https://bugs.documentfoundation.org/show_bug.cgi?id=90409
Bug ID: 90409
Summary: [ssl] libreoffice core dumps because of network
content
Product: LibreOffice
Version: 4.3.5.2 release
Hardware: x86-64 (AMD64)
OS: OpenBSD
Status: UNCONFIRMED
Severity: critical
Priority: medium
Component: LibreOffice
Assignee: [email protected]
Reporter: [email protected]
(originally reported at OpenBSD ports mailing list -
http://marc.info/?t=142793609900001&r=1&w=2)
I have an user with old libreoffice config directory and when
I tried to open one document it core dumped. Later I discovered
it is not related to old config dir but to the document itself
and Internet networking part of LO.
The document has probably "embedded" some Internet stuff as I see
following output when started (soffice) from terminal.
Versions:
* libreoffice-4.3.5.2p0v0-debug-no_java (my rebuild to get debug
symbols)
* OpenBSD 5.7-current (GENERIC.MP) #895: Wed Mar 18 18:55:03 MDT 2015
Seems like problematic document is a text copied from a HTML page
with links inside and saved as doc document.
Reproduce steps were tricky:
1. problematic document
2. open soffice and open the file
== fail
1. problematic document
2. open soffice and check Internet in preferences, save
3. open the file
== fail
1. problematic document
2. open soffice and _define_ proxy in Internet in preferences,
save
3. open the file
== success :)
It passed in last one because it cannot connect to proxy server
(yeah, it was fake).
~~~
...
Doing DNS lookup on 127.0.0.1...
req: Connecting to 127.0.0.1:3128
Request ends, status 0 class 0xx, error line:
Could not connect to proxy server: Connection refused
Running destroy hooks.
...
Could not connect to proxy server: Connection refused
Running destroy hooks.
Request ends.
warn:unotools.misc:18209:21:unotools/source/misc/mediadescriptor.cxx:736:
caught \
Exception "" while opening \
<http://www.example.com/path1/path2/path3/path4/SvorkaL.gif>
sess: Destroying session.
~~~
(I anonymized uris a bit...)
The url (ending with 'SvorkaL.gif') is of course accessing normally
when using Firefox.
~~~
warn:legacy.osl:25616:1:sw/source/filter/ww8/ww8scan.cxx:1329: Can't create
these \
from the menus, please report HTTP session to http://www.example.com:80 begins.
Running pre_send hooks
Sending request headers:
PROPFIND /path1/path2/pat3/path4/Svorka.gif HTTP/1.1
Keep-Alive:
Connection: TE, Keep-Alive
TE: trailers
Host: www.example.com
Depth: 0
Content-Length: 237
Content-Type: application/xml
Pragma: no-cache
User-Agent: LibreOffice
Sending request-line and headers:
Doing DNS lookup on www.example.com...
req: Connecting to 148.xxx.xxx.xxx:80
Sending request body:
Request sent; retry is 0.
[status-line] < HTTP/1.1 302 Found
[hdr] Date: Thu, 02 Apr 2015 00:23:52 GMT
Header Name: [date], Value: [Thu, 02 Apr 2015 00:23:52 GMT]
[hdr] Server: Apache
Header Name: [server], Value: [Apache]
[hdr] Location: https://www.example.com/path1/path2/path3/path4/Svorka.gif
Header Name: [location], Value: \
[https://www.example.com/path1/path2/path3/path3/Svorka.gif] [hdr]
Cache-Control: \
max-age=604800 Header Name: [cache-control], Value: [max-age=604800]
[hdr] Expires: Thu, 09 Apr 2015 00:23:52 GMT
Header Name: [expires], Value: [Thu, 09 Apr 2015 00:23:52 GMT]
[hdr] Content-Length: 347
Header Name: [content-length], Value: [347]
[hdr] Keep-Alive: timeout=5, max=100
Header Name: [keep-alive], Value: [timeout=5, max=100]
[hdr] Connection: Keep-Alive
Header Name: [connection], Value: [Keep-Alive]
[hdr] Content-Type: text/html; charset=iso-8859-1
Header Name: [content-type], Value: [text/html; charset=iso-8859-1]
[hdr]
End of headers.
Running post_headers hooks
Reading 347 bytes of response body.
Got 347 bytes.
Running post_send hooks
Request ends, status 302 class 3xx, error line:
302 Found
Running destroy hooks.
Request ends.
sess: Destroying session.
HTTP session to https://www.example.com:443 begins.
ssl: SNI enabled by default.
Running pre_send hooks
Sending request headers:
PROPFIND /path1/path2/path3/path4/Svorka.gif HTTP/1.1
Keep-Alive:
Connection: TE, Keep-Alive
TE: trailers
Host: www.example.com
Depth: 0
Content-Length: 237
Content-Type: application/xml
Pragma: no-cache
User-Agent: LibreOffice
Sending request-line and headers:
Doing DNS lookup on www.example.com...
req: Connecting to 148.xxx.xxx.xxx:443
Doing SSL negotiation.
~~~
(Funny, gdb fails itself as well.)
~~~
Reading symbols from /usr/local/lib/libfreebl3.so.36.0...done.
