Last Comment Bug 320927 - crash when checking pop3 mail [@ msvcrt.dll + 0x378c0 ][@ msvcrt!strlen + 0x20 - nsPop3Protocol::CapaResponse ]
: crash when checking pop3 mail [@ msvcrt.dll + 0x378c0 ][@ msvcrt!strlen + 0x2...
Status: VERIFIED FIXED
: crash, fixed1.8.1, topcrash, verified1.8.0.4, verified1.8.1.3
Product: MailNews Core
Classification: Components
Component: Networking: POP (show other bugs)
: Trunk
: x86 Windows XP
: -- critical with 1 vote (vote)
: ---
Assigned To: David :Bienvenu
:
Mentors:
http://talkback-public.mozilla.org/ta...
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2005-12-20 00:21 PST by Jean-Michel Reghem
Modified: 2011-06-09 14:58 PDT (History)
5 users (show)
timr: blocking1.8.0.4+
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---


Attachments
pop3 protocol log until crash (2.09 KB, application/octet-stream)
2006-04-04 05:46 PDT, Jean-Michel Reghem
no flags Details
pop3 log just after relaunch (4.65 KB, application/octet-stream)
2006-04-04 05:47 PDT, Jean-Michel Reghem
no flags Details
proposed fix (1008 bytes, patch)
2006-04-04 10:31 PDT, David :Bienvenu
mscott: superreview+
dveditz: approval1.8.0.4+
Details | Diff | Splinter Review

Description Jean-Michel Reghem 2005-12-20 00:21:31 PST
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

Talkback ID TB13120132Z

Stack Signature	 msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739
Product ID	Thunderbird15
Build ID	2005120115
Trigger Time	2005-12-19 08:48:45.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	msvcrt.dll + (000378c0)
URL visited	write a mail using strikethrough style and color --> crash
User Comments	
Since Last Crash	160482 sec
Total Uptime	160482 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
msvcrt.dll + 0x378c0 (0x77c478c0)
nsPop3Protocol::CapaResponse  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310]
nsPop3Protocol::ProcessProtocolState  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668]
nsMsgProtocol::OnDataAvailable  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437]
nsInputStreamPump::OnInputStreamReady  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341]
nsOutputStreamReadyEvent::EventHandler  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216]
shdocvw.dll + 0x150c24 (0x778b0c24)
nsWebBrowserPersist::OnProgress  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940]
0x1974c085

Reproducible: Couldn't Reproduce

Steps to Reproduce:

reply a mail in html mode (colors, strikethrough) and suddenly crash when checking pop3 mail [ msvcrt.dll + 0x378c0 ]

there is a lot of bug having msvcrt.dll in signature ... as it is the windows runtime library ...
But i've found no bugs with nsPop3Protocol::CapaResponse
Comment 1 timeless 2005-12-20 04:17:08 PST
nothing makes sure that the string length isn't precisely 4+null, is that what's happening here?
Comment 2 Jean-Michel Reghem 2006-01-25 07:07:17 PST
Same crash:
Here, simply browse with FF ... and then return to TB ...
Click on a mail, try to delete (but i'm not even sure i was trying to delete the mail)

--> TB 14394689 ( http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB14394689Q )

Stack Signature	 msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739
Product ID	Thunderbird15
Build ID	2005120115
Trigger Time	2006-01-25 03:23:56.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	msvcrt.dll + (000378c0)
URL visited	unexpected crash
User Comments	return to tb from ff, just to read mail and crash after attempt to delete a mail i believe
Since Last Crash	339935 sec
Total Uptime	595068 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
msvcrt.dll + 0x378c0 (0x77c478c0)
nsPop3Protocol::CapaResponse  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310]
nsPop3Protocol::ProcessProtocolState  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668]
nsMsgProtocol::OnDataAvailable  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437]
nsInputStreamPump::OnInputStreamReady  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341]
nsOutputStreamReadyEvent::EventHandler  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216]
shdocvw.dll + 0x150c24 (0x778b0c24)
nsWebBrowserPersist::OnProgress  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940]
0x1974c085
Comment 3 Jean-Michel Reghem 2006-01-31 00:23:27 PST
This bug seems to be MY thunderbird top-crasher ... according my talkbacks
here is another one:
Talkback TB14552317G

