416151 - mail hangs in cpu loop by receiving a junk mail due to super long 100k From: - From: not compliant with RFC 2822

Status: RESOLVED DUPLICATE of bug 415135

(Thunderbird :: General, defect)

Description

[edonia]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
Build Identifier: Version 2.0.0.9 (20071031)

I received a junk mail and thunderbird just friezed. The mail was from:
From [e-mail]  Thu Feb  7 15:55:16 2008
I extract the mail (hopefully correctly) from my mail spool folder.

On my Windows System the data in the inbox got lost.

I placred a zip file, containing this message here:
http://edor.de/tb-breaking-mail.zip

Reproducible: Always

Steps to Reproduce:
1.
2.
3.

Comment 1

[edonia]

Attachment: a zip file, containing the message

ok. I see to can attach a file here, therefore i attach it now.

Comment 2

[Jeremy Baron]

Attachment: text version

zip files suck

Comment 3

[Wayne Mery (:wsmwk)]

does "thunderbird just friezed" mean it hung in a cpu loop, or it crashed (as in it closed)?

If it crashed, you need to get a talkback id http://kb.mozillazine.org/Talkback#Getting_an_incident_ID

Comment 4

[edonia]

Yes, it hung in a cpu loop.

Comment 5

[Wayne Mery (:wsmwk)]

In windows trunk and 2.0 I see:
* opening saved  message it takes 10-15 seconds at 100% cpu
* keeping the standalone message window open, focus away, then focus back drives cpu high for several seconds
I don't have junk processing turned on, nor did I test sending a message to myself. 

From: field here is 100k on a single line (which breaks RFC).  Joshua, "Lines in a message MUST be a maximum of 998 characters excluding the CRLF, but it is RECOMMENDED that lines be limited to 78 characters excluding the CRLF. (RFC 2822, $ 3.5)".  Josh speculates "spam trying to exploit a buffer overflow?"

Even if From: is changed to be RFC compliant (via multiple lines), there can still be valid but super long address which might cause problems with: 
* junk processing on the incoming message (with adaptive junk processing turned on)
* mark as junk"
* saving such an address in address book (I was too fearful to try)

edonia, Do you have adaptive junk processing turned on?  How long did you wait before killing thunderbird?

Comment 6

[Wayne Mery (:wsmwk)]

affects UI performance as well (window menus, edit functions in header area of message pane, etc)

Comment 7

[edonia]

> edonia, Do you have adaptive junk processing turned on?  How long did you wait
> before killing thunderbird?

Yes I have turn it on. After about 3 or 4 minutes i did kill TB. If I just open it with "file -> open" it hangs about 15 seconds, but I received it over pop3, from my local mail server and TB just hanged on it, did not proceed to download the other mails. So I think the junk processing wasn't active, because it starts after the normal filter affected.
I got about 100 Mails in my box, this was mail no. 14 and I tried about 4 times to get them and was waiting quite long. So I edited my mail file, from the pop3 server and cut it out. Afterwards it just worked fine.

Comment 8

[Mike Cowperthwaite]

This bug sounds similar to bug 234528.

Comment 9

[Karsten Düsterloh]

Does this occur on trunk?
If not so, dupe of bug 415135?

Comment 10

[Wayne Mery (:wsmwk)]

Yes, I had tested on trunk, but older than 2008-02-02. (and I didn't think to search bugs in component=mime_)

Testcase works with current trunk, so duping to bug 415135.
Mike, dupe bug 234528 as well?