Thunderbird crashes after receiving CKR_PIN_EXPIRED from Cryptoki (PKCS#11).

NEW
Unassigned

Status

Thunderbird
Security
--
critical
7 years ago
a year ago

People

(Reporter: Markus Heintel, Unassigned, NeedInfo)

Tracking

({crash, stackwanted})

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(6 attachments)

(Reporter)

Description

7 years ago
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SBS; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.1; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8; .NET4.0C; .NET4.0E)

Steps to reproduce:

I tried to send several signed mails. After a while the used Cryptoki (PKCS#11) module returns CKR_PIN_EXPIRED. CKR_PIN_EXPIRED is a valid return code for Cryptoki tokens that want to enforce a new login, e.g. after a predefined amount of time.


Actual results:

Thunderbird crashes.


Expected results:

Ideally Thunderbird should continue after sending a C_Logout/C_Login to the Cryptoki module. Alternatively Thunderbird should show an error message and be able to recover at least after the cryptographic token (e.g. a smart card) is removed and re-inserted to the system. E.g. Firefox is able to resume after re-insertion of the cryptographic token.
Please can you get the crash report id and post it here. Detail on how to do this is given here:

https://support.mozillamessaging.com/en-US/kb/Mozilla-Crash-Reporter#w_viewing-crash-reports

Updated

7 years ago
Severity: normal → critical
Keywords: crash
OS: Other → Windows XP

Comment 2

6 years ago
Markus?

(In reply to Mark Banner (:standard8) from comment #1)
> Please can you get the crash report id and post it here. Detail on how to do
> this is given here:
> 
> https://support.mozillamessaging.com/en-US/kb/Mozilla-Crash-
> Reporter#w_viewing-crash-reports
Keywords: stackwanted
Whiteboard: [closeme 2011-11-05]
(Reporter)

Comment 3

6 years ago
The test system used to reproduce the issue is not connected to the Internet and is not able to submit a crash report. I have the .dmp and .extra files here. Could you please give me a pointer on where to send/upload them? I already tried sending them directly to you (vseerror@lehigh.edu) - I had another try right now.
Created attachment 565498 [details]
.extra for the dump
Created attachment 565499 [details]
first dump
Created attachment 565500 [details]
second dump
Status: UNCONFIRMED → NEW
Ever confirmed: true
Whiteboard: [closeme 2011-11-05]
Created attachment 565501 [details]
.extra for the second dump
Created attachment 565502 [details]
Third dump
Created attachment 565503 [details]
.extra for the third dump
Ted is there an easy way to obtain stack_walker ? and is t the binary I need to run to figure out the stack traces in those dumps ?
It's probably easier to just use a debugger, honestly:
https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg
(In reply to Ted Mielczarek [:ted, :luser] from comment #11)
> It's probably easier to just use a debugger, honestly:
> https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

Well except that the system isn't connected to the internet so It won't get the symbols.
No, you can use that same technique with the dumps present here. I can get stacks out of them later today if you can wait a bit.
(In reply to Ted Mielczarek [:ted, :luser] from comment #13)
> No, you can use that same technique with the dumps present here. I can get
> stacks out of them later today if you can wait a bit.

That would be very cool.
Stack from "first dump":

