Bug 45209

NOT reproducible as a general problem with "LibreOffice 3.5.4.2  German UI/Locale [Build-ID: 165a79a-7059095-e13bb37-fef39a4-9503d18] on German WIN7 Home Premium (64bit) 

@reporter:
Thank you for your report – unfortunately important information is missing.
May be hints on <http://wiki.documentfoundation.org/BugReport> will help you to find out what information will be useful to reproduce your problem? If you believe that that  is really sophisticated please as for Help on a user mailing list
Please:
- Write a meaningful Summary describing exactly what the problem is
- Send a sample document to me
- Contribute a step by step instruction containing every key press and every 
  mouse click how to reproduce your problem (due to example in Bug 43431)
– if possible contribute an instruction how to create a sample document 
  from the scratch
- add information 
  -- concerning your PC (video card, ...)
  -- concerning your OS (Version, Distribution, Language)
  -- concerning your LibO (UI language, Locale setting)
  –- Libo settings that might be related to your problems 
    (video hardware acceleration ...)
  -- how you launch LibO and how you opened the sample document
  -- everything else crossing your mind after you read linked texts

Even if you can not provide all demanded information, every little new information might bring the breakthrough.

May be you can test <https://www.libreoffice.org/get-help/bug/> for submitting bug reports? You reach that Bug Submission Assistant via LibO menu 'Help -> Feedback / Bug Report'

As I said in my comment, I cannot publicly send you that file.
Please check your email, I'm sending you file in question.

As you will notice, it doesn't open, even with latest LO.
Windows XP SP3, LO 3.5.4.2
LO just crashes without opening file and without any crash messages.

[Reproducible] with reporter's confidential document Server Installation of  "LibreOffice 3.6.0beta1  German UI/Locale [Build-ID: 1f1cdd8] on German WIN7 Home Premium (64bit) and
LigO 3.4.5 (others not tested)

Worked fine with 3.3.3, so regression

Unfortunately the crash disappears when I simply save the document from 3.3.3, so that I can not do further tests what the reason for the crash might be.

@Mikeyy:
We will not publish your sample, but I will have to forward it to a handful of developers for bugfix, bugfix reviews, ...
Do you agree that I send it to involved developers?

Yes.

Already [Reproducible] with "LibreOffice Daly based on 3.4.2 RC - WIN7  Home Premium (64bit) German UI [OOO340m1 (Build:201) from libreoffice-3-4~2011-07-22_15.35.00_LibO_3.4.2rc1_Win_x86_install_multi.exe]"  from 2011-07-23. 
It seems problem came with 3.4.

@Kohei:
Please set Status to ASSIGNED and add yourself to "Assigned To" if you accept this Bug. You can get the confidential sample document from reporter or from me.

I suppose I'll take this one. Kohei is still not here and 3-6Beta3 is only one week away.

File does neither crash my OpenSuse 3.4.5 build nor my master build with dgbutil.

I'll run it once with memcheck to check that there are no hidden memory problems.

Wow. Memcheck is badly complaining. There are quite some invalid memory access while loading this document.

Will need to understand them before I can start fixing them.

Problem is the SvMemoryStream inside of XclImpChangeTrack::ReadFormula. This seems to be initialized wrongly and then all future access to this memory stream is invalid.

Markus Mohrhard committed a patch related to this issue.
It has been pushed to "master":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=1b57e80858dd61986bea6da7358d9f8433d9685e

prevent invalid memory when loading change tracking from xls, fdo#45209

I have no idea how that ever worked. The code is obviously wrong and operates on invalid memory if the file is broken. The problem here was that at some point we were only able to load 245 from 847 bytes but still used all 847 bytes to generate formulas.

I hope that this fix prevents the crash. I'm not sure because I did not see a crash myself, only entries generated by memcheck.

Markus Mohrhard committed a patch related to this issue.
It has been pushed to "libreoffice-3-6":

http://cgit.freedesktop.org/libreoffice/core/commit/?id=b45e528cb70d1f908b8ff6ec156ac1a816287075&g=libreoffice-3-6

prevent invalid memory when loading change tracking from xls, fdo#45209


It will be available in LibreOffice 3.6.

Please test with a master build and/or a 3.6.0RC1 build and report if it is still broken.

Tried to test with 3.6.0.1 but installation has error, cannot start LO after install. I'll try to test again in few days or with RC2.

Finally managed to get around bug 51252 and run LO 3.6
File is loading fine, but now I have more material for bug report since it has more info then excel has. :)

Thanks for bug fix.