Stack Signature	 msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739
Product ID	Thunderbird15
Build ID	2005120115
Trigger Time	2006-01-30 06:37:03.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	msvcrt.dll + (000378c0)
URL visited	unexpected crash when i was writing a mail
User Comments	--> during a simple write of mail, suddenly, TB freezed (20") and then, the talkback appairs ...
Since Last Crash	327064 sec
Total Uptime	922132 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
msvcrt.dll + 0x378c0 (0x77c478c0)
nsPop3Protocol::CapaResponse  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310]
nsPop3Protocol::ProcessProtocolState  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668]
nsMsgProtocol::OnDataAvailable  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437]
nsInputStreamPump::OnInputStreamReady  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341]
nsOutputStreamReadyEvent::EventHandler  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216]
shdocvw.dll + 0x150c24 (0x778b0c24)
nsWebBrowserPersist::OnProgress  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940]
0x1974c085







What i did before the crash: "during a simple write of mail, suddenly, TB freezed (20") and then, the talkback appairs ..."

I don't know if it help, but i have 12 pop account (and 9 of those are automatically checked every 10 minutes)
I have also more than 60 rss feeds (every 60 minutes)

If i check my last talkback report: (all with TB 1.5 2005120115)
19/12/2005: Talkback ID TB13120132Z 
25/01/2006: Talkback ID TB14394689Q
and today ... 

so 3 crash on 4 with this build on my machine
Comment 4 Jean-Michel Reghem 2006-01-31 00:30:36 PST
maybe this is related to this 5th top crasher in talback server???

Rank    Stack Signature    %    Total OpenBugs  FixedBugs   120115      Win
5 	msvcrt.dll 	2.85% 	328 		142847 	    328 	328



i know msvcrt.dll can be related to a great number of bugs :-) ... as it is the runtime compenent of windows ...
but, as no bugs are open for this and as it crash 3 times in a month for me, i can supposed that this bug must take a great part of these 328 crash
Comment 5 Jean-Michel Reghem 2006-01-31 01:08:59 PST
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/mailnews/local/src/nsPop3Protocol.cpp&mark=1310&rev=MOZILLA_1_8_BRANCH#1310

1304 bienvenu   1.225         // see RFC 2449, chapter 6.3
1305                          if (!PL_strncasecmp(line, "SASL", 4))
1306                          {
1307                              nsCAutoString responseLine;
1308                              responseLine.Assign(line + 5);
1309                      

1310                              if (responseLine.Find("PLAIN", PR_TRUE) >= 0)  

1311                                  SetCapFlag(POP3_HAS_AUTH_PLAIN);



--> maybe line is just "SASL" with no more after (even \0)
Is there a test in nsCAutoString::Find to check if the internal buffer is null???
Comment 6 Jean-Michel Reghem 2006-02-08 05:21:54 PST
New crash ... thus this bug represent 4 on the last 5 crash on my TB.
Same line http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/mailnews/local/src/nsPop3Protocol.cpp&mark=1310&rev=MOZILLA_1_8_BRANCH#1310 than usual

Talkback ID TB14853337Q

Stack Signature	 msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739
Product ID	Thunderbird15
Build ID	2005120115
Trigger Time	2006-02-07 00:13:37.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	msvcrt.dll + (000378c0)
URL visited	unexpected crash when i was opening a folder in a new window
User Comments	
Since Last Crash	270632 sec
Total Uptime	1192764 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
msvcrt.dll + 0x378c0 (0x77c478c0)
nsPop3Protocol::CapaResponse  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310]
nsPop3Protocol::ProcessProtocolState  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668]
nsMsgProtocol::OnDataAvailable  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437]
nsInputStreamPump::OnInputStreamReady  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341]
nsOutputStreamReadyEvent::EventHandler  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216]
shdocvw.dll + 0x150c24 (0x778b0c24)
nsWebBrowserPersist::OnProgress  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940]
0x1974c085
Comment 7 David Fraser 2006-02-09 00:05:39 PST
URL contains query for Talkback, there are 46 identical tracebacks there.
Confirming as NEW
Comment 8 Jean-Michel Reghem 2006-02-09 06:07:36 PST
aaaah ... cool, it is "NEW" now :-)
--> last crash yesterday: TB14906208Q
Comment 10 Jean-Michel Reghem 2006-03-17 00:08:01 PST
thanks to the new talkback server, with the feature "search in top 5 frame" of jay ( http://weblogs.mozillazine.org/qa/archives/2006/03/dig_deeper_into_crashesnow_you.html ), you can see that this bug has generated 26 crash report in one day from 2006-03-15 22:41 to 2006-03-16 20:20 ...


http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stack&match=contains&searchfor=nsPop3Protocol%3A%3ACapaResponse+&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
Comment 11 David :Bienvenu 2006-03-17 08:53:52 PST
Is everyone using SASL authentication, i.e., GSSAPI auth? If anyone having this bug is just using a single pop3 server, a pop3 protocol log might be helpful:

follow these instructions, subsituting pop3 for protocol.

http://www.mozilla.org/quality/mailnews/mail-troubleshoot.html#pop3
Comment 12 Jean-Michel Reghem 2006-03-19 12:10:44 PST
all pop3 are single pop3 server ... but they are 3 pop in SSL (3 gmail account)
I will enable log tomorrow
Comment 13 Jean-Michel Reghem 2006-04-04 05:44:45 PDT
hello ...

