117962 - reproducible crash in mime.dll when right-click link in mail message to open

Status: VERIFIED FIXED

(SeaMonkey :: MailNews: Message Display, defect)

Description

[Eric Krock]

Using Moz 0.9.7 on WinME. [Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US;
rv:0.9.7) Gecko/20011221]

To repro:
1) open offending message in mail reader window
2) right click over link within quoted text 
3) choose open link in new window --> crashes in mime.dll

Note that if I copy the link URL, open a Moz window, and paste the URL in the
location bar, it doesn't crash, so it's not a case of bad HTML in the page.

Talkback IDs TB1192157M and TB1192154G.

Comment 1

[Eric Krock]

Crash. Nominate for mozilla0.9.9 consideration.

Comment 2

[Eric Krock]

Note: The mail message that's causing this contains some mildly confidential
information that I don't want to post on the public Internet, so I'm not
attaching it. However, I'd be happy to send it directly to the engineer working
on this bug under a good-faith confidentiality understanding.

Comment 3

[[e-mail] (gone - use [e-mail] instead)]

Stack Signature  nsStreamConverter::Init e9bae229
Trigger Time 2002-01-03 09:59:43
Email Address [e-mail]
URL visited creating new mail message via CTRL-M
User Comments Right-click over link in mail message body to open it.
Build ID 2001122109
Product ID MozillaBranch
Platform
Operating System Win32
Module
Trigger Reason Access violation
Stack Trace
nsStreamConverter::Init
[d:\builds\seamonkey\mozilla\mailnews\mime\src\nsStreamConverter.cpp, line 589]
nsStreamConverter::AsyncConvertData
[d:\builds\seamonkey\mozilla\mailnews\mime\src\nsStreamConverter.cpp, line 1121]
nsStreamConverterService::AsyncConvertData
[d:\builds\seamonkey\mozilla\netwerk\streamconv\src\nsStreamConverterService.cpp,
line 641]
nsDocumentOpenInfo::RetargetOutput
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 434]
nsDocumentOpenInfo::DispatchContent
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 310]
nsDocumentOpenInfo::OnStartRequest
[d:\builds\seamonkey\mozilla\uriloader\base\nsURILoader.cpp, line 227]
nsStreamListenerTee::OnStartRequest
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStreamListenerTee.cpp, line 14]
nsOnStartRequestEvent0::HandleEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 228]
nsStreamListenerEvent0::HandlePLEvent
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsAsyncStreamListener.cpp, line 122]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c,
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line
1072]
KERNEL32.DLL + 0x248f7 (0xbff848f7)
0x00688c02
0x00058f64 

Comment 4

[(not reading, please use [e-mail] instead)]

the stack trace looks right up mscott's alley.

eric, was the link a simple http:// link?

Comment 5

[Scott MacGregor]

accepting. 

Comment 6

[Scott MacGregor]

Eric, I'll take you up on your offer if you'll send the message directly to me.
Just click on the message then hit Ctrl-E to edit the message as new and send it
to [e-mail]. Thanks!

Comment 7

[Eric Krock]

Yes, it was a simple http:// link to a document on our internal intranet. I
emailed mscott a different email that I've verified reproduces the problem.

Comment 8

[[e-mail] (gone - use [e-mail] instead)]

Scott, could bug 109238 (which is now fixed) be the cause for this?

Comment 9

[Scott MacGregor]

The crash is happening because the message Eric received really isn't an http
url. It's an imap:// url that refers to someone elses mailbox which has a
description which matches an http url. 

In this case, the message source had a description for an http url:
"http://kontiki/pm/security/questions.html"
however the actual href value was really:
IMAP://exch2-villa.corp.zodiacnetworks.com?fetch%3EUID%3E/INBOX%3E33746&part=1.1"

Obviously we shouldn't crash in this case. But if the message came with an
embedded  imap url for someone elses inbox then we aren't going to be able to
fetch the attachment.

Comment 10

[Scott MacGregor]

moving to .9.9 since I don't think this is a common scenario that would hold the
098 release.

Comment 11

[Scott MacGregor]

Attachment: add a null ptr check for aURI to prevent the crash.

Comment 12

[(not reading, please use [e-mail] instead)]

Comment on attachment 66051 [details] [diff] [review]
add a null ptr check for aURI to prevent the crash.

sr=sspitzer

since it's an arg pointer, if you do:

NS_ENSURE_ARG_POINTER(aURI);

the difference is in what they return.

from nsDebug.h 

#define NS_ENSURE_ARG(arg) \
  NS_ENSURE_TRUE(arg, NS_ERROR_INVALID_ARG)

#define NS_ENSURE_ARG_POINTER(arg) \
  NS_ENSURE_TRUE(arg, NS_ERROR_INVALID_POINTER)

Comment 13

[Scott MacGregor]

fix checked in. i used NS_ENSURE_ARG_POINTER

Comment 14

[[e-mail] (gone - use [e-mail] instead)]

Eric, is this fixed for you?

Comment 15

[[e-mail] (gone - use [e-mail] instead)]

2001-12-21-09 was the last build this occurred with (MozillaBranch).

http://climate/reports/searchstacksignature.cfm?stacksig=nsStreamConverter%3A%3AInit

There were a few other people besides Eric experiencing this crash, and as I
haven't seen any other reports or stacks, marking this:

Verified FIXED.

Comment 16

[Eric Krock]

I'm now running Moz 0.9.7 on WinXP Pro. FWIW, clicking the link in the original
email message doesn't cause a crash. (Although since the OS has changed and the
link no longer resolves, doubt this is a good verification.) Sounds like it's
fixed though--thanks!!!