1411737 - TBE-01-016: Crash when forwarding message with non-existent file in X-Mozilla-Cloud-Part Header

Status: RESOLVED FIXED

(MailNews Core :: Attachments, defect)

Description

[Ben Bucksch (:BenB)]

An issue which leads to a crash was attributed to a message with an incorrectly used X- Mozilla-Cloud-Part header being forwarded. Due to a null pointer dereference, Thunderbird exits with a segmentation fault and must be restarted. A relevant Proof of Concept is given in the following code snippet.

PoC.eml
To: test <test@localhost>
From: test
Content-Type: text/plain
X-Mozilla-Cloud-Part: bla

The X-Mozilla-Cloud-Part header can be used for attachments. If the Content-Type of an email is text/plain or text/html, this header leads to a nullpointer being dereferenced.

Affected File:
/mailnews/mime/src/mimedrft.cpp

Affected Code:
if (!bodyAsAttachment)
{
  int64_t fileSize;
  nsCOMPtr<nsIFile> tempFileCopy;
  mdd->messageBody->m_tmpFile->Clone(getter_AddRefs(tempFileCopy));
  mdd->messageBody->m_tmpFile = do_QueryInterface(tempFileCopy);

It is recommended to verify the value of m_tmpFile before using this pointer for operations. Alternatively, this header could be ignored for messages without an attachment.

For the original report as PDF; see bug 1411701.

Comment 1

[Ben Bucksch (:BenB)]

Not a security bug (null pointer)

Comment 2

[Magnus Melin [:mkmelin]]

Attachment: bug1411737_invalid_cloud_parth_crash.patch

Comment 3

[Jorg K (CEST = GMT+2)]

Comment on attachment 8923076 [details] [diff] [review]
bug1411737_invalid_cloud_parth_crash.patch

I assume you tested it with the offending header. Please confirm.

Comment 4

[Magnus Melin [:mkmelin]]

Yes, I've tested it. 
On a side note it's kind of a funny behavior when you set this header for the main content and try to forward, the forwarded content is blank. (The header is supposed to be used only for parts).

Comment 5

[Jorg K (CEST = GMT+2)]

I'll land this once we're unbusted again.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/c28b7379ca06
Fix crash when forwarding message with non-existent file in X-Mozilla-Cloud-Part header. r=jorgk CLOSED TREE

Comment 7

[Jorg K (CEST = GMT+2)]

I rebased it for you ;-)

Comment 8

[Jorg K (CEST = GMT+2)]

Beta (TB 57):
https://hg.mozilla.org/releases/comm-beta/rev/2f70371c31db73e1028abc877d08a8883e8844c0

Comment 9

[Jorg K (CEST = GMT+2)]

TB 52.5 ESR (should be tracking 57+):
https://hg.mozilla.org/releases/comm-esr52/rev/bcccf1c02567