Issue 128310 - Windows explorer crashes when opening specific file
Summary: Windows explorer crashes when opening specific file
Status: CONFIRMED
Alias: None
Product: General
Classification: Code
Component: ui (show other issues)
Version: 4.1.7
Hardware: PC Windows, all
: P5 (lowest) Major (vote)
Target Milestone: ---
Assignee: AOO issues mailing list
QA Contact:
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2020-02-28 13:40 UTC by Juris
Modified: 2020-04-28 11:35 UTC (History)
2 users (show)

See Also:
Issue Type: DEFECT
Latest Confirmation in: ---
Developer Difficulty: ---


Attachments
System generated OO file (9.17 KB, application/vnd.oasis.opendocument.text)
2020-02-28 13:40 UTC, Juris
no flags Details
ODT opened and saved with AOO 4.1.7 on Ubuntu (20.21 KB, application/vnd.oasis.opendocument.text)
2020-02-28 17:08 UTC, Matthias Seidel
no flags Details

Note You need to log in before you can comment on or make changes to this issue.
Description Juris 2020-02-28 13:40:15 UTC
Created attachment 86862 [details]
System generated OO file

I have a system which generates .odt files. For some time they (.odt files) worked fine, but in current Windows 10 releases when I download system generated .odt file and try to open, Windows Explorer crashes. I try to open these files right away from browser (Google Chrome and FF). Same happens on 3 Windows 10 machines. In one I could open this file when I run OpenOffice separate and then Open from File menu. On other 2 machines as soon as I even open Folder where file is located, Windows Explorer crashes.

I have found out, reading LibreOffice similar issues, that there is a workaround. As soon as I modify OpenOffice installation and uninstall Windows Explorer Extensions all works as expected. This is happening on v4.1.2 till 4.1.7
Comment 1 Matthias Seidel 2020-02-28 17:07:54 UTC
Can you give more details about the system that is generating these ODT files?

Looking at the file with an archive viewer it is missing two folders:
 - Thumbnails
 - Configurations2

I am no expert in OpenDocument Format, but I would say this generated document is not valid. At least it is missing the Thumbnails folder which the Windows Shell Extension is probably looking for.

I opened your file on Ubuntu and saved it right away. With this file I have no problems on Windows (see attachement).
Comment 2 Matthias Seidel 2020-02-28 17:08:35 UTC
Created attachment 86863 [details]
ODT opened and saved with AOO 4.1.7 on Ubuntu
Comment 3 Matthias Seidel 2020-02-28 17:29:09 UTC
Did some further tests and deleted the two mentioned folders from my saved document. I even deleted "manifest.rdf" (which is also missing in your file).

Still no problems on Windows...

I think we really need more info about the system that generates the files.
Comment 4 Matthias Seidel 2020-02-28 23:37:21 UTC
The crash occurs when Explorer wants to display the AOO Infotips for the file.

Removing the Windows Explorer Extension is one workaround.
Even opening the file with a double click anywhere else than on the filename in the File Open Dialog will work.

Most likely the problem is in this code:
https://github.com/apache/openoffice/blob/trunk/main/shell/source/win32/shlxthandler/infotips/infotips.cxx

But at this point a developer must take over...
Comment 5 damjan 2020-02-28 23:53:59 UTC
(In reply to Matthias Seidel from comment #4)
> The crash occurs when Explorer wants to display the AOO Infotips for the
> file.
> 
> Removing the Windows Explorer Extension is one workaround.
> Even opening the file with a double click anywhere else than on the filename
> in the File Open Dialog will work.
> 
> Most likely the problem is in this code:
> https://github.com/apache/openoffice/blob/trunk/main/shell/source/win32/
> shlxthandler/infotips/infotips.cxx
> 
> But at this point a developer must take over...

---snip---
std::wstring formatSizeOfFile( DWORD dwSize )
{
	if ( dwSize < 1000 ) 
	{
		char buffer[3];
		int dFileSize = dwSize;
		
		_itoa( dFileSize, buffer, 10 );
---snip---

If 100 <= dwSize <= 999, that's a buffer overflow, as buffer has only 3 chars, and we need a 4th char to store the terminating '\0'.

There could be other problems I don't immediately see. Is there a way to get a stack trace when this error happens?
Comment 6 Matthias Seidel 2020-02-29 10:49:08 UTC
Unfortunately all I can see in Windows log files is the crash of Explorer.
Maybe Patricia can give more details once she has set up her build environment.

BTW: Confirmed on Windows 7 32-bit, so setting the issue to "Windows, all"
Comment 7 Matthias Seidel 2020-02-29 19:39:34 UTC
I was now able to generate a Windows Crash Dump (explorer.exe):

https://home.apache.org/~mseidel/Issue%20128310/explorer.exe.3920.dmp

Hopefully someone can get useful information from it.
Comment 8 Juris 2020-03-01 19:19:42 UTC
(In reply to Matthias Seidel from comment #3)
> Did some further tests and deleted the two mentioned folders from my saved
> document. I even deleted "manifest.rdf" (which is also missing in your file).
> 
> Still no problems on Windows...
> 
> I think we really need more info about the system that generates the files.

Files are generated using JasperServer API. If some more details are needed I can probably get them.
Comment 9 Matthias Seidel 2020-03-01 21:54:51 UTC
Thank you for the info!

However, even if the document wouldn't be valid (which I think is not the case) the Extension (namely: Infotips) should not crash Explorer.

Thank you for finding that, we have to investigate further...