Bug#761226: libreoffice-writer: Segmentation fault on special document content/input

[Rene Engelhard <rene@debian.org>]

tag 761226 + confirmed
thanks

Hi,

On Thu, Sep 11, 2014 at 04:55:47PM -0400, Jason Rhinelander wrote:
> libreoffice-writer will segfault when a file contains content such as:
> 
> (1)(2)(3)aa
> 
> This can be in an existing file being opened, or simply typed or pasted into a
> blank document.
> 

Indeed :/ (Tried by typing it into a blank document)

> Variations I've tried that also trigger the segfault:
> 
> - Adding spaces around (before, between, and after) the parenthesized values.
> - changing the 1,2,3 values to any other numbers.
> - adding more numbers (parenthesized or not) between "(3)" and "aa".
> 
> Variations that avoid the segfault:
> 
> - Changing any of the 1,2,3 values to non-numeric values.
> - Making the trailing content consist of a single letter.  (The segfault occurs
> in the original example only when something follows the first "a".)
> - Prior content on the line.  e.g. a line with "a(1)(2)(3)aa" seems okay.
> - Making the trailing content consist only of numbers (whether or not
> parenthesized).  Neither "(1)(1)(1) 42 56 12345" nor "(1)(1)(1)(42)" trigger
> the segfault, but "(1)(1)(1) 42 56 12345 aa" does.
> 
> 
> A backtrace is attached.

Thanks for those infos. Will forward upstream.

Or maybe not, seems to work for me in 4.3.2 rc1...

Regards,

Rene