199049 - browser crashes when viewing a page with embedded "binary text"

Status: RESOLVED DUPLICATE of bug 213734

(SeaMonkey :: General, defect)

Description

[Johannes Berg]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; Debian/1.3.3.20030317-1) Gecko/20030305 Galeon/1.3.3
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; Debian/1.3.3.20030317-1) Gecko/20030305 Galeon/1.3.3

The problem here was that apache sends README files inline, when viewing the
directory listing. In this case, a README.gz file was present, which for some
reason was also served inline. But only to mozilla, not to wget (go figure), but
also to lynx. I'm clueless as to why, so I'm attaching the offending file.

Reproducible: Always

Steps to Reproduce:
1. close everything important that is open in mozilla
2. load the attached file
3. scroll down (might not be necessary depending on screensize

Actual Results:  
Mozilla crashes. hard.

Expected Results:  
Display the file, even though it contains garbage.

Mozilla 1.3 handles this situation fine.
I suspect that this is due to character set handling, but don't know where to
file it, please reassign to a more appropriate component.

running in gdb (I hacked the mozilla-snapshot script)

The program 'mozilla-bin' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadLength (poly request too large or internal Xlib length erro'.
  (Details: serial 8106 error_code 16 request_code 84 minor_code 0)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)


I did that, and when running with --sync no crash happens.

Comment 1

[Johannes Berg]

Attachment: page that contains binary and crashes 1.4a.

Comment 2

[Matthias Versen [:Matti]]

-> Blizzard (nad possible dupe of the xfree bug)

Comment 3

[Andrew Schultz]

this might be a dupe of bug 175108, which has already been fixed on the trunk
for 1.4a.

Comment 4

[kmike]

I just stumbled upon this crash. GTK2+Xft Mozilla/5.0 (X11; U; Linux i686;
en-US; rv:1.6a), built from yesterday's trunk.

I received a plaintext base64-encoded email which apparently has a text portion
attached automatically by email software, resulting in some garbage after text.
When I click on it, mozilla crashes immediately. Running with --sync reveals
doesn't crash when I view message, but hitting "Reply" crashed with:

The program 'mozilla-bin' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadLength (poly request too large or internal Xlib length erro'.
  (Details: serial 70241 error_code 16 request_code 3 minor_code 0)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)

I'll attach slightly edited message and backtrace of mozilla --sync (sorry, no
debugging symbols, have no disk space for that...)

Steps for reproduce:
1. Copy downloaded message to <profile dir>/Mail/Local Folders/Crash
2. Launch Mailnews, select Local Folders->Crash
3. Select the message

BTW, viewing reporter's attachment doesn't crash here.

Comment 5

[kmike]

Attachment: The corrupted message causing crashes

Comment 6

[kmike]

Attachment: Backtrace of crash

Comment 7

[Christopher Blizzard (:blizzard)]

Sounds like a dup.

*** This bug has been marked as a duplicate of 213734 ***