Version-Release number of selected component: libreoffice-core-3.5.7.2-2.fc17 Additional info: libreport version: 2.0.14 abrt_version: 2.0.13 backtrace_rating: 4 cmdline: /usr/lib64/libreoffice/program/soffice.bin --writer --splash-pipe=6 crash_function: GetChar kernel: 3.6.1-1.fc17.x86_64 truncated backtrace: :Thread no. 1 (10 frames) : #0 GetChar at /usr/src/debug/libreoffice-3.5.7.2/solver/unxlngx6.pro/inc/tools/string.hxx:461 : #1 MathType::HandleRecords at /usr/src/debug/libreoffice-3.5.7.2/starmath/source/mathtype.cxx:718 : #2 MathType::HandleTemplate at /usr/src/debug/libreoffice-3.5.7.2/starmath/source/mathtype.cxx:2752 : #3 MathType::HandleRecords at /usr/src/debug/libreoffice-3.5.7.2/starmath/source/mathtype.cxx:1716 : #5 MathType::HandlePile at /usr/src/debug/libreoffice-3.5.7.2/starmath/source/mathtype.cxx:2678 : #6 MathType::HandleRecords at /usr/src/debug/libreoffice-3.5.7.2/starmath/source/mathtype.cxx:1721 : #9 MathType::Parse at /usr/src/debug/libreoffice-3.5.7.2/starmath/source/mathtype.cxx:597 : #10 SmDocShell::ConvertFrom at /usr/src/debug/libreoffice-3.5.7.2/starmath/source/document.cxx:786 : #11 SfxObjectShell::DoLoad at /usr/src/debug/libreoffice-3.5.7.2/sfx2/source/doc/objstor.cxx:748 : #12 SfxBaseModel::load at /usr/src/debug/libreoffice-3.5.7.2/sfx2/source/doc/sfxbasemodel.cxx:1873
Created attachment 635649 [details] File: core_backtrace
Created attachment 635650 [details] File: environ
Created attachment 635651 [details] File: backtrace
Created attachment 635652 [details] File: limits
Created attachment 635653 [details] File: cgroup
Created attachment 635654 [details] File: maps
Created attachment 635655 [details] File: dso_list
Created attachment 635656 [details] File: var_log_messages
Created attachment 635657 [details] File: open_fds
Could you attach the document here?
Looking at code around starmath/source/mathtype.cxx +718 it could be that for (nRecord == END) xub_StrLen nI = rRet.Len()-1; while (nI && ((cChar = rRet.GetChar(nI)) == ' ')) --nI; the rRet string is empty, effectively leading to nI=0xffff and out of bounds access.
Pushed http://cgit.freedesktop.org/libreoffice/core/commit/?id=4dd6c44628ab4e6b4debf22e58e01f9263a5a878 upstream according to erack's theory. But still would like to see crashing document to verify that.
let's presume the fix is good