All users were logged out of Bugzilla on October 13th, 2018

crash [@ nsCRT::strtok ] when trying to send this webpage

VERIFIED FIXED

Status

--
critical
VERIFIED FIXED
12 years ago
8 years ago

People

(Reporter: hhschwab, Assigned: mats)

Tracking

({crash, verified1.8.1.3})

Trunk
crash, verified1.8.1.3
Bug Flags:
blocking-thunderbird2 +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

Attachments

(4 attachments)

(Reporter)

Description

12 years ago
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8.1) Gecko/20060919 SeaMonkey/1.1b
Bug seen in the forum: http://forums.mozillazine.org/viewtopic.php?p=2503455#2503455

If I try to send the page in URL, Seamonkey crashes.

Steps to reproduce:
1. Load http://sportsillustrated.cnn.com/2006/players/08/22/poll.0822/index.html
2. File->Send Page...
3. send -> crash

Better way using a local copy
1. Save Page as ... WebPage, complete http://sportsillustrated.cnn.com/2006/players/08/22/poll.0822/index.html
2. Open Mail
3. Compose
4. Attach index.html
5. Save -> crash
(Reporter)

Comment 1

12 years ago
Created attachment 239795 [details]
This file attached crashes Seamonkey on Save or Send 

Got this file by saving the website as Webpage, complete.
Keywords: regression
Summary: crash when trying to send this webpage → crash [@ nsCRT::strtok ] when trying to send this webpage

Comment 3

12 years ago
Incident ID: 23650615
Stack Signature	nsCRT::strtok 675de217
Product ID	MozillaTrunk
Build ID	2006092208
Trigger Time	2006-09-23 08:40:51.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	xpcom_core.dll + (000159ed)
URL visited	
User Comments	
Since Last Crash	56 sec
Total Uptime	56 sec
Trigger Reason	Access violation
Source File, Line No.	c:/builds/tinderbox/MozillaTrunk/WINNT_5.0_Clobber/mozilla/xpcom/ds/nsCRT.cpp, line 89
Stack Trace 	
nsCRT::strtok  [mozilla/xpcom/ds/nsCRT.cpp, line 89]
nsMsgI18NParseMetaCharset  [mozilla/mailnews/base/util/nsMsgI18N.cpp, line 377]
nsMsgAttachmentHandler::UrlExit  [mozilla/mailnews/compose/src/nsMsgAttachmentHandler.cpp, line 1075]
FetcherURLDoneCallback  [mozilla/mailnews/compose/src/nsMsgAttachmentHandler.cpp, line 525]
nsURLFetcher::OnStopRequest  [mozilla/mailnews/compose/src/nsURLFetcher.cpp, line 319]
nsDocumentOpenInfo::OnStopRequest  [mozilla/uriloader/base/nsURILoader.cpp, line 378]
nsHttpChannel::OnStopRequest  [mozilla/netwerk/protocol/http/src/nsHttpChannel.cpp, line 4119]
nsInputStreamPump::OnStateStop  [mozilla/netwerk/base/src/nsInputStreamPump.cpp, line 572]
OS: Other → Windows 98
Version: 1.8 Branch → Trunk

Comment 4

12 years ago
Created attachment 239822 [details]
simpler html file that crashes

Comment 5

12 years ago
Created attachment 239824 [details]
stacktrace

http://bonsai.mozilla.org/cvsblame.cgi?file=mozilla/mailnews/base/util/nsMsgI18N.cpp&rev=1.95&mark=342,355,373#336
337    // It only supports the case when the description is within one line. 
(and doesn't cross a boundary between 512 byte blocks)
"oops"

In this specific case, the "=" after "charset" is the 512th character, so the outer PL_strstr returns NULL and the code doesn't check it.

Comment 6

12 years ago
This code hasn't changed since forever.  :)
Keywords: regression
OS: Windows 98 → All
Hardware: PC → All
(Assignee)

Comment 7

12 years ago
Created attachment 239825 [details] [diff] [review]
Patch rev. 1

The error occurs when we have everything up to and including CHARSET in the
buffer, but not the '=', so |cp| is 0x1 when we call nsCRT::strtok.
Assignee: nobody → mats.palmgren
Status: NEW → ASSIGNED
Attachment #239825 - Flags: superreview?(bienvenu)
Attachment #239825 - Flags: review?(bienvenu)

Comment 8

12 years ago
Comment on attachment 239825 [details] [diff] [review]
Patch rev. 1

thx for the patch!
Attachment #239825 - Flags: superreview?(bienvenu)
Attachment #239825 - Flags: superreview+
Attachment #239825 - Flags: review?(bienvenu)
Attachment #239825 - Flags: review+
(Assignee)

Comment 9

12 years ago
Checked in to trunk at 2006-09-23 15:54 PDT.

-> FIXED
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
Not crashing any longer with trunk build 2006-09-24-09 of SeaMonkey on Windows XP.

Verified FIXED
Status: RESOLVED → VERIFIED

Updated

12 years ago
Duplicate of this bug: 372189

Comment 12

12 years ago
We want this patch on the branch for Thunderbird 2. I'm going to land it later tonight.
Flags: blocking-thunderbird2+

Updated

12 years ago
Attachment #239825 - Flags: approval-thunderbird2+

Updated

12 years ago
Keywords: fixed1.8.1.3
verified fixed on the 1.8 branch using version 2.0pre (20070321). I tried both variants in the reporter's comment and I did not crash. Adding keyword.
Keywords: fixed1.8.1.3 → verified1.8.1.3
Product: Core → MailNews Core
Crash Signature: [@ nsCRT::strtok ]
You need to log in before you can comment on or make changes to this bug.