After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 704391 - Incorrect text placement and wrap in GNM_SO_PATH_TYPE
Incorrect text placement and wrap in GNM_SO_PATH_TYPE
Status: RESOLVED OBSOLETE
Product: Gnumeric
Classification: Applications
Component: Sheet Objects
git master
Other All
: Normal normal
: ---
Assigned To: Jody Goldberg
Jody Goldberg
Depends on:
Blocks:
 
 
Reported: 2013-07-17 12:24 UTC by jutaky
Modified: 2018-05-22 14:01 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
screenshot (24.45 KB, image/png)
2013-07-18 03:33 UTC, Andreas J. Guelzow
Details
screen shot (21.68 KB, image/png)
2013-07-18 17:04 UTC, Andreas J. Guelzow
Details
Screenshot (11.49 KB, image/png)
2013-07-19 08:13 UTC, Jean Bréfort
Details
screenshot (75.08 KB, image/png)
2013-07-21 05:29 UTC, Andreas J. Guelzow
Details

Description jutaky 2013-07-17 12:24:40 UTC
Gnumeric hangs on opening a fuzzed gnumeric file.

I waited 90 minutes and killed gnumeric. By the time 4GB of RAM was used.

Git versions of glib, goffice, gnumeric, libgsf and libxml2.

Test case: http://jutaky.com/fuzzing/gnumeric_case_18956_2522_hung.gnumeric

Program received signal SIGINT, Interrupt.
0x00007ffff3b2d06c in g_hash_table_lookup_node (hash_table=0x8d0b60, key=0x7fffffffd650, hash_return=0x7fffffffd618)
    at ghash.c:374
374	  while (!HASH_IS_UNUSED (node_hash))
(gdb) bt
  • #0 g_hash_table_lookup_node
    at ghash.c line 374
  • #1 g_hash_table_lookup
    at ghash.c line 1076
  • #2 link_single_dep
    at dependent.c line 878
  • #3 link_unlink_single_dep
    at dependent.c line 924
  • #4 link_unlink_expr_dep
    at dependent.c line 1069
  • #5 link_unlink_expr_dep
    at dependent.c line 1064
  • #6 link_unlink_expr_dep
    at dependent.c line 1067
  • #7 dependent_link
    at dependent.c line 1512
  • #8 gnm_dep_style_dependency
    at dependent.c line 1214
  • #9 gnm_style_link_dependents
    at mstyle.c line 1902
  • #10 rstyle_apply
    at sheet-style.c line 322
  • #11 vector_apply_pstyle
    at sheet-style.c line 939
  • #12 cell_tile_apply
    at sheet-style.c line 1126
  • #13 cell_tile_apply
    at sheet-style.c line 1166
  • #14 sheet_style_set_range
    at sheet-style.c line 1357
  • #15 xml_sax_style_region_end
    at xml-sax-read.c line 1422
  • #16 gsf_xml_in_end_element
    at gsf-libxml.c line 844
  • #17 xmlParseEndTag1
    at parser.c line 8683
  • #18 xmlParseElement__internal_alias
    at parser.c line 10086
  • #19 xmlParseContent__internal_alias
    at parser.c line 9885
  • #20 xmlParseElement__internal_alias
    at parser.c line 10058
  • #21 xmlParseContent__internal_alias
    at parser.c line 9885
  • #22 xmlParseElement__internal_alias
    at parser.c line 10058
  • #23 xmlParseContent__internal_alias
    at parser.c line 9885
  • #24 xmlParseElement__internal_alias
    at parser.c line 10058
  • #25 xmlParseContent__internal_alias
    at parser.c line 9885
  • #26 xmlParseElement__internal_alias
    at parser.c line 10058
  • #27 xmlParseDocument__internal_alias
    at parser.c line 10742
  • #28 gsf_xml_in_doc_parse
    at gsf-libxml.c line 1289
  • #29 read_file_common
    at xml-sax-read.c line 3350
  • #30 gnm_xml_file_open
    at xml-sax-read.c line 3479
  • #31 go_file_opener_open_real
    at app/file.c line 159
  • #32 go_file_opener_open
    at app/file.c line 417
  • #33 workbook_view_new_from_input
    at workbook-view.c line 1272
  • #34 workbook_view_new_from_uri
    at workbook-view.c line 1332
  • #35 main
    at main-application.c line 321

--
Juha Kylmänen
Research Assistant, OUSPG
Comment 1 Morten Welinder 2013-07-17 14:42:05 UTC
Not a bug, I think.

This sheet sets up an insane style for a large range, A0:XX65536
(where XX is whatever code column 1024 gets).  The style is a conditional
style "(Überstunden!B1=7)" with a relative cell reference, so the style
of each of 64M cells depends on the value of 64M different cells.
That, well, is going to take a lot of time and memory.

It would be intersting to have a look at the original file to see if we
import it correctly.
Comment 2 jutaky 2013-07-17 15:31:22 UTC
The original file used in fuzzing was http://www.excelmexel.de/HTMLOOCalc/Zeiterfassung.ods converted to a gnumeric file.

I think Gnumeric places the yellow notes' text incorrectly if compared to LibreOffice.

Also I noticed that in conversion to xls Gnumeric loses the yellow notes while LibreOffice's xls version still has them.
Comment 3 Morten Welinder 2013-07-17 16:00:40 UTC
The file from comment 2 does indeed open with the text that was supposed
to go into the yellow rectanges places elsewhere.

