[Libreoffice-bugs] [Bug 48640] New: LibreOffice 3.5.2.2 - soffice.exe\soffice.bin Denial of service and memory corruption

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=48640

             Bug #: 48640
           Summary: LibreOffice 3.5.2.2 - soffice.exe\soffice.bin Denial
                    of service and memory corruption
    Classification: Unclassified
           Product: LibreOffice
           Version: LibO 3.5.2 Release
          Platform: x86 (IA32)
        OS/Version: Linux (All)
            Status: UNCONFIRMED
          Severity: normal
          Priority: medium
         Component: Writer
        AssignedTo: libreoffice-bugs at lists.freedesktop.org
        ReportedBy: shinnai at autistici.org


Created attachment 59900
  --> https://bugs.freedesktop.org/attachment.cgi?id=59900
Crash PoC

Both on Windows and Linux it is possible to cause a Dos and\or a memory
corruption using crafted doc files (see attachments).
On Fedora core 16 the program crash as follow:

terminate called after throwing an instance of 'std::bad_alloc'
  what(): std::bad_alloc

Program received signal SIGABRT, Aborted.
0X00111416 in __kernel_vsyscall ()

Regards

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.