crash when checking pop3 mail [@ msvcrt.dll + 0x378c0 ][@ msvcrt!strlen + 0x20 - nsPop3Protocol::CapaResponse ]

VERIFIED FIXED

Status

MailNews Core
Networking: POP
--
critical
VERIFIED FIXED
12 years ago
6 years ago

People

(Reporter: Jean-Michel Reghem, Assigned: Bienvenu)

Tracking

(5 keywords)

Trunk
x86
Windows XP
crash, fixed1.8.1, topcrash, verified1.8.0.4, verified1.8.1.3
Bug Flags:
blocking1.8.0.4 +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(3 attachments)

(Reporter)

Description

12 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

Talkback ID TB13120132Z

Stack Signature	 msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739
Product ID	Thunderbird15
Build ID	2005120115
Trigger Time	2005-12-19 08:48:45.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	msvcrt.dll + (000378c0)
URL visited	write a mail using strikethrough style and color --> crash
User Comments	
Since Last Crash	160482 sec
Total Uptime	160482 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
msvcrt.dll + 0x378c0 (0x77c478c0)
nsPop3Protocol::CapaResponse  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310]
nsPop3Protocol::ProcessProtocolState  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668]
nsMsgProtocol::OnDataAvailable  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437]
nsInputStreamPump::OnInputStreamReady  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341]
nsOutputStreamReadyEvent::EventHandler  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216]
shdocvw.dll + 0x150c24 (0x778b0c24)
nsWebBrowserPersist::OnProgress  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940]
0x1974c085

Reproducible: Couldn't Reproduce

Steps to Reproduce:

reply a mail in html mode (colors, strikethrough) and suddenly crash when checking pop3 mail [ msvcrt.dll + 0x378c0 ]

there is a lot of bug having msvcrt.dll in signature ... as it is the windows runtime library ...
But i've found no bugs with nsPop3Protocol::CapaResponse

Comment 1

12 years ago
nothing makes sure that the string length isn't precisely 4+null, is that what's happening here?
Keywords: crash
Summary: reply a mail in html mode (colors, strikethrough) and suddenly crash when checking pop3 mail [ msvcrt.dll + 0x378c0 ] → reply a mail in html mode (colors, strikethrough) and suddenly crash when checking pop3 mail [@ msvcrt.dll + 0x378c0 ][@ msvcrt!strlen + 0x20 - nsPop3Protocol::CapaResponse ]
(Reporter)

Comment 2

12 years ago
Same crash:
Here, simply browse with FF ... and then return to TB ...
Click on a mail, try to delete (but i'm not even sure i was trying to delete the mail)

--> TB 14394689 ( http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=2&type=iid&id=TB14394689Q )

Stack Signature	 msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739
Product ID	Thunderbird15
Build ID	2005120115
Trigger Time	2006-01-25 03:23:56.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	msvcrt.dll + (000378c0)
URL visited	unexpected crash
User Comments	return to tb from ff, just to read mail and crash after attempt to delete a mail i believe
Since Last Crash	339935 sec
Total Uptime	595068 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
msvcrt.dll + 0x378c0 (0x77c478c0)
nsPop3Protocol::CapaResponse  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310]
nsPop3Protocol::ProcessProtocolState  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668]
nsMsgProtocol::OnDataAvailable  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437]
nsInputStreamPump::OnInputStreamReady  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341]
nsOutputStreamReadyEvent::EventHandler  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216]
shdocvw.dll + 0x150c24 (0x778b0c24)
nsWebBrowserPersist::OnProgress  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940]
0x1974c085
(Reporter)

Updated

12 years ago
Summary: reply a mail in html mode (colors, strikethrough) and suddenly crash when checking pop3 mail [@ msvcrt.dll + 0x378c0 ][@ msvcrt!strlen + 0x20 - nsPop3Protocol::CapaResponse ] → crash when checking pop3 mail [@ msvcrt.dll + 0x378c0 ][@ msvcrt!strlen + 0x20 - nsPop3Protocol::CapaResponse ]
(Reporter)

Comment 3

12 years ago
This bug seems to be MY thunderbird top-crasher ... according my talkbacks
here is another one:
Talkback TB14552317G

Stack Signature	 msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739
Product ID	Thunderbird15
Build ID	2005120115
Trigger Time	2006-01-30 06:37:03.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	msvcrt.dll + (000378c0)
URL visited	unexpected crash when i was writing a mail
User Comments	--> during a simple write of mail, suddenly, TB freezed (20") and then, the talkback appairs ...
Since Last Crash	327064 sec
Total Uptime	922132 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
msvcrt.dll + 0x378c0 (0x77c478c0)
nsPop3Protocol::CapaResponse  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310]
nsPop3Protocol::ProcessProtocolState  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668]
nsMsgProtocol::OnDataAvailable  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437]
nsInputStreamPump::OnInputStreamReady  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341]
nsOutputStreamReadyEvent::EventHandler  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216]
shdocvw.dll + 0x150c24 (0x778b0c24)
nsWebBrowserPersist::OnProgress  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940]
0x1974c085







What i did before the crash: "during a simple write of mail, suddenly, TB freezed (20") and then, the talkback appairs ..."

