197203 - crash if no '@' in From field address

Status: RESOLVED FIXED

(MailNews Core :: Composition, defect)

Description

[parish]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4a) Gecko/20030313 Netscape6/6.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4a) Gecko/20030313

If you use a munged anti-spam address without a '@' in it, Mozilla crashes shen
you click Send.

Reproducible: Always

Steps to Reproduce:
1. Edit your mail account e-mail address, or create a dummy account, and
replace/remove the '@', e.g. parish_AT_ntlworld.com

2. Compose a mail using the munged address for the From

3. Click Send or Send Later.


Actual Results:  
Mozilla crashes with an Access violation in msgcompo.dll

Note, this does not happen if you use such an address in the To:/Cc: fields.


Expected Results:  
Mail should be sent or saved in Unsent Messages.

Patch on it's way

Comment 1

[parish]

Attachment: Check for PL_strchr() returning a null ptr.

In msg_generate_message_id(), PL_strchr() returns a null ptr if no '@' in From
address. We don't check for this before incrementing it and passing to
isValidHost() where it crashes.

Comment 2

[Olivier Cahagne]

Marking NEW since it has a patch.

Comment 3

[Jean-Francois Ducarroz]

reassign to ssu

Comment 4

[Jean-Francois Ducarroz]

Comment on attachment 117085 [details] [diff] [review]
Check for PL_strchr() returning a null ptr.

R=ducarroz

Comment 5

[(not reading, please use [e-mail] instead)]

re-assign to [e-mail], since he as a patch.

I'll review and drive this in today, since it is a crasher.

Comment 6

[(not reading, please use [e-mail] instead)]

actually, the patch could just be:

if (host)
  ++host;

because right after that, we call if (!isValidHost(host)) and return if it 
isn't valid, and it will do the right thing if host is null.

I'll attach a modified patch.

Comment 7

[(not reading, please use [e-mail] instead)]

Attachment: modified patch

also, use strchr(), instead of PL_strchr() for performance reasons.

Comment 8

[(not reading, please use [e-mail] instead)]

parish, thanks for logging the bug and finding the fix.

I'll land the modified patch today.

assigning to 1.4 alpha, and marking "accepted" on parish's behalf.

Comment 9

[(not reading, please use [e-mail] instead)]

I've checked in the patch based on parish's initial patch.

Comment 10

[Matthias Versen [:Matti]]

*** Bug 198256 has been marked as a duplicate of this bug. ***

Comment 11

[Matthias Versen [:Matti]]

*** Bug 203375 has been marked as a duplicate of this bug. ***

Comment 12

[Matthias Versen [:Matti]]

*** Bug 205619 has been marked as a duplicate of this bug. ***