Closed Bug 23309 Opened 25 years ago Closed 25 years ago

assert when loading a message with jami andrew's vcard

Categories

(MailNews Core :: MIME, defect, P3)

x86
Linux
defect

Tracking

(Not tracked)

VERIFIED FIXED

People

(Reporter: sspitzer, Assigned: rhp)

References

Details

Attachments

(1 file)

#0  0x40321027 in ?? () from /lib/libc.so.6
#1  0x400406f6 in nsCRT::strlen (s=0x0) at ../../../dist/include/nsCRT.h:127
#2  0x41909d84 in WriteLineToStream (obj=0x8a59578, line=0x0) at
mimevcrd.cpp:1735
#3  0x4190770f in OutputAdvancedVcard (obj=0x8a59578, v=0x89c5b70) at
mimevcrd.cpp:886
#4  0x419088dd in WriteOutVCard (obj=0x8a59578, v=0x89c5b70) at
mimevcrd.cpp:1271
#5  0x41905955 in MimeInlineTextVCard_parse_eof (obj=0x8a59578, abort_p=0) at
mimevcrd.cpp:266
#6  0x416c8a44 in MimeMultipart_close_child (object=0x89f5a80) at
mimemult.cpp:459
#7  0x416c8158 in MimeMultipart_parse_line (line=0x85c4850 '-' <repeats 14
times>, "FD9C2F5D5BA760A03C6A28FF--\ns\ni;\n</html>\nfor
January!&nbsp;\nid=jami:clubnet&view=month\">.here's\n (Netscape Messaging
Server 4.1) with ESMTP id\n          FNXSSK00.FXN for <sspitzer@tintin."...,
length=41, obj=0x89f5a80) at mimemult.cpp:154
#8  0x416cf265 in convert_and_send_buffer (buf=0x85c4850 '-' <repeats 14 times>,
"FD9C2F5D5BA760A03C6A28FF--\ns\ni;\n</html>\nfor
January!&nbsp;\nid=jami:clubnet&view=month\">.here's\n (Netscape Messaging
Server 4.1) with ESMTP id\n          FNXSSK00.FXN for <sspitzer@tintin."...,
length=41, convert_newlines_p=1, per_line_fn=0x416c7ffc
<MimeMultipart_parse_line(char *, int, MimeObject *)>, closure=0x89f5a80) at
mimebuf.cpp:151
#9  0x416cf4bd in mime_LineBuffer (net_buffer=0x87e70c8 '-' <repeats 14 times>,
"FD9C2F5D5BA760A03C6A28FF--\ns\ni;\n</html>\nfor
January!&nbsp;\nid=jami:clubnet&view=month\">.here's\n:31 -0800 (PST)\n", 'Û'
<repeats 75 times>..., net_buffer_size=41, bufferP=0x89f5aa8,
buffer_sizeP=0x89f5ab0, buffer_fpP=0x89f5ab8, convert_newlines_p=1,
per_line_fn=0x416c7ffc <MimeMultipart_parse_line(char *, int, MimeObject *)>,
closure=0x89f5a80) at mimebuf.cpp:238
#10 0x416c97a3 in MimeObject_parse_buffer (buffer=0x87e70c8 '-' <repeats 14
times>, "FD9C2F5D5BA760A03C6A28FF--\ns\ni;\n</html>\nfor
January!&nbsp;\nid=jami:clubnet&view=month\">.here's\n:31 -0800 (PST)\n", 'Û'
<repeats 75 times>..., size=41, obj=0x89f5a80) at mimeobj.cpp:223
#11 0x416c5b9c in MimeMessage_parse_line (line=0x87e70c8 '-' <repeats 14 times>,
"FD9C2F5D5BA760A03C6A28FF--\ns\ni;\n</html>\nfor
January!&nbsp;\nid=jami:clubnet&view=month\">.here's\n:31 -0800 (PST)\n", 'Û'
<repeats 75 times>..., length=41, obj=0x84dddd0) at mimemsg.cpp:173
#12 0x416cf265 in convert_and_send_buffer (buf=0x87e70c8 '-' <repeats 14 times>,
"FD9C2F5D5BA760A03C6A28FF--\ns\ni;\n</html>\nfor
January!&nbsp;\nid=jami:clubnet&view=month\">.here's\n:31 -0800 (PST)\n", 'Û'
<repeats 75 times>..., length=41, convert_newlines_p=1, per_line_fn=0x416c5988
<MimeMessage_parse_line(char *, int, MimeObject *)>, closure=0x84dddd0) at
mimebuf.cpp:151
#13 0x416cf4bd in mime_LineBuffer (net_buffer=0x89e5c51 '-' <repeats 14 times>,
"FD9C2F5D5BA760A03C6A28FF--\n\n", net_buffer_size=42, bufferP=0x84dddf8,
buffer_sizeP=0x84dde00, buffer_fpP=0x84dde08, convert_newlines_p=1,
per_line_fn=0x416c5988 <MimeMessage_parse_line(char *, int, MimeObject *)>,
closure=0x84dddd0) at mimebuf.cpp:238
#14 0x416c97a3 in MimeObject_parse_buffer (buffer=0x89e5980 "a NEW and IMPROVED
calendar </a><font color=\"#000099\">for January!&nbsp;\nHere's to your
health!&nbsp; Cheers!</font></b>\n<br><b><font
color=\"#000099\"></font></b>&nbsp;\n<br><b><font color=\"#000099\"></f"...,
size=763, obj=0x84dddd0) at mimeobj.cpp:223
#15 0x416d0856 in mime_display_stream_write (stream=0x84dde30, buf=0x89e5980 "a
NEW and IMPROVED calendar </a><font color=\"#000099\">for January!&nbsp;\nHere's
to your health!&nbsp; Cheers!</font></b>\n<br><b><font
color=\"#000099\"></font></b>&nbsp;\n<br><b><font color=\"#000099\"></f"...,
size=763) at mimemoz2.cpp:620
#16 0x416dbe40 in nsStreamConverter::OnDataAvailable (this=0x854f620, ctxt=0x0,
aIStream=0x884d7d0, sourceOffset=0, aLength=763) at nsStreamConverter.cpp:669
#17 0x40c61779 in nsDocumentOpenInfo::OnDataAvailable (this=0x89c8418,
aChannel=0x89c83b8, aCtxt=0x0, inStr=0x884d7d0, sourceOffset=0, count=763) at
nsURILoader.cpp:233
#18 0x40609411 in nsOnDataAvailableEvent::HandleEvent (this=0x8a5cd40) at
nsAsyncStreamListener.cpp:369
#19 0x40608837 in nsStreamListenerEvent::HandlePLEvent (aEvent=0x89f00a0) at
nsAsyncStreamListener.cpp:93
#20 0x401d936b in ?? () from /builds/seth/seamonkey/mozilla/dist/bin/libplds3.so
#21 0x401d927c in ?? () from /builds/seth/seamonkey/mozilla/dist/bin/libplds3.so
#22 0x4016fad9 in ?? () from /builds/seth/seamonkey/mozilla/dist/bin/libxpcom.so
#23 0x406b6da4 in event_processor_callback (data=0x80ab440, source=8,
condition=GDK_INPUT_READ) at nsAppShell.cpp:141
#24 0x406b6a2f in our_gdk_io_invoke (source=0x81d23a8, condition=G_IO_IN,
data=0x8240d78) at nsAppShell.cpp:54
#25 0x4086b3ca in ?? () from /usr/lib/libglib-1.2.so.0
#26 0x4086ca86 in ?? () from /usr/lib/libglib-1.2.so.0
#27 0x4086d041 in ?? () from /usr/lib/libglib-1.2.so.0
#28 0x4086d1e1 in ?? () from /usr/lib/libglib-1.2.so.0
#29 0x407967a9 in ?? () from /usr/lib/libgtk-1.2.so.0
#30 0x406b73a7 in nsAppShell::Run (this=0x8077908) at nsAppShell.cpp:304
#31 0x4058cfbd in nsAppShellService::Run (this=0x80ab110) at
nsAppShellService.cpp:465
#32 0x804bf3d in main1 (argc=1, argv=0xbffff9c4) at nsAppRunner.cpp:609
#33 0x804c3c7 in main (argc=1, argv=0xbffff9c4) at nsAppRunner.cpp:697
#34 0x402dbcb3 in ?? () from /lib/libc.so.6