I don't know if it help, but i have 12 pop account (and 9 of those are automatically checked every 10 minutes)
I have also more than 60 rss feeds (every 60 minutes)

If i check my last talkback report: (all with TB 1.5 2005120115)
19/12/2005: Talkback ID TB13120132Z 
25/01/2006: Talkback ID TB14394689Q
and today ... 

so 3 crash on 4 with this build on my machine
(Reporter)

Comment 4

12 years ago
maybe this is related to this 5th top crasher in talback server???

Rank    Stack Signature    %    Total OpenBugs  FixedBugs   120115      Win
5 	msvcrt.dll 	2.85% 	328 		142847 	    328 	328



i know msvcrt.dll can be related to a great number of bugs :-) ... as it is the runtime compenent of windows ...
but, as no bugs are open for this and as it crash 3 times in a month for me, i can supposed that this bug must take a great part of these 328 crash
(Reporter)

Comment 5

12 years ago
http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/mailnews/local/src/nsPop3Protocol.cpp&mark=1310&rev=MOZILLA_1_8_BRANCH#1310

1304 bienvenu   1.225         // see RFC 2449, chapter 6.3
1305                          if (!PL_strncasecmp(line, "SASL", 4))
1306                          {
1307                              nsCAutoString responseLine;
1308                              responseLine.Assign(line + 5);
1309                      

1310                              if (responseLine.Find("PLAIN", PR_TRUE) >= 0)  

1311                                  SetCapFlag(POP3_HAS_AUTH_PLAIN);



--> maybe line is just "SASL" with no more after (even \0)
Is there a test in nsCAutoString::Find to check if the internal buffer is null???
(Reporter)

Comment 6

12 years ago
New crash ... thus this bug represent 4 on the last 5 crash on my TB.
Same line http://bonsai.mozilla.org/cvsblame.cgi?file=/mozilla/mailnews/local/src/nsPop3Protocol.cpp&mark=1310&rev=MOZILLA_1_8_BRANCH#1310 than usual

Talkback ID TB14853337Q

Stack Signature	 msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739
Product ID	Thunderbird15
Build ID	2005120115
Trigger Time	2006-02-07 00:13:37.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	msvcrt.dll + (000378c0)
URL visited	unexpected crash when i was opening a folder in a new window
User Comments	
Since Last Crash	270632 sec
Total Uptime	1192764 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
msvcrt.dll + 0x378c0 (0x77c478c0)
nsPop3Protocol::CapaResponse  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310]
nsPop3Protocol::ProcessProtocolState  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668]
nsMsgProtocol::OnDataAvailable  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437]
nsInputStreamPump::OnInputStreamReady  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341]
nsOutputStreamReadyEvent::EventHandler  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216]
shdocvw.dll + 0x150c24 (0x778b0c24)
nsWebBrowserPersist::OnProgress  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940]
0x1974c085

Comment 7

12 years ago
URL contains query for Talkback, there are 46 identical tracebacks there.
Confirming as NEW
Status: UNCONFIRMED → NEW
Ever confirmed: true
(Reporter)

Comment 8

12 years ago
aaaah ... cool, it is "NEW" now :-)
--> last crash yesterday: TB14906208Q
(Reporter)

Comment 9

11 years ago
This is the 5th topcrasher bug for TB 1.5
http://talkback-public.mozilla.org/talkback/fastfind.jsp?search=1&searchby=stacksig&match=contains&searchfor=msvcrt.dll&vendor=MozillaOrg&product=Thunderbird15&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
Keywords: topcrash
(Reporter)

Comment 10

11 years ago
thanks to the new talkback server, with the feature "search in top 5 frame" of jay ( http://weblogs.mozillazine.org/qa/archives/2006/03/dig_deeper_into_crashesnow_you.html ), you can see that this bug has generated 26 crash report in one day from 2006-03-15 22:41 to 2006-03-16 20:20 ...


http://talkback-public.mozilla.org/search/start.jsp?search=1&searchby=stack&match=contains&searchfor=nsPop3Protocol%3A%3ACapaResponse+&vendor=MozillaOrg&product=All&platform=All&buildid=&sdate=&stime=&edate=&etime=&sortby=bbid
(Assignee)

Comment 11

11 years ago
Is everyone using SASL authentication, i.e., GSSAPI auth? If anyone having this bug is just using a single pop3 server, a pop3 protocol log might be helpful:

follow these instructions, subsituting pop3 for protocol.

http://www.mozilla.org/quality/mailnews/mail-troubleshoot.html#pop3
Assignee: mscott → bienvenu
(Reporter)

Comment 12

11 years ago
all pop3 are single pop3 server ... but they are 3 pop in SSL (3 gmail account)
I will enable log tomorrow
(Reporter)

Comment 13

11 years ago
hello ...

