136998 - Crash: Multiple identical valid recipient certs GPFs Mail client

Status: VERIFIED DUPLICATE of bug 134992

(MailNews Core :: Security: S/MIME, defect, P1)

Description

[Charles Rosendahl]

Build: 2002041103 Trunk Windows

Steps to reproduce:
1.  Create a new profile and set up mail account settings.
2.  Import a dual-use certificate and the CA that signed it
3.  Make sure the CA Trust bits are set
4.  Set the dual-use cert as the signing and encryption cert in mail settings
5.  import two identical user certs (different keys only) into 'Other People' store
5.  Compose a message to that user
6.  Choose to digitally sign and encrypt the message
7.  Click send
8.  You should see a failure message.  Click ok.
9.  Bring the window back into focus and close the window.  Select 'Don't save'
10. The window closes and a few seconds later the application faults.

Specifics:
My CA:  lab212 (pki)
My Cert:  Charles Rosendahl (dual use)
User CA: lab212
User Certs: sectest (key 1) and sectest (key2) - (both are dual use)

certdb and key files provided by email by request

Comment 1

[Charles Rosendahl]

Crashes consistently on 1.0 branch as well

Comment 2

[Stephane Saux]

Charles, how do you get these certs in the Others' tab. User certs are by
definition in the Mine tab (user cert means you have the private key).

The only way to get certs in the others' tab is to read an email or load them
using a similar mechanism as in phonebook.

It's important to see how a user would get into this situation. If it's
something that will clearly happen, then it's critical.
If it requires somebody to use certutil and there doesn't appear to be any other
way to get in this situation, I don't think we'll make this a critical bug.

Can this be reproduced in the following way:
get a cert for A. Send a signed email to B. B as A's cert in Others' tab.
get a new cert for A. Send a new signed email to B. B's new cert is in Others' tab.
Does it crash?

Comment 3

[Stephane Saux]

Do you have any talkbacks from these crashes?

Comment 4

[Charles Rosendahl]

I meant recipient certs, not user certs.  Kai's reproduction case will work.

Incident ID  5099980
Stack Signature  smime3.dll + 0x38a6 (0x610538a6) 418b04bd
Trigger Time 2002-04-11 16:06:15
Email Address [e-mail]
URL visited
Build ID 2002041113
Product ID MozillaTrunk
Platform
Operating System Win32
Module
Trigger Reason Access violation
User Comments Reproducible Crash
Stack Trace
smime3.dll + 0x38a6 (0x610538a6)
DOMGCCallback [d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp,
line 1623]
js_GC [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 1367]
js_ForceGC [d:\builds\seamonkey\mozilla\js\src\jsgc.c, line 980]
JS_GC [d:\builds\seamonkey\mozilla\js\src\jsapi.c, line 1645]
nsJSContext::Notify
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 1573]
nsTimerImpl::Fire [d:\builds\seamonkey\mozilla\xpcom\threads\nsTimerImpl.cpp,
line 352]
nsTimerManager::FireNextIdleTimer
[d:\builds\seamonkey\mozilla\xpcom\threads\nsTimerImpl.cpp, line 584]
nsAppShell::Run [d:\builds\seamonkey\mozilla\widget\src\windows\nsAppShell.cpp,
line 134]
nsAppShellService::Run
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 309]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1431]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1766]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1784]
WinMainCRTStartup()
KERNEL32.DLL + 0xd326 (0x77e8d326) 

Other Incident IDS:
5095775
5091658

Comment 5

[Charles Rosendahl]

Nominating for nsbeta1. Reproducible crash.

Comment 6

[Kai Engert [:KaiE:]]

I'm confused. Charles, can you please answer Stephane's question, how do you get
the cert into the other's tab?

Which error message do you see in step 8?

What do you mean by "Kai's reproduction case will work"?

Comment 7

[Charles Rosendahl]

Build 2002041711 branch:

The crash is no longer present, something has fixed it.

Here is the test case:
- receive multiple certificates from the same sender (same subjectname - 
different keys).  I had two from the same sender.  One from OE and one from NS.
- compose a message to the owner of the multiple certs signed and encrypted.

This used to crash.  Now it simply takes the first valid cert it finds (or 
something) and encrypts - doesn't bother to verify or ask which one to use.

So, not a crash, just a bizarre edge case again.  Kaie, I would resolve this as 
wfm.  I can pick up the above edge case at a later time after the core 
functionality is ironed out.

thanks,
/c

Comment 8

[Charles Rosendahl]

Hold on - sorry.  Turns out that it worked because my cert was a dual use cert.
 I created a new profile and used a 512bit dual-use cert and then the crashes began.

The crash is identical to the crashes in bug 134992.

resolving duplicate.

Charles


*** This bug has been marked as a duplicate of 134992 ***

Comment 9

[Charles Rosendahl]

Verified as a duplicate of bug 134992.  will track that defect instead.

Comment 10

[Kai Engert [:KaiE:]]

Removing from radar.