And the file takes forever to open, although that may be my debug build.
Comment 4 Andreas J. Guelzow 2013-07-17 17:46:00 UTC
I don't see that in the odf file. So either I am misunderstanding something or we are misimporting something.
Comment 5 Andreas J. Guelzow 2013-07-17 18:03:43 UTC
For me opening the ODF file of comment #2 takes about 80 seconds. While that's not fast, I would not call it excessively slow.

That ODF file does not contain any large conditional region. Is suspect that that may be a result of the fuzzing later on. I do get conditional regions on most sheets, but none of them exceeds 40 cells.

Regarding the placement of the text:
The text is part of the rectangle objects. It is not placed separately. Since the rectangles are placed correctly. the objects in question are placed correctly. I do note that some words are missing in the text. For example on Kalendar, the blue text should start: "Aufgabe:\n Erzeugen Sie"...

So we seem to read or store the text incorrectly.
Comment 6 Andreas J. Guelzow 2013-07-17 18:09:00 UTC
The rectangles are saved as custom shapes:

 <draw:custom-shape table:end-cell-address="Kalender.E26" table:end-x="1.864cm" table:end-y="0.32cm" draw:z-index="0" draw:name="Text Box 1" draw:style-name="gr1" draw:text-style-name="P1" svg:width="7.528cm" svg:height="7.519cm" svg:x="0.81cm" svg:y="0.027cm"><text:p text:style-name="P1"><text:span text:style-name="T1">Aufgabe:</text:span></text:p><text:p text:style-name="P1"><text:span text:style-name="T2">Erzeugen Sie in Spalte A einen Kalender von diesem Monat und lassen Sie die Sonntage mit roter Schrift darstellen.</text:span></text:p><text:p text:style-name="P1"><text:span text:style-name="T1"/></text:p><text:p text:style-name="P1"><text:span text:style-name="T1"/></text:p><text:p text:style-name="P1"><text:span text:style-name="T3">Hinweis: Die Aufgaben in den Blättern</text:span></text:p><text:p text:style-name="P1"><text:span text:style-name="T3">Kalender, Anwesenheit, Pausen, Überstunden, Sonntagsarbeit, Summen , Gesamt bauen aufeinander auf und sind in dieser Reihenfolge zu lösen.</text:span></text:p><draw:enhanced-geometry svg:viewBox="0 0 21600 21600" draw:type="mso-spt202" draw:enhanced-path="M 0 0 L 21600 0 21600 21600 0 21600 0 0 Z N"/></draw:custom-shape>
Comment 7 Andreas J. Guelzow 2013-07-17 18:23:11 UTC
Note that this may also be related to bug #704417.
Comment 8 Andreas J. Guelzow 2013-07-17 19:12:07 UTC
I have fixed the problem with the text import. The fact that the text is shown partially outside the does not look like an ODF import issue!
Comment 9 Andreas J. Guelzow 2013-07-17 19:39:28 UTC
We clearly fail to correctly place and wrap the text associated with a GNM_SO_PATH_TYPE.
Comment 10 Jean Bréfort 2013-07-17 19:59:15 UTC
Text wrapping is now fixed.
Comment 11 Andreas J. Guelzow 2013-07-18 03:33:16 UTC
Created attachment 249463 [details]
screenshot

The attached screenshot shows two issues:
1) The text should either be top and left aligned or vertically and horizontally centred. It is neither.
2)We probably should keep some margin to avoid the text to run into the lines.
Comment 12 Jean Bréfort 2013-07-18 12:43:30 UTC
Text alignment should work now. Actually, we do have margins, just they are set to 0.
Comment 13 Andreas J. Guelzow 2013-07-18 17:04:37 UTC
Created attachment 249550 [details]
screen shot

text is cut off on the right..
Comment 14 Jean Bréfort 2013-07-19 05:40:34 UTC
I can't reproduce the cut off. Did you update both goffice and gnumeric?
Comment 15 Andreas J. Guelzow 2013-07-19 06:53:44 UTC
Yes, both goffice and gnumeric are up-to-date and I can replicate the cut-off text problem.
Comment 16 Andreas J. Guelzow 2013-07-19 06:55:01 UTC
Note, cut-off only happens on-screen. It does not happen in the print preview.
Comment 17 Jean Bréfort 2013-07-19 08:13:27 UTC
Created attachment 249587 [details]
Screenshot

This is what I see on screen. The preview code is quite different, and was copied from the rectangle/ellipse file which is affected by the same size issue.
Comment 18 Jean Bréfort 2013-07-19 08:30:56 UTC
The print preview should now be correct (there might be some differences occasionally because the font metrics are not exactly the same and because the layout width might be slightly different when printing (by about 1%).
Comment 19 Morten Welinder 2013-07-20 23:49:01 UTC
Anything left here?
Comment 20 Andreas J. Guelzow 2013-07-21 05:29:08 UTC
Created attachment 249739 [details]
screenshot

This screenshot shows the difference between print preview and on screen with current git for both goffice and gnumeric. Note that the text on screen is partially cut off.
Comment 21 GNOME Infrastructure Team 2018-05-22 14:01:25 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to GNOME's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.gnome.org/GNOME/gnumeric/issues/227.