1655127 - Crashes @ nss_cms_encoder_work_data after getting a certificate error. cinfo killed between the calls?

Status: RESOLVED DUPLICATE of bug 1746639

(MailNews Core :: Security: S/MIME, defect)

Description

[Alan Batie]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:76.0) Gecko/20100101 Firefox/76.0

Steps to reproduce:

Tried to send a message in 79.0b1

Actual results:

It popped up a message complaining about the signing certificate being invalid (it's not). Afterwards, trying to save the message as a Draft or trying to send it again, causes Thunderbird to crash

Expected results:

Should have sent the message

Comment 1

[Wayne Mery (:wsmwk)]

What is your crash ID? https://support.mozilla.org/en-US/kb/mozilla-crash-reporter-tb

Comment 2

[Alan Batie]

bp-dc0a1660-a708-482c-85a6-bba470200724
bp-85d9f93f-915c-4257-b148-6756f0200724

Comment 3

[Wayne Mery (:wsmwk)]

I see encryptifpossible. So you are using smime?

bp-dc0a1660-a708-482c-85a6-bba470200724
0 libnss3.dylib nss_cms_encoder_work_data security/nss/lib/smime/cmsencode.c:408 context
1 XUL morkWriter_kHexDigits scan
2 XUL nsIZipReader::COMTypeInfo<nsIZipReader, void>::kIID scan
3 libnss3.dylib NSS_CMSEncoder_Cancel security/nss/lib/smime/cmsencode.c:677 scan
4 XUL nsCMSEncoder::~nsCMSEncoder() comm/mailnews/mime/src/nsCMS.cpp:802 scan
5 XUL nsCMSEncoder::Release() comm/mailnews/mime/src/nsCMS.cpp:798 scan
6 XUL nsCOMPtr_base::assign_from_helper(nsCOMPtr_helper const&, nsID const&) xpcom/base/nsCOMPtr.cpp:112 scan
7 XUL nsMsgComposeSecure::MimeInitEncryption(bool, nsIMsgSendReport*) comm/mailnews/extensions/smime/src/nsMsgComposeSecure.cpp:543 scan
8 libnss3.dylib SEC_QuickDERDecodeItem_Util security/nss/lib/util/quickder.c:824 scan
9 XUL morkWriter_kHexDigits scan
10 libmozglue.dylib arena_t::DallocSmall(arena_chunk_t*, void*, arena_chunk_map_t*) memory/build/mozjemalloc.cpp:3290 scan
11 XUL nsMsgComposeSecure::BeginCryptoEncapsulation(nsIOutputStream*, char const*, nsIMsgCompFields*, nsIMsgIdentity*, nsIMsgSendReport*, bool) comm/mailnews/extensions/smime/src/nsMsgComposeSecure.cpp:0 scan
12 XUL nsMsgComposeAndSend::BeginCryptoEncapsulation() comm/mailnews/compose/src/nsMsgSend.cpp:1063 scan
13 XUL nsMsgSendPart::Write() comm/mailnews/compose/src/nsMsgSendPart.cpp:448 scan
14 XUL SharedStub scan
15 XUL nsMsgProgress::OnStatusChange(nsIWebProgress*, nsIRequest*, nsresult, char16_t const*) comm/mailnews/base/src/nsMsgProgress.cpp:170 scan
16 XUL nsMsgComposeAndSend::GatherMimeAttachments() comm/mailnews/compose/src/nsMsgSend.cpp:834 scan
17 libmozglue.dylib BaseAllocator::malloc(unsigned long) memory/build/mozjemalloc.cpp:4055 scan
18 XUL <name omitted> xpcom/ds/nsSimpleEnumerator.cpp:77 scan
19 XUL nsMsgComposeAndSend::CountCompFieldAttachments() comm/mailnews/compose/src/nsMsgSend.cpp:1704 scan
20 XUL nsIZipReader::COMTypeInfo<nsIZipReader, void>::kIID scan
21 XUL nsMsgComposeAndSend::HackAttachments(nsIArray*, nsIArray*) comm/mailnews/compose/src/nsMsgSend.cpp:2264 scan