I'm trying to find out more about the message that caused it.

for now, I've bulletproof the crash with this patch (which I just checked in)

Index: mimevcrd.cpp
===================================================================
RCS file: /cvsroot/mozilla/mailnews/mime/cthandlers/vcard/mimevcrd.cpp,v
retrieving revision 1.43
diff -p -r1.43 mimevcrd.cpp
*** mimevcrd.cpp        2000/01/06 16:00:25     1.43
--- mimevcrd.cpp        2000/01/07 03:04:29
*************** static int OutputAdvancedVcard(MimeObjec
*** 883,889 ****
                                                        tString1 =
VCardGetStringByID(VCARD_ADDR_HOSTNAMEIP);
                                }

!         status = WriteLineToStream (obj, tString1);
          PR_FREEIF(tString1);
                                PR_FREEIF (namestring);
                                if (status < 0) return status;
--- 883,892 ----
                                                        tString1 =
VCardGetStringByID(VCARD_ADDR_HOSTNAMEIP);
                                }

!       NS_ASSERTION(tString1,"don't write null line to stream");
!         if (tString1) {
!               status = WriteLineToStream (obj, tString1);
!       }
          PR_FREEIF(tString1);
                                PR_FREEIF (namestring);
                                if (status < 0) return status;
Is this similar to what I filed
http://bugzilla.mozilla.org/show_bug.cgi?id=23303?
it looks like jami andrew's vcard causes the problem.

now that the patch is in, we only assert.  no more crash.
yep, lisa's bug is a duplicate of mine.  (or the other way around.)

we do a strlen on null.  I've checked in a patch that prevents the crash, and
now we only assert.

mscott said that rhp checked in a bunch of mime changes, and this may be fixed
already.  sees the crash with last night build, but not with his current tree.
Summary: crash when loading a message (vcard related) → assert when loading a message with jami andrew's vcard
*** Bug 23303 has been marked as a duplicate of this bug. ***
Status: NEW → RESOLVED
Closed: 25 years ago
Resolution: --- → FIXED
Target Milestone: M13
Thanks guys. I sort of took both. The evil vcard had an old Netscape Conference
entry that was garbage data (serves me right, huh :-) Anyway, it should be all
better now.

- rhp
Esther sent a msg out today with a vcard in it which also causes a crash.  I'll
try again with a build with the fix.
Linux (2000-07-28-04 M17)
Win32 (2000-07-28-04 M17)
Mac (2000-07-26-08 M17)
I used the attached vcard to re-test the bug. It does not crash any more.
Status: RESOLVED → VERIFIED
Product: MailNews → Core
Product: Core → MailNews Core
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: