2017922 - Thunderbird crashes when particular command line arguments are passed

Status: RESOLVED FIXED

(Thunderbird :: Upstream Synchronization, defect)

Description

[kai]

Steps to reproduce:

• Set Thunderbird as the handler for mailto: URLs
• Click on a mailto: URL in Firefox

Thunderbird (ESR) is installed via the Microsoft Store.
I have only a single extension installed (Birthday Calendar).

Actual results:

Apparently nothing.
The event viewer shows an Application Error and a Windows Error Reporting message:

P1: MozillaThunderbird.MZLA_140.7.1.0_x64__h5892qc0xkpca
P2: praid:App
P3: 140.7.1.0
P4: 6973ebcc
P5: thunderbird.exe
P6: 140.7.1.0
P7: 6973ebcc
P8: c0000005
P9: 0000000000001ebc
P10:

Expected results:

Thunderbird should not crash, but open the mail compose window.

Comment 1

[Magnus Melin [:mkmelin]]

Please provide the crash id. See https://support.mozilla.org/en-US/kb/thunderbird-crashes
Without it there's not much we can do.

Comment 2

[kai]

Sadly, I don't have a crash report ID.
Thunderbird seems to crash immediately when being started via the mailto: protocol and the crash reporter never appears.
In fact, no Thunderbird creates no crash reports at all.
This also means that I have no chance to attach WinDbg.

Is there any other way I can find more information about the crash?

Comment 3

[kai]

I found the postmortem debugging setting in WinDbg and managed to gather a stacktrace:

 # Child-SP          RetAddr               Call Site
00 (Inline Function) --------`--------     thunderbird!mozilla::internal::strimatch(char * lowerstr = 0x00000000`00000000 "", char * mixedstr = 0x0000020f`7b703211 "url")+0xda [/builds/worker/workspace/obj-build/dist/include/mozilla/CmdLineAndEnvUtils.h @ 97] 
01 (Inline Function) --------`--------     thunderbird!mozilla::internal::MatchesAnyOf(char * unknown = 0x0000020f`7b703211 "url", char *(*)[3] known = 0x00000053`5ebff670)+0xdd [/builds/worker/workspace/obj-build/dist/include/mozilla/CmdLineAndEnvUtils.h @ 232] 
02 00000053`5ebff5e0 00007ff6`df381653     thunderbird!mozilla::internal::EnsureCommandlineSafeImpl<char,const char *[3],`unnamed struct at /builds/worker/workspace/obj-build/dist/include/mozilla/CmdLineAndEnvUtils.h:319:3'>(int aArgc = 0n4, char ** aArgv = 0x0000020f`7b71a460, char *(*)[3] requiredParams = 0x00000053`5ebff670, struct mozilla::internal::EnsureCommandlineSafeImpl<char,const char *[3]>::<unnamed-type-emptyContainer> * optionalParams = <Value unavailable error>)+0x35c [/builds/worker/workspace/obj-build/dist/include/mozilla/CmdLineAndEnvUtils.h @ 290] 
03 (Inline Function) --------`--------     thunderbird!mozilla::internal::EnsureCommandlineSafeImpl(int aArgc = 0n4, char ** aArgv = 0x0000020f`7b71a460, char *(*)[3] requiredParams = <Value unavailable error>, void * _ = <Value unavailable error>)+0xa [/builds/worker/workspace/obj-build/dist/include/mozilla/CmdLineAndEnvUtils.h @ 323] 
04 (Inline Function) --------`--------     thunderbird!mozilla::EnsureCommandlineSafe(int aArgc = 0n4, char ** aArgv = 0x0000020f`7b71a460, char *(*)[3] requiredParams = <Value unavailable error>, void ** optionalParams = <Value unavailable error>)+0xa [/builds/worker/workspace/obj-build/dist/include/mozilla/CmdLineAndEnvUtils.h @ 333] 
05 (Inline Function) --------`--------     thunderbird!do_main(int argc = <Value unavailable error>, char ** argv = <Value unavailable error>, char ** envp = <Value unavailable error>)+0x265 [/builds/worker/checkouts/gecko/comm/mail/app/nsMailApp.cpp @ 219] 
06 00000053`5ebff600 00007ff6`df3811de     thunderbird!NS_internal_main(int argc = <Value unavailable error>, char ** argv = <Value unavailable error>, char ** envp = <Value unavailable error>)+0x413 [/builds/worker/checkouts/gecko/comm/mail/app/nsMailApp.cpp @ 391] 
07 00000053`5ebff7d0 00007ff6`df3c2e38     thunderbird!wmain(int argc = 0n4, wchar_t ** argv = <Value unavailable error>)+0x1de [/builds/worker/checkouts/gecko/toolkit/xre/nsWindowsWMain.cpp @ 151] 
08 (Inline Function) --------`--------     thunderbird!invoke_main(void)+0x22 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 90] 
09 00000053`5ebff880 00007ffb`6227e8d7     thunderbird!__scrt_common_main_seh(void)+0x10c [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 288] 
0a 00000053`5ebff8c0 00007ffb`6350c40c     KERNEL32!BaseThreadInitThunk+0x17
0b 00000053`5ebff8f0 00000000`00000000     ntdll!RtlUserThreadStart+0x2c

The command line looks like this:
"C:\Program Files\WindowsApps\MozillaThunderbird.MZLA_140.7.1.0_x64__h5892qc0xkpca\VFS\ProgramFiles\MZLA Package Root\thunderbird.exe" -osint -url "mailto:<redacted>"

With this information, I found that the actual problem is a wrongly defined AppxManifest.xml in the Microsoft Store MSIX. This is already reported in bug 1876691.

However, I would argue that it is also a bug that wrong command line arguments can crash Thunderbird.
This can easily be reproduced by running thunderbird.exe -osint -foo -bar.
The root cause for the crash seems to be in do_main, in particular the nullptr in the acceptableParams array. I have no idea why this nullptr is there, but it ends up in mozilla::internal::strimatch where it is dereferenced, eventually crashing Thunderbird.

Comment 4

[Hartmut Welpmann [:welpy-cw]]

(In reply to kai from comment #3)

However, I would argue that it is also a bug that wrong command line arguments can crash Thunderbird.
This can easily be reproduced by running thunderbird.exe -osint -foo -bar.
The root cause for the crash seems to be in do_main, in particular the nullptr in the acceptableParams array. I have no idea why this nullptr is there, but it ends up in mozilla::internal::strimatch where it is dereferenced, eventually crashing Thunderbird.

Thanks for the analysis. The way acceptableParams had to be defined was apparently changed in bug 1733821, see this revision. Simple fix follows.

Comment 5

[Hartmut Welpmann [:welpy-cw]]

Attachment: Bug 2017922 - Port bug 1733821: Adapt cmd line sanitation params. r=mkmelin

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/073725232e7d
Port bug 1733821: Adapt cmd line sanitation params. r=mkmelin