116798 - Opening IMAP mail hangs Mail program (and Mozilla)

Status: RESOLVED FIXED

(Core :: Networking, defect, P1)

Description

[Ram Rao]

Every couple of weeks I get an administrative mail message from a mailing list.
 Whenever I try to access this mail off an Exchange IMAP server, the mail
program hangs, and Mozilla has to be killed and restarted.  This is reproducible.

I have forwarded this message (using Outlook) to a Cyrus IMAP server running on
Tru64 UNIX.  Accessing this forwarded message from the Cyrus IMAP server causes
the hang once again.

This message that causes Mozilla problems has been successfully accessed off
Exchange using the Evolution 1.0 IMAP client on Linux.

Would be glad to forward the troublesome mail to an IMAP mail server for your
testing.  Please give me an address to forward it to.

Thanks for a great IMAP client!  Inspite of this problem, it is by far the most
robust IMAP client I have found on Linux.

Ram Rao
[e-mail]

Comment 1

[Matthias Versen [:Matti]]

Reporter:
Can you try to access your mail with disabled Java plugin ?
(Edit\preferences\advanced)

Comment 2

[Ram Rao]

Disabled Java plugin.  Accessing mail still hangs Mozilla.

Comment 3

[Matthias Versen [:Matti]]

Can you attach this message in this bug ?
(http://bugzilla.mozilla.org/attachment.cgi?bugid=116798&action=enter)

Comment 4

[Ram Rao]

Attachment: Content of mail that causes hang

I was able to reproduce the problem by including the contents of this
attachment as the body of a message to myself.

Comment 5

[Ram Rao]

I accessed the imap server that Matthias Versen had installed my problematic
mail on.  Once again my Mozilla 0.9.7 hung as I tried to access the mail.

Comment 6

[Kervin]

The offending line in the message is 

   replace the "=" with an "@". Then send a message to [e-mail]

Mozilla chokes on the "@". I believe ( I hope it doesn't crash the browser as
well :), trying to convert it to and email address.

I verified this by remove this line from the email message, using a editor to
the Inbox file and restarting.  The mail no longer was a problem.

I will include a full backtrace.  I started under gdb and Ctrl+C'ed when it went
into the loop in nsReadingIterator<unsigned short>::advance(int) in
nsStringIterator.h:372 .  This happens about frame 9

I'm running a two day old CVS build as of right now ( I don't have my build ID)

[mozilla@bashful mozilla]$ uname -a
Linux bashful 2.4.7-10 #1 Thu Sep 6 17:27:27 EDT 2001 i686 unknown
[mozilla@bashful mozilla]$ gcc -v
Reading specs from /usr/lib/gcc-lib/i686-pc-linux-gnu/3.0.2/specs
Configured with: /tmp/gcc-3.0.2/configure --prefix=/usr
Thread model: single
gcc version 3.0.2
[mozilla@bashful mozilla]$ more .mozconfig
ac_add_options --prefix=/usr/local/mozilla
ac_add_options --enable-extensions=default,irc
ac_add_options --enable-leaky
ac_add_options --enable-jprof
ac_add_options --enable-xpctools
ac_add_options --enable-optimize=-O2
ac_add_options --enable-crypto
ac_add_options --disable-strip

Comment 7

[Kervin]

Attachment: mozilla backtrace

Session backtrace

Comment 8

[Matthias Versen [:Matti]]

-> Browser Networking (mozTXTToHTMLConv)
(CC  [e-mail])

Comment 9

[neeti]

cc'ing darin

Comment 10

[Doug Turner (:dougt)]

let see if we can fix this for .99  

Comment 11

[David :Bienvenu]

I tried this with the 2002010903 build and didn't hang. Perhaps this has been
fixed? Can someone else try it with a more recent build?

Comment 12

[Denis Antrushin]

I hanged with latest build with the following assertion running all over the screen:

###!!! ASSERTION: Infinite loop: can't advance a reading iterator beyond the end
of a string: 'one_hop>0', file ../../../dist/include/string/nsStringIterator.h,
line 174
###!!! Break: at file ../../../dist/include/string/nsStringIterator.h, line 174

Comment 13

[Denis Antrushin]

Attachment: suggested patch, v1

Comment 14

[neeti]

Darin: Could you review the patch?

Comment 15

[Darin Fisher]

Comment on attachment 65646 [details] [diff] [review]
suggested patch, v1

sr=darin, please seek review from someone on the mailnews team as well.

Comment 16

[David :Bienvenu]

Comment on attachment 65646 [details] [diff] [review]
suggested patch, v1

Would it be possible/correct to fix FindUrlStart and FindUrlEnd not to return
TRUE in these cases, instead of changing the caller? Even though there is
currently only one caller of these routines, it seems wrong to make all the
potential callers check if the returned pos is correct. Or am I
misunderstanding this patch? I realize the code is very very difficult to
decipher.

Comment 17

[Darin Fisher]

bienvenu: it's possible... let me investigate this some more.

Comment 18

[Denis Antrushin]

I didn't move those checks into FindUrlXXX just because I wasn't 100% sure
I fully understood the code. (My initial intention was to include them
there, but I was confised the fact that some |case|es has such a check,
but others not....

Comment 19

[Denis Antrushin]

Attachment: suggested patch, v2

moved boundary checks into FindURL(Start|End).

Comment 20

[David :Bienvenu]

Comment on attachment 68314 [details] [diff] [review]
suggested patch, v2

r=bienvenu, thx

Comment 21

[Darin Fisher]

Comment on attachment 68314 [details] [diff] [review]
suggested patch, v2

sr=darin ... i'll check this in once the tree opens.

Comment 22

[Darin Fisher]

fixed-on-trunk