Bug 321677 – Crash when loading planmaker example surface.xls

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 321677 - Crash when loading planmaker example surface.xls


Summary:	Crash when loading planmaker example surface.xls


Status:	RESOLVED FIXED

Product:	Gnumeric
Classification:	Applications
Component:	import/export MS Excel (tm)
Version:	1.6.x
Hardware:	Other All

Importance:	Normal critical
Target Milestone:	---
Assigned To:	Jody Goldberg
QA Contact:	Jody Goldberg

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2005-11-17 01:22 UTC by Nick Lamb
Modified:	2008-03-09 12:05 UTC

See Also:
GNOME target:	---
GNOME version:	---

Description Nick Lamb 2005-11-17 01:22:33 UTC

Steps to reproduce:
1. Obtain surface.xls example file from 
http://www.softmaker.com/english/pmwcomp_en.htm under the heading Surface Charts

2. Try to load it into Gnumeric 1.6.1 as released

3. Crash in Excel plug-in.

Stack trace:
0x00265402 in __kernel_vsyscall ()

+ Trace 64095

#0 __kernel_vsyscall
#1 __waitpid_nocancel
from /lib/libc.so.6
#2 libgnomeui_module_info_get
from /usr/lib/libgnomeui-2.so.0
#3 <signal handler called>
#4 xl_chart_read_gelframe
at ms-chart.c line 999
#5 ms_excel_chart_read
at ms-chart.c line 2955
#6 ms_excel_chart_read_BOF
at ms-chart.c line 3159
#7 ms_read_OBJ
at ms-obj.c line 1241
#8 ms_escher_read_ClientData
at ms-escher.c line 1975
#9 ms_escher_read_container
at ms-escher.c line 2079
#10 ms_escher_read_container
at ms-escher.c line 2079
#11 ms_escher_read_container
at ms-escher.c line 2079
#12 ms_escher_read_container
at ms-escher.c line 2079
#13 ms_escher_parse
at ms-escher.c line 2146
#14 excel_read_sheet
at ms-excel-read.c line 5684
#15 excel_read_BOF
at ms-excel-read.c line 5968
#16 excel_read_workbook
at ms-excel-read.c line 6034
#17 excel_file_open
at boot.c line 180
#18 go_plugin_loader_module_func_file_open
at go-plugin-loader-module.c line 239
#19 go_plugin_file_opener_open
at go-plugin-service.c line 500
#20 go_file_opener_open
at file.c line 289
#21 wb_view_new_from_input
at workbook-view.c line 976
#22 wb_view_new_from_uri
at workbook-view.c line 1027
#23 main
at main-application.c line 410



Other information:
This example is something a fair few people will use to compare Gnumeric to
Excel, because another spreadsheet maker uses it to show how their product is
superior to OpenOffice.org

Comment 1 Morten Welinder 2005-11-17 02:35:00 UTC

Confirmed.

Program received signal SIGSEGV, Segmentation fault.

+ Trace 64098

Thread 1093426560 (LWP 13101)

#0 xl_chart_read_gelframe
at ms-chart.c line 999
#1 ms_excel_chart_read
at ms-chart.c line 2955
#2 ms_excel_chart_read_BOF
at ms-chart.c line 3159
#3 ms_read_OBJ
at ms-obj.c line 1241
#4 ms_escher_read_ClientData
at ms-escher.c line 1975
#5 ms_escher_read_container
at ms-escher.c line 2079
#6 ms_escher_read_container
at ms-escher.c line 2079

Comment 2 Jody Goldberg 2005-11-17 03:34:57 UTC

looks simple.

Comment 3 Jean Bréfort 2005-11-17 06:36:20 UTC

Confirmed.
On entering gelframe, s->style = NULL, so it crashes the first time it is used:
	s->style->fill.type = GOG_FILL_STYLE_GRADIENT;

Comment 4 Morten Welinder 2005-11-18 16:09:10 UTC

Looks fixed in cvs.

Comment 5 Nick Lamb 2006-02-05 02:45:49 UTC

Re-opening, crashes 1.6.2. Please fix crashes in stables releases, not just HEAD

Comment 6 Morten Welinder 2006-02-06 00:22:21 UTC

Maybe.  The crasher does not [easily] cause data loss since it is on load, so
severity is not that high.  Whether we can do it depends on how intrusive
the fix is -- we don't want to risk making things worse.

Comment 7 Jean Bréfort 2006-02-06 07:13:41 UTC

The fix is quite straightforward, just do not try to set these data for unsupported plot types. Jody's fix in HEAD should be quite harmless in 1.6

Comment 8 Nick Lamb 2006-02-06 11:40:27 UTC

Downgrading my bug and marking it FIXED does not make it so. Severity restored, all crashes are critical severity, even ones Morten doesn't like.

Jean's observation looks superficially correct. If posted now I'm sure I could find time to review a small proposed patch to 1.6 branch in time for 1.6.3, but someone else still has to check it in...

Comment 9 Nick Lamb 2008-03-09 04:54:25 UTC

Doesn't crash 1.6.3 here. Presumably this fix was merged?

Comment 10 Morten Welinder 2008-03-09 12:05:35 UTC

> Presumably this fix was merged?

Only in the sense that 1.8.2 probably fixes it.  Nothing was done to the
1.6 series.