New crash today:
TB17155216Z
Stack Signature	 msvcrt.dll + 0x378c0 (0x77c478c0) 5db4c739
Product ID	Thunderbird15
Build ID	2005120115
Trigger Time	2006-04-04 02:11:17.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	msvcrt.dll + (000378c0)
URL visited	unexpected crash
User Comments	
Since Last Crash	275922 sec
Total Uptime	2686782 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
msvcrt.dll + 0x378c0 (0x77c478c0)
nsPop3Protocol::CapaResponse  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 1310]
nsPop3Protocol::ProcessProtocolState  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/local/src/nsPop3Protocol.cpp, line 3668]
nsMsgProtocol::OnDataAvailable  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/mailnews/base/util/nsMsgProtocol.cpp, line 350]
nsInputStreamPump::OnStateTransfer  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 437]
nsInputStreamPump::OnInputStreamReady  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 341]
nsOutputStreamReadyEvent::EventHandler  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/xpcom/io/nsStreamUtils.cpp, line 216]
shdocvw.dll + 0x150c24 (0x778b0c24)
nsWebBrowserPersist::OnProgress  [e:/builds/tinderbox/Tb-Mozilla1.8/WINNT_5.0_Depend/mozilla/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp, line 940]
0x1974c085



this times ... with log
--> see attachement after
(Reporter)

Comment 14

11 years ago
Created attachment 217137 [details]
pop3 protocol log until crash

pop3 protocol log until crash

it is strange ... the log is quite big (1.3Mo ...) but all the beginning is empty

You can see a SASL trace at the end ...
(Reporter)

Comment 15

11 years ago
Created attachment 217138 [details]
pop3 log just after relaunch

--> here is a clean log just after a relaunch
(and automatically download of new messages)
(Assignee)

Comment 16

11 years ago
thanks for the log; that explains it completely. We're expecting something like SASL GSSAPI but the server is just saying "SASL". I believe that's a server bug, i.e., it's sending invalid protocol (not 100% sure of that), but we shouldn't crash. I'll come up with a fix, and also try to contact the dovecot folks.
Component: General → Networking: POP
Product: Thunderbird → Core
Version: unspecified → Trunk
(Assignee)

Comment 17

11 years ago
Created attachment 217173 [details] [diff] [review]
proposed fix

make sure we have some text after "SASL" before trying to parse it.
Attachment #217173 - Flags: superreview?(mscott)

Updated

11 years ago
Attachment #217173 - Flags: superreview?(mscott) → superreview+
(Assignee)

Updated

11 years ago
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Keywords: fixed1.8.1
Resolution: --- → FIXED
(Assignee)

Updated

11 years ago
Attachment #217173 - Flags: approval1.8.0.3?
(Reporter)

Comment 18

11 years ago
Really really good job David ... thanks
As it was a topcrasher bug for me, it will be a good reason to test TB 2.0 nighlty...

I will keep the log after the upgrade to be sure the problem is solved ...
Flags: blocking1.8.0.3?

Comment 19

11 years ago
Crash - Nom approved
Flags: blocking1.8.0.3? → blocking1.8.0.3+
Comment on attachment 217173 [details] [diff] [review]
proposed fix

approved for 1.8.0 branch, a=dveditz for drivers
Attachment #217173 - Flags: approval1.8.0.3? → approval1.8.0.3+
(Assignee)

Updated

11 years ago
Keywords: fixed1.8.0.3
David, Jean-Michel, can you provide a test case for this problem or retest using a build from the latest release candidates?
(Assignee)

Comment 22

11 years ago
Unfortunately, I don't have a test case - I just fixed it by code inspection.
(Reporter)

Comment 23

11 years ago
(In reply to comment #21)
> David, Jean-Michel, can you provide a test case for this problem or retest
> using a build from the latest release candidates?
> 

i will update to nightly 1.8.0.4 ... but as this bug was totally random (it depends from a server bug), i don't have a testcase ... For example, i'm in 1.8.0.2 and the last crash is more than 1,5 month ago ... It was with TB 1.5 (build 2005120115) ... and since, i've updated to 1.5.0.2 (2006050105) ... So this patch was not yet in this build, but TB doesn't crash anymore ... 
(Reporter)

Comment 24

11 years ago
no more problems, seems correctly fixed --> verified
Status: RESOLVED → VERIFIED
verified fixed for 1.8.1.3 using Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.8.1.3) Gecko/20070326 Thunderbird/2.0.0.0 ID:2007032620 (Thunderbird 2 RC1), no crash when checking various POP3 Accounts.

Also verified fixed for 1.8.0.4 by the reporter on comment #24 , thanks jean-michel.
Keywords: fixed1.8.0.4 → verified1.8.0.4, verified1.8.1.3
Product: Core → MailNews Core
Crash Signature: [@ msvcrt.dll + 0x378c0 ] [@ msvcrt!strlen + 0x20 - nsPop3Protocol::CapaResponse ]
You need to log in before you can comment on or make changes to this bug.