207798 - Mail crashes when moving mail between folders

Status: RESOLVED FIXED

(MailNews Core :: Database, defect)

Description

[Andrew Schultz]

I received 3 messages.  2 were marked junk and Mozilla attempted to move them to
the junk folder.  That crashed Mozilla.  Further investigation shows that almost
any moving of messages bewteen folders results in a crash (it might have worked
once).

All of this was happening with a POP account (local folders)

This regressed between linux trunk 2003053005 and 2003053104.  backing out bug
206473 fixed it.

Comment 1

[Andrew Schultz]

Attachment: stacktrace

Comment 2

[David :Bienvenu]

probably linux-specific - I haven't seen this on Windows at all. I'll try it on
Linux. Unfortunately, that stack trace doesn't tell me which call to memchr is
causing the problem.

Comment 3

[David :Bienvenu]

Attachment: proposed fix

this is just a guess as to what's going wrong. I'll try this patch on linux. If
you want to try it yourself (after unbacking out the fix you backed out, that
would be helpful). thx,

- David

Comment 4

[Andrew Schultz]

Attachment: folder with offending message

It seems that most normal mail doesn't trigger this bug.  Junk mail seems
particularly troublesome.  This is a folder with a message that triggers this
bug pretty consistently.  I noticed there are plenty of ^M here.

the patch didn't help. :(
I'll try to isolate the memchr that's having problems.

Comment 5

[David :Bienvenu]

thx, I tried that msg on windows w/o a problem.

Comment 6

[Andrew Schultz]

it seems to be the third memchr (in the current trunk code) that causes problems:
http://lxr.mozilla.org/mozilla/source/mailnews/local/src/nsLocalMailFolder.cpp#2517

2517   end = (char *) memchr(start, '\r', end - start + 1);

for the attached message (end-start+1) is consistently -1.  the third argument
to memchr is a size_t, which is an unsigned int.  Amazingly, it makes it through
the while loop quite a few times before crashing.

Comment 7

[David :Bienvenu]

OK, I think I see the problem - when we advance start here:

      start = end+linebreak_len;

we need to advance end as well. I'll try to come up with another patch

Comment 8

[David :Bienvenu]

Attachment: proposed fix

can you try this patch? First, you need to unapply the old one (or just remove
nsLocalMailFolder.cpp, cvs up, then apply this patch)

thx, - David

Comment 9

[Andrew Schultz]

the new patch fixes the crash for me.

Comment 10

[David :Bienvenu]

great, thx. I'll check it in as soon as I can.

Comment 11

[David :Bienvenu]

fix checked in, r/sr=sspitzer.

Comment 12

[Andreas Kunz]

This may have caused bug 207908. Only three checkins when it regressed and this
one is about the same portion of mailnews.

Comment 13

[Jim Booth]

FYI, I saw a very similar problem in WINDOWS ME in build 2003060104.  
Happened consistently with messages with JPEGs inserted in body of message.
It's fixed as of 2003060608.  See bug 208565

Comment 14

[David :Bienvenu]

*** Bug 208055 has been marked as a duplicate of this bug. ***