Bug 1217569

Summary: [abrt] libreoffice-core: FindTableNode(): soffice.bin killed by SIGSEGV
Product: [Fedora] Fedora Reporter: Peter F. Patel-Schneider <pfpschneider>
Component: libreofficeAssignee: Caolan McNamara <caolanm>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 21CC: caolanm, dtardon, erack, ltinkl, mstahl, sbergman
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/8170a64dc720818b2897432204b0b12dde912c7d
Whiteboard: abrt_hash:a717f56823d2720bdb1a4bb247cad51af432e2c9
Fixed In Version: libreoffice-4.3.7.2-4.fc21 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-05-12 20:40:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: exploitable
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status
none
File that causes crash none

Description Peter F. Patel-Schneider 2015-04-30 16:42:00 UTC 
Description of problem:
This problem occurred when opening a Word document, with extension docx.

It is repeatable.  Each time I open this document I get a crash.

Version-Release number of selected component:
libreoffice-core-4.3.6.2-9.fc21

Additional info:
reporter:       libreport-2.3.0
backtrace_rating: 4
cmdline:        /usr/lib64/libreoffice/program/soffice.bin --writer file:///home/pfps/.tmp/Incident%20Report%20Form%206.4.5.docx --splash-pipe=5
crash_function: FindTableNode
executable:     /usr/lib64/libreoffice/program/soffice.bin
kernel:         3.19.4-200.fc21.x86_64
runlevel:       N 5
type:           CCpp
uid:            1316
var_log_messages: [System Logs]:\n-- Logs begin at Thu 2015-04-09 14:24:20 PDT, end at Thu 2015-04-30 09:34:23 PDT. --

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 FindTableNode at /usr/src/debug/libreoffice-4.3.6.2/sw/inc/node.hxx:672
 #1 SwTableBox::SwTableBox at /usr/src/debug/libreoffice-4.3.6.2/sw/source/core/table/swtable.cxx:1679
 #2 SwNodes::TextToTable at /usr/src/debug/libreoffice-4.3.6.2/sw/source/core/docnode/ndtbl.cxx:1396
 #3 SwDoc::TextToTable at /usr/src/debug/libreoffice-4.3.6.2/sw/source/core/docnode/ndtbl.cxx:1210
 #4 SwXText::convertToTable at /usr/src/debug/libreoffice-4.3.6.2/sw/source/core/unocore/unotext.cxx:2247
 #5 writerfilter::dmapper::DomainMapperTableHandler::endTable at /usr/src/debug/libreoffice-4.3.6.2/writerfilter/source/dmapper/DomainMapperTableHandler.cxx:1059
 #6 writerfilter::TableManager<com::sun::star::uno::Reference<com::sun::star::text::XTextRange>, boost::shared_ptr<writerfilter::dmapper::TablePropertyMap> >::resolveCurrentTable at /usr/src/debug/libreoffice-4.3.6.2/writerfilter/inc/resourcemodel/TableManager.hxx:1046
 #7 writerfilter::TableManager<com::sun::star::uno::Reference<com::sun::star::text::XTextRange>, boost::shared_ptr<writerfilter::dmapper::TablePropertyMap> >::endLevel at /usr/src/debug/libreoffice-4.3.6.2/writerfilter/inc/resourcemodel/TableManager.hxx:770
 #8 writerfilter::dmapper::DomainMapperTableManager::endLevel at /usr/src/debug/libreoffice-4.3.6.2/writerfilter/source/dmapper/DomainMapperTableManager.cxx:529
 #9 writerfilter::TableManager<com::sun::star::uno::Reference<com::sun::star::text::XTextRange>, boost::shared_ptr<writerfilter::dmapper::TablePropertyMap> >::endParagraphGroup at /usr/src/debug/libreoffice-4.3.6.2/writerfilter/inc/resourcemodel/TableManager.hxx:821
Comment 1 Peter F. Patel-Schneider 2015-04-30 16:42:04 UTC 
Created attachment 1020669 [details]
File: backtrace
Comment 2 Peter F. Patel-Schneider 2015-04-30 16:42:05 UTC 
Created attachment 1020670 [details]
File: cgroup
Comment 3 Peter F. Patel-Schneider 2015-04-30 16:42:06 UTC 
Created attachment 1020671 [details]
File: core_backtrace
Comment 4 Peter F. Patel-Schneider 2015-04-30 16:42:07 UTC 
Created attachment 1020672 [details]
File: dso_list
Comment 5 Peter F. Patel-Schneider 2015-04-30 16:42:08 UTC 
Created attachment 1020673 [details]
File: environ
Comment 6 Peter F. Patel-Schneider 2015-04-30 16:42:08 UTC 
Created attachment 1020674 [details]
File: exploitable
Comment 7 Peter F. Patel-Schneider 2015-04-30 16:42:09 UTC 
Created attachment 1020675 [details]
File: limits
Comment 8 Peter F. Patel-Schneider 2015-04-30 16:42:11 UTC 
Created attachment 1020676 [details]
File: maps
Comment 9 Peter F. Patel-Schneider 2015-04-30 16:42:12 UTC 
Created attachment 1020677 [details]
File: open_fds
Comment 10 Peter F. Patel-Schneider 2015-04-30 16:42:12 UTC 
Created attachment 1020678 [details]
File: proc_pid_status
Comment 11 Michael Stahl 2015-04-30 20:21:15 UTC 
could you attach the .docx file here? (click on "Add an attachment")
Comment 12 Peter F. Patel-Schneider 2015-04-30 21:55:57 UTC 
Created attachment 1020748 [details]
File that causes crash

I attached a file that causes the crash.  (I sanitized the original document a bit.)
Comment 13 Caolan McNamara 2015-05-01 15:28:03 UTC 
fixed in 4.4, backporting to 4.3
Comment 14 Fedora Update System 2015-05-03 20:01:19 UTC 
libreoffice-4.3.7.2-4.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/libreoffice-4.3.7.2-4.fc21
Comment 15 Fedora Update System 2015-05-08 07:44:46 UTC 
Package libreoffice-4.3.7.2-4.fc21:
* should fix your issue,
* was pushed to the Fedora 21 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing libreoffice-4.3.7.2-4.fc21'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-7549/libreoffice-4.3.7.2-4.fc21
then log in and leave karma (feedback).
Comment 16 Fedora Update System 2015-05-12 20:40:11 UTC 
libreoffice-4.3.7.2-4.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 17 Peter F. Patel-Schneider 2015-06-16 17:14:18 UTC 
Confirmed fixed.