Issue 128310 - Windows explorer crashes when opening specific file
Summary: Windows explorer crashes when opening specific file
Status: CONFIRMED
Alias: None
Product: General
Classification: Code
Component: ui (show other issues)
Version: 4.1.7
Hardware: PC Windows, all
: P5 (lowest) Major (vote)
Target Milestone: 4.2.0
Assignee: AOO issues mailing list
QA Contact:
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2020-02-28 13:40 UTC by Juris
Modified: 2021-02-25 14:06 UTC (History)
2 users (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: 4.1.9
Developer Difficulty: ---


Attachments
System generated OO file (9.17 KB, application/vnd.oasis.opendocument.text)
2020-02-28 13:40 UTC, Juris
no flags Details
ODT opened and saved with AOO 4.1.7 on Ubuntu (20.21 KB, application/vnd.oasis.opendocument.text)
2020-02-28 17:08 UTC, Matthias Seidel
no flags Details

Note You need to log in before you can comment on or make changes to this issue.
Description Juris 2020-02-28 13:40:15 UTC
Created attachment 86862 [details]
System generated OO file

I have a system which generates .odt files. For some time they (.odt files) worked fine, but in current Windows 10 releases when I download system generated .odt file and try to open, Windows Explorer crashes. I try to open these files right away from browser (Google Chrome and FF). Same happens on 3 Windows 10 machines. In one I could open this file when I run OpenOffice separate and then Open from File menu. On other 2 machines as soon as I even open Folder where file is located, Windows Explorer crashes.

I have found out, reading LibreOffice similar issues, that there is a workaround. As soon as I modify OpenOffice installation and uninstall Windows Explorer Extensions all works as expected. This is happening on v4.1.2 till 4.1.7
Comment 1 Matthias Seidel 2020-02-28 17:07:54 UTC
Can you give more details about the system that is generating these ODT files?

Looking at the file with an archive viewer it is missing two folders:
 - Thumbnails
 - Configurations2

I am no expert in OpenDocument Format, but I would say this generated document is not valid. At least it is missing the Thumbnails folder which the Windows Shell Extension is probably looking for.

I opened your file on Ubuntu and saved it right away. With this file I have no problems on Windows (see attachement).
Comment 2 Matthias Seidel 2020-02-28 17:08:35 UTC
Created attachment 86863 [details]
ODT opened and saved with AOO 4.1.7 on Ubuntu
Comment 3 Matthias Seidel 2020-02-28 17:29:09 UTC
Did some further tests and deleted the two mentioned folders from my saved document. I even deleted "manifest.rdf" (which is also missing in your file).

Still no problems on Windows...

I think we really need more info about the system that generates the files.
Comment 4 Matthias Seidel 2020-02-28 23:37:21 UTC
The crash occurs when Explorer wants to display the AOO Infotips for the file.

Removing the Windows Explorer Extension is one workaround.
Even opening the file with a double click anywhere else than on the filename in the File Open Dialog will work.

Most likely the problem is in this code:
https://github.com/apache/openoffice/blob/trunk/main/shell/source/win32/shlxthandler/infotips/infotips.cxx

But at this point a developer must take over...
Comment 5 damjan 2020-02-28 23:53:59 UTC
(In reply to Matthias Seidel from comment #4)
> The crash occurs when Explorer wants to display the AOO Infotips for the
> file.
> 
> Removing the Windows Explorer Extension is one workaround.
> Even opening the file with a double click anywhere else than on the filename
> in the File Open Dialog will work.
> 
> Most likely the problem is in this code:
> https://github.com/apache/openoffice/blob/trunk/main/shell/source/win32/
> shlxthandler/infotips/infotips.cxx
> 
> But at this point a developer must take over...

---snip---
std::wstring formatSizeOfFile( DWORD dwSize )
{
	if ( dwSize < 1000 ) 
	{
		char buffer[3];
		int dFileSize = dwSize;
		
		_itoa( dFileSize, buffer, 10 );
---snip---

If 100 <= dwSize <= 999, that's a buffer overflow, as buffer has only 3 chars, and we need a 4th char to store the terminating '\0'.

There could be other problems I don't immediately see. Is there a way to get a stack trace when this error happens?
Comment 6 Matthias Seidel 2020-02-29 10:49:08 UTC
Unfortunately all I can see in Windows log files is the crash of Explorer.
Maybe Patricia can give more details once she has set up her build environment.

BTW: Confirmed on Windows 7 32-bit, so setting the issue to "Windows, all"
Comment 7 Matthias Seidel 2020-02-29 19:39:34 UTC
I was now able to generate a Windows Crash Dump (explorer.exe):

https://home.apache.org/~mseidel/Issue%20128310/explorer.exe.3920.dmp

Hopefully someone can get useful information from it.
Comment 8 Juris 2020-03-01 19:19:42 UTC
(In reply to Matthias Seidel from comment #3)
> Did some further tests and deleted the two mentioned folders from my saved
> document. I even deleted "manifest.rdf" (which is also missing in your file).
> 
> Still no problems on Windows...
> 
> I think we really need more info about the system that generates the files.

Files are generated using JasperServer API. If some more details are needed I can probably get them.
Comment 9 Matthias Seidel 2020-03-01 21:54:51 UTC
Thank you for the info!

However, even if the document wouldn't be valid (which I think is not the case) the Extension (namely: Infotips) should not crash Explorer.

Thank you for finding that, we have to investigate further...
Comment 10 Matthias Seidel 2021-02-25 14:06:09 UTC
The crash occurs, when hovering with the mouse over the filename in Windows Explorer.

At this point "infotips" should be displayed. For OpenDocument files this is part of our ShellExtension (if installed):

https://github.com/apache/openoffice/tree/trunk/main/shell/source/win32/shlxthandler/infotips