Bug 135195

Summary: FILEOPEN DOCX Specific chart makes Writer use all memory
Product: LibreOffice Reporter: NISZ LibreOffice Team <libreoffice>
Component: ChartAssignee: Not Assigned <libreoffice-bugs>
Status: NEW ---    
Severity: normal CC: 79045_79045, nemeth, tundeth, varga.balazs3, xiscofauli
Priority: medium Keywords: bibisected, bisected, perf, regression
Version: 5.3.0.3 release   
Hardware: All   
OS: All   
Whiteboard:
Crash report or crash signature: Regression By:
Bug Depends on:    
Bug Blocks: 75057    
Attachments: Example file from Word
Screenshot of the original document side by side in Word and Writer 5.2
Opening the document in Writer
Screenshot of the problem in Writer
Opening the file in a 32 bit build
Reproducer example made in Excel 13

Description NISZ LibreOffice Team 2020-07-27 12:22:25 UTC
Created attachment 163622 [details]
Example file from Word

Attached user made file contains a column chart.
Opening this file in Writer causes the processor and memory use to skyrocket until memory is exhausted.

Steps to reproduce:
1.	Open attached file

Actual results:
Writer stops answering, uses huge amount of memory and after a few minutes opens the document without the chart data, with only an empty chart.

Expected results:
File opens correctly.

LibreOffice details:
Version: 7.1.0.0.alpha0+ (x64)
Build ID: <buildversion>
CPU szálak: 4; OS: Windows 6.3 Build 9600; Felületmegjelenítés: alapértelmezett; VCL: win
Locale: hu-HU (hu_HU); UI: hu-HU
Calc: CL

Also happens in:
Version: 5.3.0.3
Build ID: 7074905676c47b82bbcfbea1aeefc84afe1c50e1
CPU Threads: 4; OS Version: Windows 6.2; UI Render: GL; Layout Engine: new; 
Locale: en-US (hu_HU); Calc: CL

But not yet in:
Version: 5.2.0.4
Build ID: 066b007f5ebcc236395c7d282ba488bca6720265
CPU Threads: 4; OS Version: Windows 6.2; UI Render: default; 
Locale: en-US (hu_HU)

Additional Information: 

Bibisected using bibisect-win32-5.3 to: 

URL: https://cgit.freedesktop.org/libreoffice/core/commit/?id=4bcf1872bbe9db1388769485a7e4c0cbcce3d53c 
author	Jean-Tiare Le Bigot <admin@jtlebi.fr>	2016-10-13 23:43:41 +0200
committer	Markus Mohrhard <markus.mohrhard@googlemail.com>	2016-11-06 06:02:27 +0000

chartx: fix sparse chart import
Comment 1 NISZ LibreOffice Team 2020-07-27 12:22:46 UTC
Created attachment 163623 [details]
Screenshot of the original document side by side in Word and Writer 5.2
Comment 2 NISZ LibreOffice Team 2020-07-27 12:23:10 UTC
Created attachment 163624 [details]
Opening the document in Writer
Comment 3 NISZ LibreOffice Team 2020-07-27 12:23:41 UTC
Created attachment 163625 [details]
Screenshot of the problem in Writer
Comment 4 NISZ LibreOffice Team 2020-07-27 12:24:19 UTC
Created attachment 163626 [details]
Opening the file in a 32 bit build

Version: 7.1.0.0.alpha0+ (x86)
Build ID: 0d45380c99c7200075d01860a2315d0ddb450f1c
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: hu-HU (hu_HU); UI: en-US
Calc: CL

gives a very different error message
Comment 5 NISZ LibreOffice Team 2020-09-15 16:16:27 UTC
Created attachment 165545 [details]
Reproducer example made in Excel 13

Here is an example for how to break this:
- In Excel create a chart with some data
- In the Select Data Source dialog of Excel edit the range for the horizontal (category) axis. In the small Axis Labels dialog go to A2 and select a range until the end of data by pressing Ctrl-Shift-DOWN. But oh no, press DOWN twice so it does not select to the end of data, but to the end of the sheet. So the field shows =Munka1!$A$2:$A$1048576 - no problem, Excel can handle this just fine.
- Copy the resulting chart to Word. Save as DOCX. This will generate something like this in chart1.xml:
					<c:cat>
						<c:numRef>
							<c:f>Munka1!$A$2:$A$1048576</c:f>
							<c:numCache>
								<c:formatCode>d\-mmm</c:formatCode>
								<c:ptCount val="1048575"/>


Now Writer uses this ptCount value to try to determine how many rows the internal data table of the chart should have. 1 million rows is too much for it, so we should not believe this number to be true.
This happens on MSO 2010 / 13.
The actual number of c:pt tags could be a more accurate estimate.
Comment 6 Xisco Faulí 2020-12-07 17:54:08 UTC
reproduced in

Version: 7.2.0.0.alpha0+
Build ID: 84af20ef3ea72190784e9e7be820684c2558ba8c
CPU threads: 4; OS: Linux 5.7; UI render: default; VCL: gtk3
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded
Comment 7 Roman Kuznetsov 2021-09-25 14:57:52 UTC
I saw two memory leaks while saw opening process , both around 1,8 Gb

LO opens the file, but chart is empty

So still repro in

Version: 7.3.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: 1516711eb7861a08cc9fd19ec867360737a6d070
CPU threads: 4; OS: Windows 10.0 Build 19043; UI render: Skia/Vulkan; VCL: win
Locale: ru-RU (ru_RU); UI: en-US
Calc: threaded
Comment 8 Roman Kuznetsov 2022-01-07 15:21:02 UTC
Still repro in

Version: 7.4.0.0.alpha0+ (x64) / LibreOffice Community
Build ID: 1be170d0629cf761f0ee4173007a3c021966546e
CPU threads: 4; OS: Windows 6.1 Service Pack 1 Build 7601; UI render: Skia/Raster; VCL: win
Locale: ru-RU (ru_RU); UI: en-US
Calc: CL
Comment 9 Faisal 2024-01-05 18:14:09 UTC
Repro in

Version: 7.6.4.1 (X86_64) / LibreOffice Community
Build ID: 60(Build:1)
CPU threads: 4; OS: Linux 6.1; UI render: default; VCL: kf5 (cairo+wayland)
Locale: en-GB (en_US.UTF-8); UI: en-US
7.6.4-2
Calc: threaded