353958 - crash [@ nsCRT::strtok ] when trying to send this webpage

Status: VERIFIED FIXED

Description

[Hermann Schwab]

Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.1) Gecko/20060919 SeaMonkey/1.1b
Bug seen in the forum: http://forums.mozillazine.org/viewtopic.php?p=2503455#2503455

If I try to send the page in URL, Seamonkey crashes.

Steps to reproduce:
1. Load http://sportsillustrated.cnn.com/2006/players/08/22/poll.0822/index.html
2. File->Send Page...
3. send -> crash

Better way using a local copy
1. Save Page as ... WebPage, complete http://sportsillustrated.cnn.com/2006/players/08/22/poll.0822/index.html
2. Open Mail
3. Compose
4. Attach index.html
5. Save -> crash

Comment 1

[Hermann Schwab]

Created attachment 239795 [details]
This file attached crashes Seamonkey on Save or Send 

Got this file by saving the website as Webpage, complete.

Comment 2

[Bruno 'Aqualon' Escherl]

Talkback ID: TB23650615E

http://talkback-public.mozilla.org/search/start.jsp?search=2&type=iid&id=TB23650615E

Comment 3

[Adam Guthrie]

Incident ID: 23650615
Stack Signature	nsCRT::strtok 675de217
Product ID	MozillaTrunk
Build ID	2006092208
Trigger Time	2006-09-23 08:40:51.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	xpcom_core.dll + (000159ed)
URL visited	
User Comments	
Since Last Crash	56 sec
Total Uptime	56 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/ds/nsCRT.cpp, line 89
Stack Trace 	
nsCRT::strtok  [mozilla/xpcom/ds/nsCRT.cpp, line 89]
nsMsgI18NParseMetaCharset  [mozilla/mailnews/base/util/nsMsgI18N.cpp, line 377]
nsMsgAttachmentHandler::UrlExit  [mozilla/mailnews/compose/src/nsMsgAttachmentHandler.cpp, line 1075]
FetcherURLDoneCallback  [mozilla/mailnews/compose/src/nsMsgAttachmentHandler.cpp, line 525]
nsURLFetcher::OnStopRequest  [mozilla/mailnews/compose/src/nsURLFetcher.cpp, line 319]
nsDocumentOpenInfo::OnStopRequest  [mozilla/uriloader/base/nsURILoader.cpp, line 378]
nsHttpChannel::OnStopRequest  [mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp, line 4119]
nsInputStreamPump::OnStateStop  [mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 572]

Comment 4

[Andrew Schultz]

Created attachment 239822 [details]
simpler html file that crashes

Comment 5

[Andrew Schultz]

Created attachment 239824 [details]
stacktrace

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/mailnews/base/util/nsMsgI18N.cpp&rev=1.95&mark=342,355,373#336
337    // It only supports the case when the description is within one line. 
(and doesn't cross a boundary between 512 byte blocks)
"oops"

In this specific case, the "=" after "charset" is the 512th character, so the outer PL_strstr returns NULL and the code doesn't check it.

Comment 6

[Andrew Schultz]

This code hasn't changed since forever.  :)

Comment 7

[Mats Palmgren (:mats)]

Created attachment 239825 [details] [diff] [review]
Patch rev. 1

The error occurs when we have everything up to and including CHARSET in the
buffer, but not the '=', so |cp| is 0x1 when we call nsCRT::strtok.

Comment 8

[David :Bienvenu]

Comment on attachment 239825 [details] [diff] [review]
Patch rev. 1

thx for the patch!

Comment 9

[Mats Palmgren (:mats)]

Checked in to trunk at 2006-09-23 15:54 PDT.

-> FIXED

Comment 10

[Stephen Donner [:stephend]]

Not crashing any longer with trunk build 2006-09-24-09 of SeaMonkey on Windows XP.

Verified FIXED

Comment 12

[Scott MacGregor]

We want this patch on the branch for Thunderbird 2. I'm going to land it later tonight.

Comment 13

[Marcia Knous [:marcia - needinfo? me]]

verified fixed on the 1.8 branch using version 2.0pre (20070321). I tried both variants in the reporter's comment and I did not crash. Adding keyword.