500534 - Crash @ [nsImapServerResponseParser::mailbox] with bogus IMAP server

Status: RESOLVED DUPLICATE of bug 376192

(MailNews Core :: Networking: IMAP, defect)

Description

[Brandon Sterne (:bsterne)]

Attachment: IMAP server script

Steve Kemp <[e-mail]> reported this issue to security@m.o.

I wrote a Python script to emulate the server behavior that the produces the crash in case he needs to take down his test server.  This crashes Thunderbird 2 but doesn't appear to crash Shredder.

To reproduce:
1. Grab the attachment server.py
2. sudo ./server.py (needs root to bind to port 143)
3. Run Thunderbird 2 and set up a IMAP account with localhost as your
   Incoming Server
4. Enter a password when you are prompted and witness the crash

This is a null dereference crash, but I'm going to hide it initially because I know nothing about the surrounding code.  Feel free to unhide if this is a safe crash.  In the stack trace below you can see that boxSpec->connection->GetCurrentUrl() is null when it is dereferenced.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb1bebb90 (LWP 14059)]
0xb6cb9413 in nsImapServerResponseParser::mailbox (this=0x9882f3c, 
    boxSpec=0x9467fb0)
    at /build/tb2/mozilla/mailnews/imap/src/nsImapServerResponseParser.cpp:964
964	    boxSpec->connection->GetCurrentUrl()->AllocateCanonicalPath(boxname, boxSpec->hierarchySeparator, &boxSpec->allocatedPathName);
(gdb) p boxSpec 
$1 = (class nsImapMailboxSpec *) 0x9467fb0
(gdb) p boxSpec->connection
$2 = (class nsImapProtocol *) 0x9882d88
(gdb) p boxSpec->connection->GetCurrentUrl
$3 = {class nsIImapUrl *(
    nsImapProtocol *)} 0xb6cafedc <nsImapProtocol::GetCurrentUrl()>
(gdb) p boxSpec->connection->GetCurrentUrl()
[Thread 0xb450cb90 (LWP 14057) exited]
[Thread 0xb23ecb90 (LWP 14060) exited]
$4 = (class nsIImapUrl *) 0x0

This is preceded by the assertion:

###!!! ASSERTION: box spec has connection with null url: 'boxSpec->connection->GetCurrentUrl()', file /build/tb2/mozilla/mailnews/imap/src/nsImapServerResponseParser.cpp, line 961

Comment 1

[David :Bienvenu]

this is a dup of bug 376192 - I'll nominate that fix for 1.8.1 next...afaik, it's a safe crash.

Comment 3

[Wayne Mery (:wsmwk)]

even closed bugs should get keyword(s), severity, etc appropriate to bug description