173711 - Crash when reading S/Mime message with OCSP enabled

Status: RESOLVED WORKSFORME

(MailNews Core :: Security: S/MIME, defect, P2)

Description

[Kai Engert [:KaiE:]]

Enable OCSP.
Open a particular S/Mime message (I'll attach it).
Mozilla crashes (I'll also attach a stack trace).

Comment 1

[Kai Engert [:KaiE:]]

Attachment: Mail message that triggers a crash

Comment 2

[Kai Engert [:KaiE:]]

Attachment: Stack

Comment 3

[Kai Engert [:KaiE:]]

I filed NSS bug 173715.

Comment 4

[Kai Engert [:KaiE:]]

actually, it's -> S/Mime

Comment 5

[Wan-Teh Chang]

Comment on attachment 102442 [details]
Stack

Kai, could you print the value of *addr in pt_Connect?

Comment 6

[Julien Pierre]

Kai,

Could you attach the message in mozilla folder format ?
I'm not sure how to transfer your attachment as is into mozilla to test this
problem.

Thanks.

Comment 7

[Kai Engert [:KaiE:]]

> Kai, could you print the value of *addr in pt_Connect?

#10 0x40347c91 in pt_Connect (fd=0x8a463b8, addr=0xbfffeca0, timeout=30000)
    at /home/kaie/trunk/mozilla/nsprpub/pr/src/pthreads/ptio.c:1531
1531        PR_ASSERT(IsValidNetAddr(addr) == PR_TRUE);
Current language:  auto; currently c
(gdb) print *addr
$2 = {raw = {family = 0, data = '\0' <repeats 13 times>}, inet = {family = 0,
port = 0, ip = 0, pad = "\0\0\0\0\0\0\0"}, ipv6 = {
    family = 0, port = 0, flowinfo = 0, ip = {_S6_un = {_S6_u8 = '\0' <repeats
15 times>, _S6_u16 = {0, 0, 0, 0, 0, 0, 0, 0},
        _S6_u32 = {0, 0, 0, 0}, _S6_u64 = {0, 0}}}, scope_id = 0}, local =
{family = 0, path = '\0' <repeats 103 times>}}

Comment 8

[Kai Engert [:KaiE:]]

Julien, simply add one line before the message, move it to your "Local Folders"
directory, and the file will be understood as a mailbox file:

The added line is:

From -

Comment 9

[Kai Engert [:KaiE:]]

Hmm, it appears I can only reproduce this crash with a debug build.

Comment 10

[Brant Gurganus]

By the definitions on <http://bugzilla.mozilla.org/bug_status.html#severity> and
<http://bugzilla.mozilla.org/enter_bug.cgi?format=guided>, crashing and dataloss
bugs are of critical or possibly higher severity.  Only changing open bugs to
minimize unnecessary spam.  Keywords to trigger this would be crash, topcrash,
topcrash+, zt4newcrash, dataloss.

Comment 11

[John G. Myers]

Mass reassign ssaux bugs to nobody

Comment 12

[Chandrasekar Kannan]

non-critical as it happens only with a debug build.

Comment 13

[Kai Engert [:KaiE:]]

Because OCSP is important, let's retest this for 1.8.1, because the underlying NSS bug is said to be fixed. Most likely this is worksforme.

Comment 14

[Kai Engert [:KaiE:]]

using mozilla mail from branch 1.8 i no longer crash using the attached email, neither in debug nor optimized build

worksforme