0014edf8 6bc9c52b KERNELBASE!RaiseException+0x58
0014ee30 6bca4f13 mozcrt19!_CxxThrowException(void * pExceptionObject = 0x0014ee40, struct _s__ThrowInfo * pThrowInfo = 0x6bd0aa24)+0x46 [f:\sp\vctools\crt_bld\self_x86\crt\prebuild\eh\throw.cpp @ 161]
*** WARNING: Unable to verify timestamp for thunderbird.exe
0014ee48 012258dd mozcrt19!operator new(unsigned int size = 0x122596d)+0x73 [e:\buildbot\win32_build_31\build\objdir-tb\mozilla\memory\jemalloc\crtsrc\new.cpp @ 61]
0014ee60 0122596d thunderbird!nsDOMEvent::nsDOMEvent(class nsPresContext * aPresContext = 0x073bc000, class nsEvent * aEvent = 0x00000000)+0x63 [e:\buildbot\win32_build_31\build\mozilla\content\events\src\nsdomevent.cpp @ 136]
0014ee6c 01244e7a thunderbird!NS_NewDOMEvent(class nsIDOMEvent ** aInstancePtrResult = 0x011b7d2d, class nsPresContext * aPresContext = 0x073bc000, class nsEvent * aEvent = 0x00000000)+0x1b [e:\buildbot\win32_build_31\build\mozilla\content\events\src\nsdomevent.cpp @ 1529]
0014ee8c 011b7d2d thunderbird!nsEventDispatcher::CreateEvent(class nsPresContext * aPresContext = 0x073bc000, class nsEvent * aEvent = 0x00000000, class nsAString_internal * aEventType = 0x0014ef58, class nsIDOMEvent ** aDOMEvent = 0x0014ef7c)+0x4b1 [e:\buildbot\win32_build_31\build\mozilla\content\events\src\nseventdispatcher.cpp @ 733]
0014eea4 014b9a19 thunderbird!nsDocument::CreateEvent(class nsAString_internal * aEventType = 0x0199115c, class nsIDOMEvent ** aReturn = 0x0014f270)+0x3b [e:\buildbot\win32_build_31\build\mozilla\content\base\src\nsdocument.cpp @ 6335]
0014ef80 014b9ac2 thunderbird!nsAutoWindowStateHelper::DispatchCustomEvent(char * aEventName = 0x0199115c "--- memory read error at address 0x0199115c ---")+0x83 [e:\buildbot\win32_build_31\build\mozilla\embedding\components\windowwatcher\src\nsautowindowstatehelper.cpp @ 98]
0014ef94 014a9a64 thunderbird!nsAutoWindowStateHelper::nsAutoWindowStateHelper(class nsIDOMWindow * aWindow = 0x007443c0)+0x16 [e:\buildbot\win32_build_31\build\mozilla\embedding\components\windowwatcher\src\nsautowindowstatehelper.cpp @ 56]
0014f1d4 014a9eb1 thunderbird!nsWindowWatcher::OpenWindowJSInternal(class nsIDOMWindow * aParent = 0x007443c0, char * aUrl = 0x01990bf4 "--- memory read error at address 0x01990bf4 ---", char * aName = 0x017e2d78 "--- memory read error at address 0x017e2d78 ---", char * aFeatures = 0x017e2d80 "--- memory read error at address 0x017e2d80 ---", int aDialog = 1, class nsIArray * argv = 0x07671690, int aCalledFromJS = 0, class nsIDOMWindow ** _retval = 0x0014f270)+0x1111 [e:\buildbot\win32_build_31\build\mozilla\embedding\components\windowwatcher\src\nswindowwatcher.cpp @ 1003]
0014f234 014b6a3e thunderbird!nsWindowWatcher::OpenWindow(class nsIDOMWindow * aParent = 0x007443c0, char * aUrl = 0x01990bf4 "--- memory read error at address 0x01990bf4 ---", char * aName = 0x017e2d78 "--- memory read error at address 0x017e2d78 ---", char * aFeatures = 0x017e2d80 "--- memory read error at address 0x017e2d80 ---", class nsISupports * aArguments = 0x073defc0, class nsIDOMWindow ** _retval = 0x0014f270)+0x1e7 [e:\buildbot\win32_build_31\build\mozilla\embedding\components\windowwatcher\src\nswindowwatcher.cpp @ 425]
0014f268 014b6c6a thunderbird!nsPromptService::DoDialog(class nsIDOMWindow * aParent = 0x007443c0, class nsIDialogParamBlock * aParamBlock = 0x00000000, char * aChromeURL = 0x01990bf4 "--- memory read error at address 0x01990bf4 ---")+0x89 [e:\buildbot\win32_build_31\build\mozilla\embedding\components\windowwatcher\src\nspromptservice.cpp @ 799]
0014f35c 014b8bb0 thunderbird!nsPromptService::Alert(class nsIDOMWindow * parent = 0x007443c0, wchar_t * dialogTitle = 0x073e1190 "--- memory read error at address 0x073e1190 ---", wchar_t * text = 0x073c5848 "--- memory read error at address 0x073c5848 ---")+0x189 [e:\buildbot\win32_build_31\build\mozilla\embedding\components\windowwatcher\src\nspromptservice.cpp @ 148]
0014f370 016c2ce6 thunderbird!nsPrompt::Alert(wchar_t * dialogTitle = 0x077b8e00 "--- memory read error at address 0x077b8e00 ---", wchar_t * text = 0x073c5848 "--- memory read error at address 0x073c5848 ---")+0x19 [e:\buildbot\win32_build_31\build\mozilla\embedding\components\windowwatcher\src\nsprompt.cpp @ 199]
0014f390 016c4bd4 thunderbird!nsMsgDisplayMessageByString(class nsIPrompt * aPrompt = 0x077b8e00, wchar_t * msg = 0x073c5848 "--- memory read error at address 0x073c5848 ---", wchar_t * windowTitle = 0x073e1190 "--- memory read error at address 0x073e1190 ---")+0x6d [e:\buildbot\win32_build_31\build\mailnews\compose\src\nsmsgprompts.cpp @ 124]
0014f3f4 0163514d thunderbird!nsMsgSendReport::DisplayReport(class nsIPrompt * prompt = 0x077b8e00, int showErrorOnly = 1, int dontShowReportTwice = 0, unsigned int * _retval = 0x0014f494)+0x28c [e:\buildbot\win32_build_31\build\mailnews\compose\src\nsmsgsendreport.cpp @ 428]
0014f41c 01636830 thunderbird!nsMsgComposeAndSend::Fail(unsigned int failure_code = 0x77b8e00, wchar_t * error_msg = 0x00000000 "", unsigned int * _retval = 0x0014f494)+0x73 [e:\buildbot\win32_build_31\build\mailnews\compose\src\nsmsgsend.cpp @ 3812]
0014f59c 016c45c8 thunderbird!nsMsgComposeAndSend::GatherMimeAttachments(void)+0x113d [e:\buildbot\win32_build_31\build\mailnews\compose\src\nsmsgsend.cpp @ 1147]
0014f6ec 016c311d thunderbird!nsMsgAttachmentHandler::UrlExit(unsigned int status = 0, wchar_t * aMsg = 0x00000000 "")+0x7ce [e:\buildbot\win32_build_31\build\mailnews\compose\src\nsmsgattachmenthandler.cpp @ 1315]
0014f708 016415d5 thunderbird!FetcherURLDoneCallback(unsigned int aStatus = 0, class nsACString_internal * aContentType = 0x074d6448, class nsACString_internal * aCharset = 0x074d6454, int totalSize = 247, wchar_t * aMsg = 0x00000000 "", void * tagData = 0x0675ee20)+0x6d [e:\buildbot\win32_build_31\build\mailnews\compose\src\nsmsgattachmenthandler.cpp @ 534]

Looks like we're trying to allocate too much memory here.

Comment 16

6 years ago
(In reply to Ted Mielczarek [:ted, :luser] from comment #15)
>
> Looks like we're trying to allocate too much memory here.

OOM?
Markus' email fails.

Without stronger STR, Any reason to believe this is useful after so many years?

xref bug 316167
Flags: needinfo?(eddy_nigg)
You need to log in before you can comment on or make changes to this bug.