242990 - Crash when LDAP query results content none UTF8 characters

Status: RESOLVED FIXED

(MailNews Core :: LDAP Integration, defect)

Description

[wind li]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.6) Gecko/20040113

in mozilla/directory/xpcom/base/src/nsLDAPMessage.cpp:516 we use
UTF8ToNewUnicode to convert the result strings to unicode, but the LDAP qeury
result may not be UTF8 chars, such as "Ulrich Rüße". If LDAP server return these
chars, mozilla will crash

Reproducible: Always
Steps to Reproduce:

Comment 1

[wind li]

Attachment: If the result strings IsUTF8 use UTF8ToNewUnicode, otherwise use general ToNewUnicode

Comment 2

[Dan Mosedale (:dmosedale, :dmose)]

Comment on attachment 147958 [details] [diff] [review]
If the result strings IsUTF8 use UTF8ToNewUnicode, otherwise use general ToNewUnicode

r+sr=dmose

Comment 3

[Kyle Yuan]

Comment on attachment 147958 [details] [diff] [review]
If the result strings IsUTF8 use UTF8ToNewUnicode, otherwise use general ToNewUnicode

This fixed a crash bug, nice to have in 1.7.

Comment 4

[Kyle Yuan]

fixed in trunk, still waiting for 1.7 branch approval.

Comment 5

[Greg K.]

Is there a crash point or stack for this so we can search for dups?

Comment 6

[wind li]

#0  0x4047421d in free () from /lib/libc.so.6
#1  0x400ae488 in PR_Free () from ./libnspr4.so
#2  0x406242bd in nsMemoryImpl::Free ()
   from /cws/cws/mozab04/mozilla/dist/bin/libxpcom.so
#3  0x08063633 in nsMemory::Free ()
#4  0x41657275 in NSGetModule ()
   from /cws/cws/mozab04/mozilla/dist/bin/components/libmozldap.so
#5  0x411d0770 in NSGetModule ()
   from /cws/cws/mozab04/mozilla/dist/bin/components/libaddrbook.so
#6  0x411d2526 in NSGetModule ()
   from /cws/cws/mozab04/mozilla/dist/bin/components/libaddrbook.so
#7  0x411d1217 in NSGetModule ()
   from /cws/cws/mozab04/mozilla/dist/bin/components/libaddrbook.so
#8  0x406314e5 in XPTC_InvokeByIndex ()
   from /cws/cws/mozab04/mozilla/dist/bin/libxpcom.so
#9  0x4061e628 in nsProxyObject::Post ()
   from /cws/cws/mozab04/mozilla/dist/bin/libxpcom.so
#10 0x406171da in PL_HandleEvent ()
   from /cws/cws/mozab04/mozilla/dist/bin/libxpcom.so
#11 0x40617111 in PL_ProcessPendingEvents ()
   from /cws/cws/mozab04/mozilla/dist/bin/libxpcom.so
#12 0x40618bab in nsEventQueueImpl::ProcessPendingEvents ()
   from /cws/cws/mozab04/mozilla/dist/bin/libxpcom.so
---Type <return> to continue, or q <return> to quit---
#13 0x40d6a71f in ?? ()
   from /cws/cws/mozab04/mozilla/dist/bin/components/libwidget_gtk.so
#14 0x0810ca98 in ?? ()
#15 0x4050dcc0 in __morecore () from /lib/libc.so.6
#16 0xbfffeec8 in ?? ()
#17 0x40d6a341 in ?? ()
   from /cws/cws/mozab04/mozilla/dist/bin/components/libwidget_gtk.so
#18 0x0810ca98 in ?? ()
#19 0x00000008 in ?? ()
#20 0x00000001 in ?? ()
#21 0x4047426b in free () from /lib/libc.so.6
Previous frame inner to this frame (corrupt stack?)

Comment 7

[chris hofmann]

Comment on attachment 147958 [details] [diff] [review]
If the result strings IsUTF8 use UTF8ToNewUnicode, otherwise use general ToNewUnicode

a=chofmann for 1.7

Comment 8

[Scott MacGregor]

fixed on the 1.7 branch

Comment 9

[Aleksey Nogin]

Is this fix included in TBird-1.0? I just had it crash in libmozldap.so (under
Fedora Core 3) and I am wondering whether I am seeing this bug or a different
one (I was running a non-debug build, so I did not get a meaningfull stack
trace). Thank you!

Comment 10

[Dan Mosedale (:dmosedale, :dmose)]

Yes, this was in Thunderbird 1.0.