1432218 - Messages in imap folder flash when read (screen turns white, message paints, then flashes white), shows "loading message"

Status: RESOLVED INVALID

(Thunderbird :: Message Reader UI, defect)

Description

[tlhackque]

Attachment: flasher.eml

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Build ID: 20170824053622

Steps to reproduce:

Some messages, when opened, cause the message to flash continuously.  I've only seen it on digest format mailing list messages; it seems to happen when some users post.  

The screen turns white, one sees the message paint, then it flashes white.  This continues at a high rate.

This happens when opening in a new pane - but also in the preview pane.

While this is going on, the status bar reads "loading message" - flashing with the rest of the screen.

In the attached example:
  Loaded as a standalone message, it does NOT flash, but reports "5 attachments, 19.2KB"
  While read from my (IMAP) inbox, it DOES flash, but reports **6** attachments.

The attachment count doesn't flash.

This was the last message in my inbox (/var/spool/mail/username).  The behavior persists when additional mail is delivered.

Thunderbird 52.5.2 (32-bit). 

The inbox file is ~81M.

I marked this as "security" because if someone can figure out how to craft an e-mail with these symptoms, it seems as though Thunderbird goes out of control.  However, there is no evidence of permanent harm.

Comment 1

[Wayne Mery (:wsmwk)]

https://wiki.mozilla.org/Security_Severity_Ratings describes levels of security issues. I tested using 52.5.2 and nightly on windows. I don't see flashing. But even if I did, as far as I can tell your issue doesn't appear to fit a security bucket.

Comment 2

[Wayne Mery (:wsmwk)]

In my testing using nightly build, the message shows 6 attachments when loaded from all sources: bug report, local folders and imap folder

Comment 3

[tlhackque]

1) Continuous flashing based on a received message seems to me to be a way to attack a recipient's UI.  It can be difficult to get it to stop.  I suppose it might also be an issue for triggering epileptic seizures in those sensitive to flashing. In a sense, this is denial of service; it certainly corrupts the UI.
2) I'm not surprised that it didn't reproduce, as that's consistent with the stand-alone .eml not reproducing.  There is obviously some other precondition yet to be identified
3) I had another instance, which was followed shortly by a Thunderbird crash.  I put "Followed another instance of 1432218" in the comments to crash reporter.  I suspect they're related - if I had to guess, all the flashing might trigger a memory leak or resource limit.  In any case, perhaps the crash dump will provide clues...

4) I noticed that PGP signatures seem to be present when this occurs.  I disabled Enignmail & restarted.  No flashing with the current message.  Re-enabled, and the flashing re-appears.  So it appears to be Enigmail-related... (I have 1.9.9)

I guess I should open a bug there.

Comment 4

[tlhackque]

Found out how to get crash data:

Crash dump is bp-15194888-293f-4b5b-98ee-e2a670180123 (https://crash-stats.mozilla.com/report/index/15194888-293f-4b5b-98ee-e2a670180123)

Enigmail Bug is https://sourceforge.net/p/enigmail/bugs/734/ Also marked "private" for the same reasons.

I'll update this if there's progress there.

Thanks for looking at this.

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to tlhackque from comment #3)
> ...
> 3) I had another instance, which was followed shortly by a Thunderbird
> crash.  I put "Followed another instance of 1432218" in the comments to
> crash reporter.  I suspect they're related - if I had to guess, all the
> flashing might trigger a memory leak or resource limit.  In any case,
> perhaps the crash dump will provide clues...

bp-15194888-293f-4b5b-98ee-e2a670180123 @ CompareCacheMatchEntry which is https://bugzilla.mozilla.org/show_bug.cgi?id=1353702

Comment 6

[Wayne Mery (:wsmwk)]

tlhackque, do you still crash when using version 60?

Comment 7

[tlhackque]

The flashing was fixed in Enigmail. The crash hasn't occurred since (and I'm up to TB 60.4.0), but I didn't set a tickler to update this bug. Sorry.

This bug can be closed.

Comment 8

[Wayne Mery (:wsmwk)]

(In reply to tlhackque from comment #7)

The flashing was fixed in Enigmail. The crash hasn't occurred since (and I'm up to TB 60.4.0), but I didn't set a tickler to update this bug. Sorry.

THanks for the update. In which version of enigmail is this fixed? And do you know which bug report?

Comment 9

[tlhackque]

My bug report (noted above) response said V2.0 (master). Not sure when the actual fix was checked-in, or when "master" released. Just that at some later point, enigmail updated and the symptom disappeared.

https://sourceforge.net/p/enigmail/bugs/734/ - that report has a video showing the flashing issue. I presume that it caused a resource leak that resulted in the crash. But I don't know.

I also don't know if the fix in 2.0 was as a result of some other bug report, or a developer's edit. The response was rather terse.

Sorry I don't have more detail; that's pretty much all I know.

Comment 10

[Wayne Mery (:wsmwk)]

Thanks. I was able to get to https://sourceforge.net/p/enigmail/bugs/734/ and it indicates being fixed in enigmail 2.0 January 2018