Repository: nvaccess/nvda

Issue:
Calling UIA custom pattern in some malformed Outlook messages causes the app to crash
<!-- Please read the text in this edit field before filling it in.
Please thoroughly read NVDA's wiki article on how to fill in this template, including how to provide the required files.
Issues may be closed if the required information is not present.
https://github.com/nvaccess/nvda/blob/master/devDocs/githubIssueTemplateExplanationAndExamples.md
Please also note that the NVDA project has a Citizen and Contributor Code of Conduct which can be found at https://github.com/nvaccess/nvda/blob/master/CODE_OF_CONDUCT.md. NV Access expects that all contributors and other community members read and abide by the rules set out in this document while participating or contributing to this project. This includes creating or commenting on issues and pull requests. 

Each of the questions and sections below start with multiple hash symbols (#). Place your answers and information on the blank line below each question.
-->

### Steps to reproduce:
1. Open an affected message in Outlook 16.0.15028.20050.
2. Press down arrow in the message body.

### Actual behavior:
Outlook crashes and the following is written to the log:

```
ERROR - NVDAHelperLocal (13:28:04.198) - MainThread (16740):
Thread 16740, build\x86\UIARemote\UIARemote.cpp, msWord_getCustomAttributeValue, 95:
Error in scope.Resolve: code -2147418113
DEBUGWARNING - scriptHandler.executeScript (13:28:04.218) - MainThread (16740):
error executing script: <bound method CursorManager.script_moveByLine_forward of <NVDAObjects.UIA.wordDocument.WordBrowseModeDocument object at 0x06EFECB0>> with gesture 'down arrow'
Traceback (most recent call last):
  File "scriptHandler.pyc", line 212, in executeScript
  File "cursorManager.pyc", line 256, in script_moveByLine_forward
  File "cursorManager.pyc", line 163, in _caretMovementScriptHelper
  File "baseObject.pyc", line 26, in __get__
  File "treeInterceptorHandler.pyc", line 212, in _get_isCollapsed
  File "baseObject.pyc", line 26, in __get__
  File "textInfos\__init__.pyc", line 449, in _get_isCollapsed
  File "NVDAObjects\UIA\__init__.pyc", line 909, in compareEndPoints
  File "monkeyPatches\comtypesMonkeyPatches.pyc", line 32, in __call__
_ctypes.COMError: (-2147220991, 'An event was unable to invoke any of the subscribers', (None, None, None, 0, None))
DEBUG - speech.sayAll._TextReader.nextLine (13:28:04.220) - MainThread (16740):
no self.reader
DEBUGWARNING - NVDAObjects.IAccessible.IAccessible._get_IAccessibleRole (13:28:04.298) - MainThread (16740):
accRole failed: (-2147024809, 'The parameter is incorrect.', (None, None, None, 0, None))
DEBUG - appModuleHandler.cleanup (13:28:04.303) - MainThread (16740):
application outlook closed
DEBUG - treeInterceptorHandler.killTreeInterceptor (13:28:04.314) - MainThread (16740):
Killed treeInterceptor: <NVDAObjects.UIA.wordDocument.WordBrowseModeDocument object at 0x06EFECB0>
```

### Expected behavior:
No app crash.

### System configuration
#### NVDA installed/portable/running from source:
Installed

#### NVDA version:
Commit c8d96591.

#### Windows version:
Windows 11 (22000.556).

#### Name and version of other software in use when reproducing the issue:
Outlook.

#### Other information about your system:

### Other questions
#### Does the issue still occur after restarting your computer?
N/A
#### Have you tried any other versions of NVDA? If so, please report their behaviors.
N/A (custom patterns new to 2022.1).
#### If NVDA add-ons are disabled, is your problem still occurring?
N/A
#### Does the issue still occur after you run the COM Registration Fixing Tool in NVDA's tools menu?
N/A (UIA issue)


Discussion:
CC @michaelDCurran.
It appears that commit 8220d6c3 does not exhibit this crash.
@codeofdusk  It would be great if you could track down the exact call from NvDA (Python code) that did this. My hunch is that it is when fetching section number. If so, we could easily refuse to fetch this for Outlook messages which I don't think would hurt users too much. However, this may also be true for fetching line numbers as well... in that case, we should not try fetching custom attributes in Outlook messages at all... 

Resolving patch:
diff --git a/source/NVDAObjects/UIA/wordDocument.py b/source/NVDAObjects/UIA/wordDocument.py
--- a/source/NVDAObjects/UIA/wordDocument.py
+++ b/source/NVDAObjects/UIA/wordDocument.py
@@ -438,11 +438,15 @@ def _getFormatFieldAtRange(self, textRange, formatConfig, ignoreMixedValues=Fals
 				)
 				if isinstance(sectionNumber, int):
 					formatField.field['section-number'] = sectionNumber
-				textColumnNumber = UIARemote.msWord_getCustomAttributeValue(
-					docElement, textRange, UIACustomAttributeID.COLUMN_NUMBER
-				)
-				if isinstance(textColumnNumber, int):
-					formatField.field['text-column-number'] = textColumnNumber
+				if False:
+					# #13511: Fetching of text-column-number is disabled
+					# as it causes Microsoft Word 16.0.1493 and newer to crash!!
+					# This should only be reenabled for versions identified not to crash.
+					textColumnNumber = UIARemote.msWord_getCustomAttributeValue(
+						docElement, textRange, UIACustomAttributeID.COLUMN_NUMBER
+					)
+					if isinstance(textColumnNumber, int):
+						formatField.field['text-column-number'] = textColumnNumber
 		return formatField
 
 


Test patch: