302888 - Invalid free occurs when using gmail smime

Status: RESOLVED INCOMPLETE

(Core :: XPConnect, defect)

Description

[Erik Jensen]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6

When trying to send an encrypted message with gmail smime on linux, a message
such as "*** glibc detected *** free(): invalid pointer: 0x09107de0 ***" is
printed on the console.  Depending on the system configuration, this may or may
not be fatal.  On my system, firefox gets sent SIGABRT and crashes.  This
extension is written entirely in javascript, so it should not be able to produce
an invalid free.

Reproducible: Always

Steps to Reproduce:
1. Get a gmail account
2. Get a personal e-mail certificate and install it.  (eg. from Thawte)
3. Install the gmail smime extension.
4. Log into gmail account
5. Compose a message to the address the certificate is for and verify that the
lock icon from gmail smime is shown as locked.
6. Press the send button.

Actual Results:  
Firefox freezes up and "*** glibc detected *** free(): invalid pointer:
0x09107de0 ***" is printed on the console.

Expected Results:  
Sent the encrypted message, or at least not generated the invalid free and kept
running.

Setting the environment variable MALLOC_CHECK_ to 1 makes the error non-fatal on
my system, and the message is sent.  I am using version 0.1.3 of the extension,
but experienced the same problem with 0.1.2.

Comment 1

[Erik Jensen]

Attachment: Full backtrace from after crash

Comment 2

[Erik Jensen]

Comment on attachment 191159 [details]
Full backtrace from after crash

The error was:
*** glibc detected *** free(): invalid pointer: 0x08c4a760 ***

Comment 3

[timeless]

reporter: can you dig from the js_Interpret or nearby frames for
cx->fp(down->)*->script->filename
                       ->lineNo

and also provide a url for this extension.

Comment 4

[Erik Jensen]

(In reply to comment #3)
> reporter: can you dig from the js_Interpret or nearby frames for
> cx->fp(down->)*->script->filename
>                        ->lineNo
Where can I find instructions for this?

> 
> and also provide a url for this extension.

http://richard.jones.name/google-hacks/gmail-smime/gmail-smime.html

Comment 5

[timeless]

in gdb, p(rint), see http://www.mozilla.org/unix/debugging-faq.html

Comment 6

[Erik Jensen]

(In reply to comment #5)
> in gdb, p(rint), see http://www.mozilla.org/unix/debugging-faq.html

(gdb) p cx->fp->down->script->filename
$1 = 0x851014d "chrome://gmailsmime/content/smimesender.js"

what do I need to type to get the line number?

Comment 7

[James Ross]

p cx->fp->down->script->lineNo

Comment 8

[Erik Jensen]

(In reply to comment #7)

That does not work for me:
(gdb) p cx->fp->down->script->lineNo
There is no member named lineNo.

I am using a debug version of 1.0.6 if that helps.

Comment 9

[James Ross]

I only suggested what comment #3 said. I think it may be lineno instead of
lineNo, though, so try this:

p cx->fp->down->script->lineno

Comment 10

[Erik Jensen]

(In reply to comment #9)

Thanks.

(gdb) p cx->fp->down->script->lineno
$2 = 184

Comment 11

[Erik Jensen]

Unfortunately, I can not currently test this bug as newer versions of
the extension use a completely different method to send messages, and so
would not exhibit the same behavior.  I looked briefly but was unable to
find an old version of the plugin, but it would probably not be usable
anyway, due to changes in Gmail that occur.

Comment 12

[Wayne Mery (:wsmwk)]

(In reply to comment #11)
> Unfortunately, I can not currently test this bug as newer versions of
> the extension use a completely different method to send messages, and so
> would not exhibit the same behavior.  I looked briefly but was unable to
> find an old version of the plugin, but it would probably not be usable
> anyway, due to changes in Gmail that occur.

=> incomplete

please reopen if you still see problem or prospects for follow up