Closed Bug 320927 Opened 20 years ago Closed 20 years ago

crash when checking pop3 mail [@ msvcrt.dll + 0x378c0 ][@ msvcrt!strlen + 0x20 - nsPop3Protocol::CapaResponse ]

Categories

(MailNews Core :: Networking: POP, defect)

Product:
MailNews Core
Component:
Networking: POP
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

(Not tracked)

Status:
VERIFIED FIXED

People

(Reporter: jeanmichel.reghem, Assigned: Bienvenu)

References

(
URL
)

Details

(5 keywords)

Crash Data

Attachments

(3 files)

pop3 protocol log until crash
2.09 KB, application/octet-stream
Details
pop3 log just after relaunch
4.65 KB, application/octet-stream
Details
proposed fix
1008 bytes, patch
mscott
: superreview+
dveditz
: approval1.8.0.4+
Details | Diff | Splinter Review
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5 Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5 Talkback ID TB13120132Z Stack Signature msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739 Product ID Thunderbird15 Build ID 2005120115 Trigger Time 2005-12-19 08:48:45.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module msvcrt.dll + (000378c0) URL visited write a mail using strikethrough style and color --> crash User Comments Since Last Crash 160482 sec Total Uptime 160482 sec Trigger Reason Access violation Source File, Line No. N/A Stack Trace msvcrt.dll + 0x378c0 (0x77c478c0) nsPop3Protocol::CapaResponse [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310] nsPop3Protocol::ProcessProtocolState [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668] nsMsgProtocol::OnDataAvailable [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350] nsInputStreamPump::OnStateTransfer [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437] nsInputStreamPump::OnInputStreamReady [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341] nsOutputStreamReadyEvent::EventHandler [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216] shdocvw.dll + 0x150c24 (0x778b0c24) nsWebBrowserPersist::OnProgress [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940] 0x1974c085 Reproducible: Couldn't Reproduce Steps to Reproduce: reply a mail in html mode (colors, strikethrough) and suddenly crash when checking pop3 mail [ msvcrt.dll + 0x378c0 ] there is a lot of bug having msvcrt.dll in signature ... as it is the windows runtime library ... But i've found no bugs with nsPop3Protocol::CapaResponse
nothing makes sure that the string length isn't precisely 4+null, is that what's happening here?
Keywords: crash
Summary: reply a mail in html mode (colors, strikethrough) and suddenly crash when checking pop3 mail [ msvcrt.dll + 0x378c0 ] → reply a mail in html mode (colors, strikethrough) and suddenly crash when checking pop3 mail [@ msvcrt.dll + 0x378c0 ][@ msvcrt!strlen + 0x20 - nsPop3Protocol::CapaResponse ]
Same crash: Here, simply browse with FF ... and then return to TB ... Click on a mail, try to delete (but i'm not even sure i was trying to delete the mail) --> TB 14394689 ( http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB14394689Q ) Stack Signature msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739 Product ID Thunderbird15 Build ID 2005120115 Trigger Time 2006-01-25 03:23:56.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module msvcrt.dll + (000378c0) URL visited unexpected crash User Comments return to tb from ff, just to read mail and crash after attempt to delete a mail i believe Since Last Crash 339935 sec Total Uptime 595068 sec Trigger Reason Access violation Source File, Line No. N/A Stack Trace msvcrt.dll + 0x378c0 (0x77c478c0) nsPop3Protocol::CapaResponse [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310] nsPop3Protocol::ProcessProtocolState [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668] nsMsgProtocol::OnDataAvailable [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350] nsInputStreamPump::OnStateTransfer [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437] nsInputStreamPump::OnInputStreamReady [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341] nsOutputStreamReadyEvent::EventHandler [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216] shdocvw.dll + 0x150c24 (0x778b0c24) nsWebBrowserPersist::OnProgress [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940] 0x1974c085
Summary: reply a mail in html mode (colors, strikethrough) and suddenly crash when checking pop3 mail [@ msvcrt.dll + 0x378c0 ][@ msvcrt!strlen + 0x20 - nsPop3Protocol::CapaResponse ] → crash when checking pop3 mail [@ msvcrt.dll + 0x378c0 ][@ msvcrt!strlen + 0x20 - nsPop3Protocol::CapaResponse ]
