1660556 - Crash when viewing a message with an encrypted attachment [@ mime_LineBuffer via MimeHandleDecryptedOutput

Status: RESOLVED DUPLICATE of bug 1665475

(MailNews Core :: Security: OpenPGP, defect)

Description

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:79.0) Gecko/20100101 Firefox/79.0

Steps to reproduce:

View a message with an OpenPGP encrypted attachment.

Actual results:

Thunderbird crashes.

A crashreport can be found at https://crash-stats.mozilla.org/report/index/13fe63ff-a7f7-4592-9740-00dce0200821

I'm not sure if this is related to one of the following!?

bug 168577, bug 174460

It seams that it doesn't matter, if the (outer) message itself is or isn't encrypted and/or signed. Simply the attachment seams to cause thunderbird to crash when it's encrypted. The attachment being signed, also doesn't seam to matter!? Solely the attachment beeing encrypted.

Also, I noticed that a signed attachment seams to loose its signature!? But, this could be another issue?!

Expected results:

The message should be shown and Thunderbird shouldn't crash, of course.

Comment 1

[Wayne Mery (:wsmwk)]

bp-13fe63ff-a7f7-4592-9740-00dce0200821
0 libxul.so mime_LineBuffer comm/mailnews/mime/src/mimebuf.cpp:141
1 libxul.so MimeHandleDecryptedOutput(char const*, int, void*) comm/mailnews/mime/src/mimecryp.cpp:264
2 libxul.so nsPgpMimeProxy::OutputDecryptedData(char const*, unsigned int) comm/mailnews/mime/cthandlers/pgpmime/nsPgpMimeProxy.cpp:392
3 libxul.so NS_InvokeByIndex
4 libxul.so XPCWrappedNative::CallMethod(XPCCallContext&, XPCWrappedNative::CallMode) js/xpconnect/src/XPCWrappedNative.cpp:1141
5 libxul.so XPC_WN_CallMethod(JSContext*, unsigned int, JS::Value*) js/xpconnect/src/XPCWrappedNativeJSOps.cpp:946
6 libxul.so js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:599
7 libxul.so Interpret(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:3336
8 libxul.so js::RunScript(JSContext*, js::RunState&) js/src/vm/Interpreter.cpp:468
9 libxul.so js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) js/src/vm/Interpreter.cpp:636
10 libxul.so js::Call(JSContext*, JS::Handle<JS::Value>, JS::Handle<JS::Value>, js::AnyInvokeArgs const&, JS::MutableHandle<JS::Value>, js::CallReason) js/src/vm/Interpreter.cpp:681

Comment 2

[Magnus Melin [:mkmelin]]

Looks the same as bug 1659919

Comment 3

[Kai Engert [:KaiE:]]

Patch from bug 1659919 doesn't fix this bug.

I received a test message and can reproduce this crash.
I see very confusing data in the debugger.

At stack level 2, the third parameter passed to function is a completely different value than what the function at stack level 1 sees.
This smells like memory/stack corruption or use of already destroyed data.

Comment 4

[Kai Engert [:KaiE:]]

Kim, did you already send me a test message?

If not, could you please me a test message per the instructions found in bug 1663400.

I found a problem, but it might be triggered by a different scenario. I'd like to ensure I'm aware of all scenarios that trigger it. Thank you.

Comment 5

[Kim A. Brandt]

(In reply to Kai Engert (:KaiE:) from comment #4)

Kim, did you already send me a test message?
...

I've send a test message to: [e-mail], [e-mail] and myself. I can confirm, that the message crashes my Thunderbird 78.2.2. I didn't try with the latest developer version.

I might have been wrong, about not having to encrypt the outer message!?

The simplest steps (scenario) to reproduce this bug, are:

1. send an encrypted message to yourself
2. send a new encrypted, signed (attached public key) message with the message from 1) as an attachment to yourself
3. open the message from 2), which should cause the crash

Comment 6

[Kai Engert [:KaiE:]]

Thank you, this helped. I can reproduce.

This is the same underlying cause as bug 1665475.