Issue 114245 - (potential) crash when opening the "Format" dialog for a database table column
Summary: (potential) crash when opening the "Format" dialog for a database table column
Alias: None
Product: gsl
Classification: Code
Component: code (show other issues)
Version: OOO330m6
Hardware: PC Windows, all
: P3 Trivial (vote)
Target Milestone: OOo 3.3
Assignee: Frank Schönheit
QA Contact: issues@gsl
: 109681 113209 (view as issue list)
Depends on:
Blocks: 111112
  Show dependency tree
Reported: 2010-09-01 08:27 UTC by Frank Schönheit
Modified: 2017-05-20 11:41 UTC (History)
4 users (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: ---
Developer Difficulty: ---

document to reproduce the bug case (3.29 KB, application/vnd.sun.xml.base)
2010-09-01 08:28 UTC, Frank Schönheit
no flags Details

Note You need to log in before you can comment on or make changes to this issue.
Description Frank Schönheit 2010-09-01 08:27:25 UTC
- open the attached database document
- open the contained table by double-clicking it
- open the context menu for the table column "n"
- choose "Column Format"
=> in a non-product build on Windows, you get multiple error messages from
   the "Microsoft Visual C++ Debug Library", saying "HEAP CORRUPTION DETECTED"

Ignoring all those messages, the "Field Format" dialog opens as expected.
However, the messages indicate a serious problem, which can potentially lead to
OOo crashing.
Comment 1 Frank Schönheit 2010-09-01 08:28:04 UTC
Created attachment 71515 [details]
document to reproduce the bug case
Comment 2 Frank Schönheit 2010-09-01 14:16:51 UTC
will investigate whether this is worth fixing for 3.3 ...
Comment 3 Frank Schönheit 2010-09-01 21:21:42 UTC
fs->hdu: The problem originates from vcl/win/source/gdi/winlayout.cxx. line 2206
  mpLogClusters[ k ] =
Now when you open the dialog as described above, then you'll reach this line
multiple times, but at least once, k equals -1, so this statement writes to
memory which it doesn't own ... The assertion from the MSVC runtime is then
fired in ~UniscribeLayout, when mpLogClusters is deleted.
Comment 4 Frank Schönheit 2010-09-01 21:25:32 UTC
Note: Assertions with the same stack can be seen when choosing Tools => Options
=> Language Settings => Languages. So, the problem is not limited to the dialog
invoked from within Base.
Comment 5 Frank Schönheit 2010-09-01 21:26:55 UTC
changing component to GSL
Comment 6 Frank Schönheit 2010-09-01 21:27:26 UTC
fs->pl: Since hdu is on vacation - any chance you look into this?
Comment 7 Frank Schönheit 2010-09-01 21:29:47 UTC
changing "Platform", since the bug is in Windows-specific code.
Comment 8 philipp.lohmann 2010-09-02 10:28:31 UTC
@fs: I know as much about that code as you. If you say there is a wrong index
the fix I'd do is checking that index; however hdu would probably also be able
to fix the root cause.
Comment 9 Frank Schönheit 2010-09-02 10:29:37 UTC
sad, I had hope you know this code ...
well, fixing the crash would indeed be easy, however, it would indeed be fixing
symptoms only ...
Comment 10 2010-09-07 11:15:50 UTC
Comment 11 2010-09-08 10:12:57 UTC
Excellent analysis, thanks!
Fixed in CWS ooo33gsl08.
Comment 12 2010-09-08 10:51:00 UTC
*** Issue 109681 has been marked as a duplicate of this issue. ***
Comment 13 2010-09-09 14:45:43 UTC
@fs: please dev-verify in CWS ooo33gsl08
Comment 14 Frank Schönheit 2010-09-13 15:20:59 UTC
verified in CWS ooo33gsl08
Comment 15 Edwin Sharp 2013-07-06 18:22:40 UTC
*** Issue 113209 has been marked as a duplicate of this issue. ***