This bug seems to be MY thunderbird top-crasher ... according my talkbacks here is another one: Talkback TB14552317G Stack Signature msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739 Product ID Thunderbird15 Build ID 2005120115 Trigger Time 2006-01-30 06:37:03.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module msvcrt.dll + (000378c0) URL visited unexpected crash when i was writing a mail User Comments --> during a simple write of mail, suddenly, TB freezed (20") and then, the talkback appairs ... Since Last Crash 327064 sec Total Uptime 922132 sec Trigger Reason Access violation Source File, Line No. N/A Stack Trace msvcrt.dll + 0x378c0 (0x77c478c0) nsPop3Protocol::CapaResponse [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310] nsPop3Protocol::ProcessProtocolState [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668] nsMsgProtocol::OnDataAvailable [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350] nsInputStreamPump::OnStateTransfer [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437] nsInputStreamPump::OnInputStreamReady [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341] nsOutputStreamReadyEvent::EventHandler [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216] shdocvw.dll + 0x150c24 (0x778b0c24) nsWebBrowserPersist::OnProgress [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940] 0x1974c085 What i did before the crash: "during a simple write of mail, suddenly, TB freezed (20") and then, the talkback appairs ..." I don't know if it help, but i have 12 pop account (and 9 of those are automatically checked every 10 minutes) I have also more than 60 rss feeds (every 60 minutes) If i check my last talkback report: (all with TB 1.5 2005120115) 19/12/2005: Talkback ID TB13120132Z 25/01/2006: Talkback ID TB14394689Q and today ... so 3 crash on 4 with this build on my machine
maybe this is related to this 5th top crasher in talback server??? Rank Stack Signature % Total OpenBugs FixedBugs 120115 Win 5 msvcrt.dll 2.85% 328 142847 328 328 i know msvcrt.dll can be related to a great number of bugs :-) ... as it is the runtime compenent of windows ... but, as no bugs are open for this and as it crash 3 times in a month for me, i can supposed that this bug must take a great part of these 328 crash
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/mailnews/local/src/nsPop3Protocol.cpp&mark=1310&rev=MOZILLA_1_8_BRANCH#1310 1304 bienvenu 1.225 // see RFC 2449, chapter 6.3 1305 if (!PL_strncasecmp(line, "SASL", 4)) 1306 { 1307 nsCAutoString responseLine; 1308 responseLine.Assign(line + 5); 1309 1310 if (responseLine.Find("PLAIN", PR_TRUE) >= 0) 1311 SetCapFlag(POP3_HAS_AUTH_PLAIN); --> maybe line is just "SASL" with no more after (even \0) Is there a test in nsCAutoString::Find to check if the internal buffer is null???
New crash ... thus this bug represent 4 on the last 5 crash on my TB. Same line http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/mailnews/local/src/nsPop3Protocol.cpp&mark=1310&rev=MOZILLA_1_8_BRANCH#1310 than usual Talkback ID TB14853337Q Stack Signature msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739 Product ID Thunderbird15 Build ID 2005120115 Trigger Time 2006-02-07 00:13:37.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module msvcrt.dll + (000378c0) URL visited unexpected crash when i was opening a folder in a new window User Comments Since Last Crash 270632 sec Total Uptime 1192764 sec Trigger Reason Access violation Source File, Line No. N/A Stack Trace msvcrt.dll + 0x378c0 (0x77c478c0) nsPop3Protocol::CapaResponse [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310] nsPop3Protocol::ProcessProtocolState [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668] nsMsgProtocol::OnDataAvailable [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350] nsInputStreamPump::OnStateTransfer [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437] nsInputStreamPump::OnInputStreamReady [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341] nsOutputStreamReadyEvent::EventHandler [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216] shdocvw.dll + 0x150c24 (0x778b0c24) nsWebBrowserPersist::OnProgress [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940] 0x1974c085
URL contains query for Talkback, there are 46 identical tracebacks there. Confirming as NEW
URL: http://talkback-public.mozilla.org/ta...
Status: UNCONFIRMED → NEW
Ever confirmed: true
aaaah ... cool, it is "NEW" now :-) --> last crash yesterday: TB14906208Q
thanks to the new talkback server, with the feature "search in top 5 frame" of jay ( http://weblogs.mozillazine.org/qa/archives/2006/03/dig_deeper_into_crashesnow_you.html ), you can see that this bug has generated 26 crash report in one day from 2006-03-15 22:41 to 2006-03-16 20:20 ... http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stack&match=contains&searchfor=nsPop3Protocol%3A%3ACapaResponse+&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
