After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 712662 - Null pointer crash in print_page on xls2pdf conversion
Null pointer crash in print_page on xls2pdf conversion
Status: RESOLVED FIXED
Product: Gnumeric
Classification: Applications
Component: import/export MS Excel (tm)
git master
Other Linux
: Normal critical
: ---
Assigned To: Jody Goldberg
Jody Goldberg
Depends on:
Blocks:
 
 
Reported: 2013-11-19 11:33 UTC by jutaky
Modified: 2013-11-19 12:49 UTC
See Also:
GNOME target: ---
GNOME version: ---


Description jutaky 2013-11-19 11:33:13 UTC 
Null pointer crash in print_page on xls2pdf conversion.

Git versions of glib, goffice, gnumeric, libgsf and libxml2.

Test case: http://jutaky.com/fuzzing/gnumeric_case_29298_2388.2pdf.xls


==4573== ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f44d0e48c6e sp 0x7fff2979f520 bp 0x7fff2979f820 T0)
AddressSanitizer can not provide additional info.

+ Trace 232797

  • #0 print_page /gnumeric/gnumeric/src/print.c:568
  • #1 gnm_draw_page_cb /gnumeric/gnumeric/src/print.c:1431
  • #2 g_closure_invoke /gnumeric/glib/gobject/gclosure.c:777
  • #3 signal_emit_unlocked_R /gnumeric/glib/gobject/gsignal.c:3586
  • #4 g_signal_emit_valist /gnumeric/glib/gobject/gsignal.c:3330
  • #5 g_signal_emit /gnumeric/glib/gobject/gsignal.c:3386 #6 0x7ff3207af36d
  • #9 g_idle_dispatch /gnumeric/glib/glib/gmain.c:5254
  • #10 g_main_dispatch /gnumeric/glib/glib/gmain.c:3066
  • #11 g_main_context_dispatch /gnumeric/glib/glib/gmain.c:3640
  • #12 g_main_context_iterate /gnumeric/glib/glib/gmain.c:3711
  • #13 g_main_loop_run /gnumeric/glib/glib/gmain.c:3905 #14 0x7ff3207aeaee
  • #16 gnm_print_sheet /gnumeric/gnumeric/src/print.c:1861
  • #17 pdf_write_workbook /gnumeric/gnumeric/src/print-info.c:851
  • #18 pdf_export /gnumeric/gnumeric/src/print-info.c:876
  • #19 go_file_saver_save_real /gnumeric/goffice/goffice/app/file.c:577
  • #20 go_file_saver_save /gnumeric/goffice/goffice/app/file.c:848
  • #21 wbv_save_to_output /gnumeric/gnumeric/src/workbook-view.c:1059
  • #22 wb_view_save_to_uri /gnumeric/gnumeric/src/workbook-view.c:1096
  • #23 wb_view_save_as /gnumeric/gnumeric/src/workbook-view.c:1132
  • #24 convert /gnumeric/gnumeric/src/ssconvert.c:788
  • #25 main /gnumeric/gnumeric/src/ssconvert.c:860
  • #26 __libc_start_main ??:?
  • #27 _start ??:? ==4573== ABORTING 

--
Juha Kylmänen
Research Assistant, OUSPG
Comment 1 Morten Welinder 2013-11-19 12:49:59 UTC 
This problem has been fixed in our software repository. The fix will go into the next software release. Thank you for your bug report.