317536 - Thunderbird crashes when displaying a special gif image [@ do_lzw]

Status: VERIFIED DUPLICATE of bug 328509

(Core :: Graphics: ImageLib, defect)

Description

[Jean-Michel Reghem]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla Thunderbird version 1.5 (20051107)

See Talkback : TB12130349Z


Stack Signature	 do_lzw f940d597
Product ID	Thunderbird15
Build ID	2005110712
Trigger Time	2005-11-22 04:11:25.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	thunderbird.exe + (000ee441)
URL visited	just delete 5 mails in a junk folder (pop account)
User Comments	just delete 5 mails in a junk folder (pop account) and then --> crash
Since Last Crash	301758 sec
Total Uptime	301758 sec
Trigger Reason	Access violation
Source File, Line No.	e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/modules/libpr0n/decoders/gif/GIF2.cpp, line 347
Stack Trace 	
do_lzw  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/modules/libpr0n/decoders/gif/GIF2.cpp, line 347]
gif_write  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/modules/libpr0n/decoders/gif/GIF2.cpp, line 460]

Reproducible: Couldn't Reproduce




It was a junk folder of a pop account.
5 junk mails
--> press 5 times on delete key and crash

maybe one mail had a bad gif into and TB crash during display ...

sorry i couldn't reproduce it ...

Comment 1

[Frank Wein [:mcsmurf]]

You do not happen to have this bad mail still available (Note: It only really deletes the mails if you click on Compress, otherwise you should still find the mail in your profile somewhere, like Junk or Trash folder?).

Comment 2

[Jean-Michel Reghem]

no, i'm really sorry.
This crash occured yesterday ... and i was waiting the trackback report be available ...
and like an idiot, this morning i delete all the trash folders (like every morning) and click yes on compress ...

:-(

Comment 3

[Jean-Michel Reghem]

Same bug  but i cannot reproduce it or find the mail ...

Here, the process was:
* Running filter on a big folder (more than 1000 mails)
* In the same time, "junkify" a mail and delete 2

--> talkback TB13732873Y

--> crash

Stack Signature	 do_lzw f940d597
Product ID	Thunderbird15
Build ID	2005120115
Trigger Time	2006-01-09 00:19:43.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	thunderbird.exe + (000ee563)
URL visited	write a mail using strikethrough style and color --> crash
User Comments	Run filters on folders and in the same time delete mails in the same big folder
Since Last Crash	94651 sec
Total Uptime	255133 sec
Trigger Reason	Access violation
Source File, Line No.	e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/modules/libpr0n/decoders/gif/GIF2.cpp, line 344
Stack Trace 	
do_lzw  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/modules/libpr0n/decoders/gif/GIF2.cpp, line 344]
gif_write  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/modules/libpr0n/decoders/gif/GIF2.cpp, line 460]

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+2]]

I had the same crash today while marking unread junk as read.

talkback: TB15108734K

It's exactly the same small stack trace. Looking at the topcrashers for Thunderbird 1.5 this one is on place 7 with 2632 crash reports.

While searching the database for other bugs I noticed bug 209079. I don't dupe and reopen the other one cause it's still to old and resolved since a long time. I think we should continue on this one. So confirming with Thunderbird 1.5 WinXP. I'll try to fetch the guilty gif image tomorrow.

Comment 5

[Henrik Skupin [:whimboo][⌚️UTC+2]]

I get closer to the problem. I can reproduce the crash with the attachment I will add immediately. It does only occur once within a windows session. You have to restart to see the behavior again! I don't know if there is any malicious code inside the gif image so please be aware of - it's still a junk mail. Any security plans we have to follow?

Comment 6

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Attachment: HTML Message with included gif image which will crash thunderbird!!

I forgot to mention that you have to enable "Display Attachments Inline" and "Original HTML" for the message body. By this configuration Thunderbird crashes me every time.

Comment 7

[Daniel Veditz [:dveditz]]

*** This bug has been marked as a duplicate of 328509 ***