451944 - Fx crashes when displaying PDF with Adobe Reader 9.0.0 with modified user agent string [@ msvcr80.dll@0x14500] ("nsPluginHostImpl::UserAgent return=(null)" when UA string exceeds a length limit (more than 25 extra characters))

Status: RESOLVED DUPLICATE of bug 328778

(Core Graveyard :: Plug-ins, defect)

Description

[Manfred H. Winter]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.2pre) Gecko/2008082105 GranParadiso/3.0.2pre (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.2pre) Gecko/2008082105 GranParadiso/3.0.2pre ID:2008082105

When there is more than one "general.useragent.extra." line in prefs.js, Firefox crashes when displaying a PDF with Adobe Reader 9.0.0.

Reproducible: Always

Steps to Reproduce:
1. Add more than one "general.useragent.extra." line in prefs.js
2. Open a PDF with Fx
Actual Results:  
Fx immediately crashes while loading the PDF.

Expected Results:  
PDF should get displayed with Adobe Reader 9.0.0 plugin

This is a followup to bug 448102. See bug 448102 comment #87 ff.
When there's only one "general.useragent.extra." line in prefs.js (or none) NSPR log looks like this:
> 00000950b 3.02077007b [13984] 0[928140]: nsPluginHostImpl::InstantiateFullPagePlugin End mime=application/pdf, rv=0, owner=6f06500, url=http://www.barchetta-lexikon.de/pdf/s021_frontumbau.pdf
> 00000953b 3.02423549b [13984] 0[928140]: nsPluginHostImpl::UserAgent return=Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.2pre) Gecko/2008073106 GranParadiso/3.0.2pre Mnenhy/0.7.5.20005

With more than one of this extra headers, this happens:
> 00000795 2.29245329 [10884] 0[128140]: nsPluginHostImpl::UserAgent return=(null)
> 00000796 2.29597259 [10884] 0[128140]: nsPluginHostImpl::UserAgent return=(null)

UserAgent header is null.

Comment 1

[Manfred H. Winter]

Attachment: NSPR log (all:5) of crash

Crash ID: bp-a2bc2082-71cb-11dd-8101-0013211cbf8a

Comment 2

[WADA:World Anti-bad-Duping Agency]

(Firefox 3.0.1 on MS Win-XP SP3)
>No crash with:
> user_pref("general.useragent.extra.abc", "abc-abc-abc-abc-abc-abc-abc");
> user_pref("general.useragent.extra.bcd", "bcd-bcd-");
>Crash with:
> user_pref("general.useragent.extra.abc", "abc-abc-abc-abc-abc-abc-abc");
> user_pref("general.useragent.extra.bcd", "bcd-bcd-b");

(Firefox trunk 2008/8/02 build)
>No crash even with next, and PDF is opened successfully.
user_pref("general.useragent.extra.abc1", "1-abc-abc-abc-abc-abc-abc-abc-abc-abc-abc-abc-abc-abc-abc");
user_pref("general.useragent.extra.abc2", "2-abc-abc-abc-abc-abc-abc-abc-abc-abc-abc-abc-abc-abc-abc");
user_pref("general.useragent.extra.bcd1", "1-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd");
user_pref("general.useragent.extra.bcd2", "2-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd-bcd");
user_pref("general.useragent.extra.cde1", "1-cde-cde-cde-cde-cde-cde-cde-cde-cde-cde-cde-cde-cde-cde");
user_pref("general.useragent.extra.cde2", "2-cde-cde-cde-cde-cde-cde-cde-cde-cde-cde-cde-cde-cde-cde");
user_pref("general.useragent.extra.def1", "1-def-def-def-def-def-def-def-def-def-def-def-def-def-def");
user_pref("general.useragent.extra.def2", "2-def-def-def-def-def-def-def-def-def-def-def-def-def-def");
user_pref("general.useragent.extra.efg1", "1-efg-efg-efg-efg-efg-efg-efg-efg-efg-efg-efg-efg-efg-efg");
user_pref("general.useragent.extra.efg2", "2-efg-efg-efg-efg-efg-efg-efg-efg-efg-efg-efg-efg-efg-efg");
user_pref("general.useragent.extra.fgh1", "1-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh");
user_pref("general.useragent.extra.fgh2", "2-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh-fgh");
user_pref("general.useragent.extra.ghi1", "1-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi");
user_pref("general.useragent.extra.ghi2", "2-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi-ghi");
user_pref("general.useragent.extra.hij1", "1-hij-hij-hij-hij-hij-hij-hij-hij-hij-hij-hij-hij-hij-hij");
user_pref("general.useragent.extra.hij2", "2-hij-hij-hij-hij-hij-hij-hij-hij-hij-hij-hij-hij-hij-hij");

Cause seems to be Bug 416286(over flow of buffer for user agent string).