Loaded symbols for /usr/local/lib/libfreebl3.so.36.0
#0 SHA512_Final (md=0x7f7ffffde390 "@�L]\227\031", c=0x1996759f2e00)
at /usr/src/lib/libcrypto/crypto/../../libssl/src/crypto/sha/sha512.c:102
102 /usr/src/lib/libcrypto/crypto/../../libssl/src/crypto/sha/sha512.c: No
such \
file or directory.
in /usr/src/lib/libcrypto/crypto/../../libssl/src/crypto/sha/sha512.c
(gdb) bt full
#0 SHA512_Final (md=0x7f7ffffde390 "@�L]\227\031", c=0x1996759f2e00) at \
/usr/src/lib/libcrypto/crypto/../../libssl/src/crypto/sha/sha512.c:102 p =
(unsigned \
char *) 0x1996759f2e50 "sp.usertrust.comU\003\006D0" n = 2264712071
#1 0x000019975d257cf3 in EVP_DigestFinal_ex (ctx=0x7f7ffffde350, md=Variable
"md" is \
not available. ) at
/usr/src/lib/libcrypto/crypto/../../libssl/src/crypto/evp/digest.c \
:257 ret = Variable "ret" is not available.
(gdb)
(gdb) bt
#0 SHA512_Final (md=0x7f7ffffde390 "@�L]\227\031", c=0x1996759f2e00) at \
/usr/src/lib/libcrypto/crypto/../../libssl/src/crypto/sha/sha512.c:102 #1 \
0x000019975d257cf3 in EVP_DigestFinal_ex (ctx=0x7f7ffffde350, md=Variable "md"
is not \
available. ) at
/usr/src/lib/libcrypto/crypto/../../libssl/src/crypto/evp/digest.c:257 \
#2 0x000019975d22d595 in EVP_DigestVerifyFinal (ctx=0x7f7ffffde420,
sig=0x19974f9f3100 \
"d�\203\232\205��)W\r�>\004np�\036<�M\rtj201\202%�*]L�\213�m\tu'\016
\
]\204y7@\023w�\034�\027\0224\030~+ӫWE\f�(�\225\210�205Wi}\222\201�\034�
\
nf\021\005�\036\224-\177\221\225\222YΣ\221qL|G\f;\v\031�l\206>\\�\202\a\226�H
\
M\220224ȩs�006{#\235ޢU\237zaE\230\030h@k#�yz214�k\213�oF...,
siglen=256) at \
/usr/src/lib/libcrypto/crypto/../../libssl/src/crypto/evp/m_sigver.c:188 #3 \
0x000019975d22d3e3 in ASN1_item_verify (it=0x19975d4c3a40, a=0x19975d4cb940, \
signature=0x19966776eec0, asn=0x19966439f280, pkey=Variable "pkey" is not
available. \
) at /usr/src/lib/libcrypto/crypto/../../libssl/src/crypto/asn1/a_verify.c:158
#4 0x000019975d228d53 in internal_verify (ctx=0x7f7ffffde590) at \
/usr/src/lib/libcrypto/crypto/../../libssl/src/crypto/x509/x509_vfy.c:1591 #5
\
0x000019975d22a445 in X509_verify_cert (ctx=0x7f7ffffde590) at \
/usr/src/lib/libcrypto/crypto/../../libssl/src/crypto/x509/x509_vfy.c:374 #6 \
0x000019975cd0dac0 in ssl_verify_cert_chain (s=0x19966e036800, sk=Variable "sk"
is \
not available. ) at /usr/src/lib/libssl/ssl/../../libssl/src/ssl/ssl_cert.c:459
#7 0x000019975cceec14 in ssl3_get_server_certificate (s=0x19966e036800) at \
/usr/src/lib/libssl/ssl/../../libssl/src/ssl/s3_clnt.c:1069 #8
0x000019975ccf006b in \
ssl3_connect (s=0x19966e036800) at \
/usr/src/lib/libssl/ssl/../../libssl/src/ssl/s3_clnt.c:353 #9
0x000019975cce3050 in \
ssl23_connect (s=0x19966e036800) at \
/usr/src/lib/libssl/ssl/../../libssl/src/ssl/s23_clnt.c:564 #10
0x000019975d7099cc in \
ne_sock_connect_ssl () from /usr/local/lib/libneon.so.29.0 #11
0x000019975d714049 in \
ne__negotiate_ssl () from /usr/local/lib/libneon.so.29.0 #12 0x000019975d703725
in \
send_request () from /usr/local/lib/libneon.so.29.0 #13 0x000019975d7029b1 in \
ne_begin_request () from /usr/local/lib/libneon.so.29.0 #14 0x000019975d7030ed
in \
ne_request_dispatch () from /usr/local/lib/libneon.so.29.0 #15
0x000019975d7104fd in \
propfind () from /usr/local/lib/libneon.so.29.0 #16 0x000019975d710e7f in \
ne_simple_propfind () from /usr/local/lib/libneon.so.29.0
Die: DW_TAG_unspecified_type (abbrev = 100, offset = 723619)
has children: FALSE
attributes:
DW_AT_name (DW_FORM_strp) string: "decltype(nullptr)"
Dwarf Error: Cannot find type of die [in module \
/usr/local/lib/libreoffice/program/libucpdav1.so] ~~~
j.
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
Libreoffice-bugs mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/libreoffice-bugs
