21869 - Forwarding winter party message causes crash

Status: VERIFIED FIXED

(MailNews Core :: Backend, defect, P3)

Description

[kinmoz]

I'm attatching the multipart mime message announcing our holiday party to this
bug. When I try to forward this message, I get an assert and then a crash.

Here's the stack trace for the assert:




NTDLL! 77f7629c()
MimeObject_parse_eof(MimeObject * 0x054c9e70, int 0) line 239 + 38 bytes
MimeContainer_parse_eof(MimeObject * 0x054c9e70, int 0) line 115 + 14 bytes
MimeMultipart_parse_eof(MimeObject * 0x054c9e70, int 0) line 585 + 14 bytes
MimeMultipart_parse_eof(MimeObject * 0x054c91d0, int 0) line 580 + 16 bytes
MimeMultipart_finalize(MimeObject * 0x054c91d0) line 109 + 14 bytes
mime_free(MimeObject * 0x054c91d0) line 275 + 12 bytes
MimeContainer_finalize(MimeObject * 0x035c1f90) line 95 + 9 bytes
MimeMessage_finalize(MimeObject * 0x035c1f90) line 98 + 10 bytes
mime_free(MimeObject * 0x035c1f90) line 275 + 12 bytes
mime_parse_stream_complete(_nsMIMESession * 0x035c00c0) line 1120 + 12 bytes
nsStreamConverter::OnStopRequest(nsStreamConverter * const 0x02dd7080,
nsIChannel * 0x035c7870, nsISupports * 0x035c0f44, unsigned int 0, const
unsigned short * 0x00000000) line 721 + 13 bytes
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x054cab10) line
279
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x054ca890) line 93 + 12 bytes
PL_HandleEvent(PLEvent * 0x054ca890) line 522 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x010789e0) line 483 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x11930138, unsigned int 49430, unsigned int 0,
long 17271264) line 947 + 9 bytes
USER32! 77e71820()




Here's the stack trace for the crash:



_NMSG_WRITE(int 10) line 221
abort() line 44 + 7 bytes
PR_Assert(const char * 0x0316b1ec, const char * 0x0316b1c0, int 239) line 450
MimeObject_parse_eof(MimeObject * 0x054c9e70, int 0) line 239 + 38 bytes
MimeContainer_parse_eof(MimeObject * 0x054c9e70, int 0) line 115 + 14 bytes
MimeMultipart_parse_eof(MimeObject * 0x054c9e70, int 0) line 585 + 14 bytes
MimeMultipart_parse_eof(MimeObject * 0x054c91d0, int 0) line 580 + 16 bytes
MimeMultipart_finalize(MimeObject * 0x054c91d0) line 109 + 14 bytes
mime_free(MimeObject * 0x054c91d0) line 275 + 12 bytes
MimeContainer_finalize(MimeObject * 0x035c1f90) line 95 + 9 bytes
MimeMessage_finalize(MimeObject * 0x035c1f90) line 98 + 10 bytes
mime_free(MimeObject * 0x035c1f90) line 275 + 12 bytes
mime_parse_stream_complete(_nsMIMESession * 0x035c00c0) line 1120 + 12 bytes
nsStreamConverter::OnStopRequest(nsStreamConverter * const 0x02dd7080,
nsIChannel * 0x035c7870, nsISupports * 0x035c0f44, unsigned int 0, const
unsigned short * 0x00000000) line 721 + 13 bytes
nsOnStopRequestEvent::HandleEvent(nsOnStopRequestEvent * const 0x054cab10) line
279
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x054ca890) line 93 + 12 bytes
PL_HandleEvent(PLEvent * 0x054ca890) line 522 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x010789e0) line 483 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x11930138, unsigned int 49430, unsigned int 0,
long 17271264) line 947 + 9 bytes
USER32! 77e71820()
010

Comment 1

[kinmoz]

Attachment: This is the multi-part mime mail message that causes the crash.

Comment 2

[kinmoz]

Forgot to mention that I'm crashing with my 12/15/1999 Mozilla debug build.

Comment 3

[Phil Peterson]

Reassign to rhp

Comment 4

[rhp (gone)]

Jeff,
This is a crash when forwarding this message, but we can view if fine, as well
as reply/quote just fine. Can you take a look? I'm not sure what Forwarding
Inline is doing differently than quoting.

- rhp

Comment 5

[jefft]

The reason we crash is because we don't handle multipart/signed messages well.
We have an earlier termination of parsing the multipart/signed messages for
opening as draft. This causes PR_ASSERT() which terminated the application. Mime
needs to be able to handle multipart/signed and multipart/en_____ed message.

Comment 6

[rhp (gone)]

I may have a way we can deal with this. Let me hack something up. I'll let you
know.

- Rich

Comment 7

[rhp (gone)]

Hmm...I'm not sure I follow this. There is a content type handler in the tree
for En___ messages. They don't get decoded, but you will get a nice message
saying that we can't handle it. I put one of these together for Signed messages
so we process all of the data normally.

Maybe you can help me understand this better.

- rhp

Comment 8

[jefft]

Attachment: A generic way to fix the crashing

Comment 9

[rhp (gone)]

Fix looks good to me...do you want to check it in?

- rhp

Comment 10

[jefft]

Yes, I do. Can I? Thanks,

-- Jeff

Comment 11

[jefft]

Fix checked in. mimemult.cpp modified.

Comment 12

[pmock]

changing qa assigned to [e-mail]

Comment 13

[pmock]

Verified on win32, macos, and linux using the following builds:
ftp://sweetlou/products/client/seamonkey/windows/32bit/x86/2000-01-04-09-M13/sea
monkey32e.exe
ftp://sweetlou/products/client/seamonkey/unix/linux_glibc/2.2/x86/2000-01-04-08-
M13/netscape-i686-pc-linux-gnu.tar.gz
ftp://sweetlou/products/client/seamonkey/macos/8.x/ppc/2000-01-04-09-M13/NSMacIn
staller-M13.sea.bin

I can successful forward this message as a attachment or inline. :)