To Manfred H. Winter:
Can you reproduce crash with latest-trunk?

Comment 3

[Manfred H. Winter]

Crash with latest branch:
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.2pre) Gecko/2008082405 GranParadiso/3.0.2pre (.NET CLR 3.5.30729) Mnenhy/0.7.5.20005

No crash with latest trunk:
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1a2pre) Gecko/20080824031931 Minefield/3.1a2pre (.NET CLR 3.5.30729) Mnenhy/0.7.5.20005

And just another bug in GranParadiso: Fx ignores "Display PDF in Browser="Off setting of Adobe Reader. PDF gets displayed inside GranParadiso, while Minefield opens PDF inside external Adobe Reader.
If there's any bug in Firefox with Adobe Reader it seems to happen on my computer. ;-)

Comment 4

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #3)
> Crash with latest branch:
> No crash with latest trunk:

What "general.useragent.extra.???" do you use in prefs.js or user.js? 
What string is set by it?

> And just another bug in GranParadiso: Fx ignores "Display PDF in Browser="Off setting of Adobe Reader.
> PDF gets displayed inside GranParadiso, while Minefield opens PDF inside external Adobe Reader.

Behavior of Fx/Adobe Reader 9 depends on next.
  1. nppdf32.dll is found or not
     1-1. nppdf32.dll in Fx's plugins directory
     1-2. nppdf32.dll in Adobe Reader 9's ...\Reader\Browser
  2. If found at step 1, PDF plugin is enabled or disabled by Firefox.
  3. Adobe Reader 9's "Display PDF in Broweser" option is On or Off
Above settings when you tested were really the one you expected?

Comment 5

[Manfred H. Winter]

(In reply to comment #4)
> (In reply to comment #3)
> > Crash with latest branch:
> > No crash with latest trunk:
> 
> What "general.useragent.extra.???" do you use in prefs.js or user.js? 
> What string is set by it?
> 

The headers are set by "Microsoft .NET Framework Assistant 1.0" and Mnenhy, the lines are:
> user_pref("general.useragent.extra.microsoftdotnet", "(.NET CLR 3.5.30729)");
> user_pref("general.useragent.extra.mnenhy", "Mnenhy/0.7.5.20005");
But it doesn't matter, what extra strings are added. It also crashes with:
> user_pref("general.useragent.extra.abc", "abc-abc-abc-abc-abc-abc-abc");
> user_pref("general.useragent.extra.bcd", "bcd-bcd-");
as you mentioned in comment #2 where it didn't crash on XP.

> > And just another bug in GranParadiso: Fx ignores "Display PDF in Browser="Off setting of Adobe Reader.
> > PDF gets displayed inside GranParadiso, while Minefield opens PDF inside external Adobe Reader.
> 
> Behavior of Fx/Adobe Reader 9 depends on next.
>   1. nppdf32.dll is found or not
>      1-1. nppdf32.dll in Fx's plugins directory
>      1-2. nppdf32.dll in Adobe Reader 9's ...\Reader\Browser
>   2. If found at step 1, PDF plugin is enabled or disabled by Firefox.
>   3. Adobe Reader 9's "Display PDF in Broweser" option is On or Off
> Above settings when you tested were really the one you expected?
> 

Yes, I've set "Display PDF in Browser"=Off in Adobe Reader, nppdf32.dll is in ...\Reader\Browser. Then I've tested opening a PDF with branch and trunk builds. Branch displays PDF inside Firefox which it shouldn't do. Trunk opens Adobe Reader as external app and PDF gets displayed inside Adobe Reader, which is the expected behavior.

Comment 6

[WADA:World Anti-bad-Duping Agency]

(In reply to comment #5)
> Branch displays PDF inside Firefox which it shouldn't do.
> Trunk opens Adobe Reader as external app and PDF gets displayed inside Adobe Reader, which is the expected behavior.

Funny. Let's check it in bug 448102. (Already very messy, but that'll be closed as INVALID, so no problem to add more comments to that bug. And, we need to know Fx/nppdf32.dll/AcroRd32.exe behaviour before saying "Adobe's fault".)

Comment 7

[Manfred H. Winter]

I found out, that it doesn't matter how many general.useragent.extra.* lines there are in prefs.js.
Fx crashes, if the addition to user agent is longer than 25 characters.

Crash with:
> user_pref("general.useragent.extra.abc", "12345678901234567890123456");

No crash with:
> user_pref("general.useragent.extra.abc", "1234567890123456789012345");

Comment 8

[timeless]

the useragent problem is bug 416286 and friends i think bug 328778 is the original