701194 - error parsing message header (like subject) with empty continuation line after it

Status: RESOLVED DUPLICATE of bug 707078

(MailNews Core :: Backend, defect)

Description

[geebee1970]

Attachment: mail2

User Agent: Mozilla/5.0 (Windows NT 6.0; rv:8.0) Gecko/20100101 Firefox/8.0
Build ID: 20111104165243

Steps to reproduce:

Receiveing mails from several Accounts.


Actual results:

There are many Mailadresses in the subject line of the mail. They are only in the list of mails to see. These Mailadresses are unknown by the sender so I am wondering why they are there???


Expected results:

Nothing

Comment 1

[David :Bienvenu]

it's a malformed mime2-encoded subject line, I believe. We shouldn't run off the end of the buffer. Interestingly, this only happens in the thread pane, not the message pane, not sure why.

Comment 2

[David :Bienvenu]

what does this have to do with sql injection?

Comment 3

[Daniel Veditz [:dveditz]]

David: when you say "run off the end" you mean there was a crash? Were we reading the buffer or writing?

Comment 4

[David :Bienvenu]

(In reply to Daniel Veditz from comment #3)
> David: when you say "run off the end" you mean there was a crash? Were we
> reading the buffer or writing?

No crash, but I see "iiiiiiiiiiii" at the end of the subject string in the thread pane, which is not there in the original source, which makes me think the mime 2 decoding code is reading past the end of the buffer (or not null terminating its result, I suppose). I haven't debugged it yet.

Comment 5

[David :Bienvenu]

OK, I think the issue is that there's a continuation line after the subject header with just a tab on it, followed by an empty line, and while parsing the message subject, we seem to add a bit of garbage to the subject. This is in our parsing, before we mime decode the header. I'll look into it.

Comment 6

[Daniel Veditz [:dveditz]]

Could this happen with headers other than the subject line?

Comment 7

[David :Bienvenu]

Yes, pretty much any header would cause this, as long as it was the last header in the message, followed by a continuation line.

Comment 8

[Wayne Mery (:wsmwk)]

If this causes bug 707078 then this is topcrash

Comment 9

[Wayne Mery (:wsmwk)]

bug 707078 still marginally a topcrash, if you sum the various crash sigs

Comment 10

[Wayne Mery (:wsmwk)]

Makoto Kato, can you take a look at this?

Comment 11

[Wayne Mery (:wsmwk)]

geebee1970, do you have crash report IDs to go with this issue?
see https://support.mozillamessaging.com/en-US/kb/mozilla-crash-reporter#w_viewing-crash-reports

Comment 12

[Hiroyuki Ikezoe (:hiro)]

This crash has been fixed by https://hg.mozilla.org/comm-central/rev/1c833d465ab7

The crasher message in comment #0 has been also checked in https://hg.mozilla.org/comm-central/rev/cc9bb408f84e