New crash today:
TB17155216Z
Stack Signature	 msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739
Product ID	Thunderbird15
Build ID	2005120115
Trigger Time	2006-04-04 02:11:17.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	msvcrt.dll + (000378c0)
URL visited	unexpected crash
User Comments	
Since Last Crash	275922 sec
Total Uptime	2686782 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
msvcrt.dll + 0x378c0 (0x77c478c0)
nsPop3Protocol::CapaResponse  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310]
nsPop3Protocol::ProcessProtocolState  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668]
nsMsgProtocol::OnDataAvailable  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437]
nsInputStreamPump::OnInputStreamReady  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341]
nsOutputStreamReadyEvent::EventHandler  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216]
shdocvw.dll + 0x150c24 (0x778b0c24)
nsWebBrowserPersist::OnProgress  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940]
0x1974c085



this times ... with log
--> see attachement after
Comment 14 Jean-Michel Reghem 2006-04-04 05:46:34 PDT
Created attachment 217137 [details]
pop3 protocol log until crash

pop3 protocol log until crash

it is strange ... the log is quite big (1.3Mo ...) but all the beginning is empty

You can see a SASL trace at the end ...
Comment 15 Jean-Michel Reghem 2006-04-04 05:47:47 PDT
Created attachment 217138 [details]
pop3 log just after relaunch

--> here is a clean log just after a relaunch
(and automatically download of new messages)
Comment 16 David :Bienvenu 2006-04-04 10:01:38 PDT
thanks for the log; that explains it completely. We're expecting something like SASL GSSAPI but the server is just saying "SASL". I believe that's a server bug, i.e., it's sending invalid protocol (not 100% sure of that), but we shouldn't crash. I'll come up with a fix, and also try to contact the dovecot folks.
Comment 17 David :Bienvenu 2006-04-04 10:31:05 PDT
Created attachment 217173 [details] [diff] [review]
proposed fix

make sure we have some text after "SASL" before trying to parse it.
Comment 18 Jean-Michel Reghem 2006-04-05 00:01:30 PDT
Really really good job David ... thanks
As it was a topcrasher bug for me, it will be a good reason to test TB 2.0 nighlty...

I will keep the log after the upgrade to be sure the problem is solved ...
Comment 19 Tim Riley [:timr] 2006-04-12 11:17:33 PDT
Crash - Nom approved
Comment 20 Daniel Veditz [:dveditz] 2006-04-19 12:11:37 PDT
Comment on attachment 217173 [details] [diff] [review]
proposed fix

approved for 1.8.0 branch, a=dveditz for drivers
Comment 21 juan becerra [:juanb] 2006-05-23 15:15:20 PDT
David, Jean-Michel, can you provide a test case for this problem or retest using a build from the latest release candidates?
Comment 22 David :Bienvenu 2006-05-23 15:26:34 PDT
Unfortunately, I don't have a test case - I just fixed it by code inspection.
Comment 23 Jean-Michel Reghem 2006-05-23 23:29:53 PDT
(In reply to comment #21)
> David, Jean-Michel, can you provide a test case for this problem or retest
> using a build from the latest release candidates?
> 

i will update to nightly 1.8.0.4 ... but as this bug was totally random (it depends from a server bug), i don't have a testcase ... For example, i'm in 1.8.0.2 and the last crash is more than 1,5 month ago ... It was with TB 1.5 (build 2005120115) ... and since, i've updated to 1.5.0.2 (2006050105) ... So this patch was not yet in this build, but TB doesn't crash anymore ... 
Comment 24 Jean-Michel Reghem 2006-06-07 00:34:43 PDT
no more problems, seems correctly fixed --> verified
Comment 25 Carsten Book [:Tomcat] - PTO-back Sept 4th 2007-03-30 12:37:51 PDT
verified fixed for 1.8.1.3 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 ID:2007032620 (Thunderbird 2 RC1), no crash when checking various POP3 Accounts.

Also verified fixed for 1.8.0.4 by the reporter on comment #24 , thanks jean-michel.

Note You need to log in before you can comment on or make changes to this bug.