22 libmozglue.dylib arena_t::GetNonFullBinRun(arena_bin_t*) memory/build/mozjemalloc.cpp:2675 scan
23 libmozglue.dylib arena_dalloc(void*, unsigned long, arena_t*) memory/build/mozjemalloc.cpp:3376 scan
24 libmozglue.dylib arena_t::GetNonFullBinRun(arena_bin_t*) memory/build/mozjemalloc.cpp:2675 scan
25 libmozglue.dylib arena_t::MallocSmall(unsigned long, bool) memory/build/mozjemalloc.cpp:2864 scan
26 libmozglue.dylib Allocator<MozJemallocBase>::malloc(unsigned long) memory/build/malloc_decls.h:51 scan
27 libmozglue.dylib BaseAllocator::malloc(unsigned long) memory/build/mozjemalloc.cpp:4055 scan
28 libmozglue.dylib Allocator<MozJemallocBase>::malloc(unsigned long) memory/build/malloc_decls.h:51 scan
29 XUL nsMsgComposeAndSend::Init(nsIMsgIdentity*, char const*, nsMsgCompFields*, nsIFile*, bool, bool, int, nsIMsgDBHdr*, char const*, nsTSubstring<char> const&, nsIArray*, nsIArray*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, int) comm/mailnews/compose/src/nsMsgSend.cpp:2791 scan
30 XUL nsMsgComposeAndSend::CreateAndSendMessage(nsIEditor*, nsIMsgIdentity*, char const*, nsIMsgCompFields*, bool, bool, int, nsIMsgDBHdr*, char const*, nsTSubstring<char> const&, nsIArray*, nsIArray*, mozIDOMWindowProxy*, nsIMsgProgress*, nsIMsgSendListener*, nsTSubstring<char16_t> const&, nsTSubstring<char> const&, int) comm/mailnews/compose/src/nsMsgSend.cpp:3706 scan
31 XUL hexCharsUpper scan
32 XUL nsMsgCompose::SendMsgToServer(int, nsIMsgIdentity*, char const*) comm/mailnews/compose/src/nsMsgCompose.cpp:1209 scan
33 XUL hexCharsUpper scan
34 XUL xpt::detail::sMethods scan
35 XUL morkWriter_kHexDigits scan
36 XUL nsIZipReader::COMTypeInfo<nsIZipReader, void>::kIID scan
37 XUL SharedStub scan
38 XUL nsMsgProgress::OnStateChange(nsIWebProgress*, nsIRequest*, unsigned int, nsresult) comm/mailnews/base/src/nsMsgProgress.cpp:138 scan
39 XUL nsMsgCompose::SendMsg(int, nsIMsgIdentity*, char const*, nsIMsgWindow*, nsIMsgProgress*) comm/mailnews/compose/src/nsMsgCompose.cpp:1404 scan
40 libmozglue.dylib arena_t::MallocSmall(unsigned long, bool) memory/build/mozjemalloc.cpp:2864 scan
41 XUL nsIZipReader::COMTypeInfo<nsIZipReader, void>::kIID scan

Comment 4

[Alan Batie]

Yes, smime

Comment 5

[Magnus Melin [:mkmelin]]

https://searchfox.org/mozilla-central/rev/828f2319c0195d7f561ed35533aef6fe183e68e3/security/nss/lib/smime/cmsencode.c#408 doesn't look like it could crash unless another thread killed cinfo in between the calls

Comment 6

[Wayne Mery (:wsmwk)]

Alan, are you still able to cause the crash?

Comment 7

[Wayne Mery (:wsmwk)]

Alan wrote "The one at home is 78.6.0, so I apparently reverted from the beta and haven't had the problem." and there are no crashes in recent months, so => WFM

Comment 8

[Alan Batie]

Just upgraded to 91.4.1 and no problems sending

Comment 9

[Kai Engert (:KaiE:)]

The problem only happens if you get certain failures, and then try again to send.
I found the cause.