676882 - Crash in libmime following bug 674488 libmime passes badly encoded char* into JS land as AUTF8Strings landing

Status: RESOLVED FIXED

(MailNews Core :: MIME, defect)

Description

[Mark Banner (:standard8)]

This bug was filed from the Socorro interface and is 
report bp-354cb846-76eb-46e8-b2fb-f18cb2110804 .
============================================================= 

I noticed this in crash-stacks earlier today. Top of the stack is:

0 	mozcrt19.dll 	strlen 	strlen.asm:81
1 	xul.dll 	nsDependentCString::nsDependentCString 	objdir-tb/mozilla/dist/include/nsTDependentString.h:90
2 	xul.dll 	MimeMessage_close_headers 	mailnews/mime/src/mimemsg.cpp:296
3 	xul.dll 	MimeMessage_parse_line 	mailnews/mime/src/mimemsg.cpp:278
4 	xul.dll 	convert_and_send_buffer 	

The code at issue is here:

http://hg.mozilla.org/comm-central/annotate/6b22e35111fd/mailnews/mime/src/mimemsg.cpp#l296

nsDependentCString orig(obj->headers->munged_subject);

Unfortunately the code doesn't take account of the fact munged_subject is null - nsDependentCString doesn't allow for that, and hence you just get a crash.

Comment 1

[Jonathan Protzenko [:protz]]

Attachment: Fix

Disclaimer: I haven't test it...

Comment 2

[Kent James (:rkent)]

See my bug 677360 for similar issues.

Comment 3

[Jonathan Protzenko [:protz]]

http://hg.mozilla.org/comm-central/rev/71b93e1bf96c