-03-11 20:44:25 UTC
Created attachment 98464 [details]
The font that crashed my OO.o

FOXJUMP.TTF

Comment 4 Sigge Kotliar 2004-03-11 20:45:16 UTC
Hi!

I was having the same problem, and tested my fonts out a little, this
one turned out to be faulty: [attached]

note that maybe it still is an OO.o bug since all other apps are
working fine!

Comment 5 Zuirdj 2004-03-12 16:20:30 UTC
I don't have that font. :-(

Comment 6 Dan Williams 2004-03-12 18:18:57 UTC
The FOXJUMP.TTF font is malformed it turns out.  TrueType fonts have a
'name' table that contains strings, and one entry in that 'name' table
has an extremely bad offset to the beginning of the actual string, in
this case 0xFFF1 (located at offset 0x75C4 in the font file).  This
causes a memcpy() of OOo to fail because it reads beyond the end of
the memory.

So, in short, the font file is bad but OOo could be more robust in
dealing with this font.  I will attempt to make OOo do so.

Comment 7 Zuirdj 2004-03-18 00:25:43 UTC
Created attachment 98637 [details]
OOo returns to work....

Comment 8 Zuirdj 2004-03-18 00:26:39 UTC
The problem was gone with the last update (openoffice.org-1.1.0-30). 

I have 769 TTFs in my ./fonts directory and last OOo development
package recognized all of them.

If you think problem was completely resolved (no more users will have
the problem), you can close the entry.

Thanks for the solution!

Comment 9 Dan Williams 2004-03-19 14:34:20 UTC
Fixed in rawhide (openoffice.org-1.1.0-32) and RHEL3 U2
(openoffice.org-1.1.0-14.EL)