Is everyone using SASL authentication, i.e., GSSAPI auth? If anyone having this bug is just using a single pop3 server, a pop3 protocol log might be helpful: follow these instructions, subsituting pop3 for protocol. http://www.mozilla.org/quality/mailnews/mail-troubleshoot.html#pop3
Assignee: mscott → bienvenu
all pop3 are single pop3 server ... but they are 3 pop in SSL (3 gmail account) I will enable log tomorrow
hello ... New crash today: TB17155216Z Stack Signature msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739 Product ID Thunderbird15 Build ID 2005120115 Trigger Time 2006-04-04 02:11:17.0 Platform Win32 Operating System Windows NT 5.1 build 2600 Module msvcrt.dll + (000378c0) URL visited unexpected crash User Comments Since Last Crash 275922 sec Total Uptime 2686782 sec Trigger Reason Access violation Source File, Line No. N/A Stack Trace msvcrt.dll + 0x378c0 (0x77c478c0) nsPop3Protocol::CapaResponse [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310] nsPop3Protocol::ProcessProtocolState [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668] nsMsgProtocol::OnDataAvailable [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350] nsInputStreamPump::OnStateTransfer [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437] nsInputStreamPump::OnInputStreamReady [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341] nsOutputStreamReadyEvent::EventHandler [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216] shdocvw.dll + 0x150c24 (0x778b0c24) nsWebBrowserPersist::OnProgress [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940] 0x1974c085 this times ... with log --> see attachement after
pop3 protocol log until crash it is strange ... the log is quite big (1.3Mo ...) but all the beginning is empty You can see a SASL trace at the end ...
--> here is a clean log just after a relaunch (and automatically download of new messages)
thanks for the log; that explains it completely. We're expecting something like SASL GSSAPI but the server is just saying "SASL". I believe that's a server bug, i.e., it's sending invalid protocol (not 100% sure of that), but we shouldn't crash. I'll come up with a fix, and also try to contact the dovecot folks.
Component: General → Networking: POP
Product: Thunderbird → Core
Version: unspecified → Trunk
Attached patch proposed fix — — Splinter Review
make sure we have some text after "SASL" before trying to parse it.
Attachment #217173 - Flags: superreview?(mscott)
Attachment #217173 - Flags: superreview?(mscott) → superreview+
Status: NEW → RESOLVED
Closed: 20 years ago
Keywords: fixed1.8.1
Resolution: --- → FIXED
Attachment #217173 - Flags: approval1.8.0.3?
Really really good job David ... thanks As it was a topcrasher bug for me, it will be a good reason to test TB 2.0 nighlty... I will keep the log after the upgrade to be sure the problem is solved ...
Flags: blocking1.8.0.3?
Crash - Nom approved
Flags: blocking1.8.0.3? → blocking1.8.0.3+
Comment on attachment 217173 [details] [diff] [review] proposed fix approved for 1.8.0 branch, a=dveditz for drivers
Attachment #217173 - Flags: approval1.8.0.3? → approval1.8.0.3+
Keywords: fixed1.8.0.3
David, Jean-Michel, can you provide a test case for this problem or retest using a build from the latest release candidates?
Unfortunately, I don't have a test case - I just fixed it by code inspection.
(In reply to comment #21) > David, Jean-Michel, can you provide a test case for this problem or retest > using a build from the latest release candidates? > i will update to nightly 1.8.0.4 ... but as this bug was totally random (it depends from a server bug), i don't have a testcase ... For example, i'm in 1.8.0.2 and the last crash is more than 1,5 month ago ... It was with TB 1.5 (build 2005120115) ... and since, i've updated to 1.5.0.2 (2006050105) ... So this patch was not yet in this build, but TB doesn't crash anymore ...
no more problems, seems correctly fixed --> verified
Status: RESOLVED → VERIFIED
verified fixed for 1.8.1.3 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 ID:2007032620 (Thunderbird 2 RC1), no crash when checking various POP3 Accounts. Also verified fixed for 1.8.0.4 by the reporter on comment #24 , thanks jean-michel.
Keywords: fixed1.8.0.4 → verified1.8.0.4, verified1.8.1.3
Product: Core → MailNews Core
Crash Signature: [@ msvcrt.dll + 0x378c0 ] [@ msvcrt!strlen + 0x20 - nsPop3Protocol::CapaResponse ]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: