89393 - newsgroup message with .png attachment crashes Mozilla

Status: VERIFIED DUPLICATE of bug 89595

(MailNews Core :: Backend, defect)

Description

[Tim Wunder]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.2+)
Gecko/20010704
BuildID:    2001070404

I did a quick check of bugzilla and didn't find this reported, so I'll
enter one. When attempting to read a newsgroup message with a .png file
attachemnt, Mozilla crashes. I don't know if it's because it's a .png, or if
it's a bad file or what, but the file does not display properly under NC4.77,
although NC4.77 doesn't crash. The crash happens with 0.9.2 and current
nightlies (tested with 2001070404 and an older build from earlier in the week).
The offending message is in alt.os.linux.caldera, if anyone wants to see if it
chashes their install. The message subject is "need help with QT".
BTW, Talkback ID TB32550892X.


Reproducible: Always
Steps to Reproduce:
1. Subscribe to alt.os.linux.caldera
2. Using the 3-pane or alt-3-pane, click on message with subject "need help with
QT", which contains a .png file attachment 
3 [details] [diff] [review]. Crash

Comment 1

[Asa Dotzler [:asa]]

Incident ID 32550892
Stack Signature MSVCRT.DLL + 0x20540 (0x78020540) e427997e
Bug ID
Trigger Time 2001-07-05 08:04:02
User Comments
Build ID 2001070409
Product ID MozillaTrunk
Platform ID Win32
Stack Trace
MSVCRT.DLL + 0x20540 (0x78020540)
nsPipe::nsPipeInputStream::ReadSegments 
[d:\builds\seamonkey\mozilla\xpcom\io\nsPipe2.cpp, line 412]
nsPNGDecoder::WriteFrom 
[d:\builds\seamonkey\mozilla\modules\libpr0n\decoders\png\nsPNGDecoder.cpp, 
line 164]
ReadDataOut 
[d:\builds\seamonkey\mozilla\modules\libpr0n\decoders\png\nsPNGDecoder.cpp, 
line 139]
PR_AtomicIncrement [../../../../pr/src/misc/pratom.c, line 286]
nsMsgProtocol::AddRef 
[d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgProtocol.cpp, line 49]
nsMsgProtocol::QueryInterface 
[d:\builds\seamonkey\mozilla\mailnews\base\util\nsMsgProtocol.cpp, line 62]
ProxyListener::OnDataAvailable 
[d:\builds\seamonkey\mozilla\modules\libpr0n\src\imgLoader.cpp, line 387]
nsMimeBaseEmitter::OnFull 
[d:\builds\seamonkey\mozilla\mailnews\mime\emitters\src\nsMimeBaseEmitter.cpp, 
line 273]
nsPipe::nsPipeOutputStream::WriteSegments 
[d:\builds\seamonkey\mozilla\xpcom\io\nsPipe2.cpp, line 690]
nsPipe::nsPipeOutputStream::Write 
[d:\builds\seamonkey\mozilla\xpcom\io\nsPipe2.cpp, line 784]
nsReadFromRawBuffer [d:\builds\seamonkey\mozilla\xpcom\io\nsPipe2.cpp, line 771]
mime_output_fn [d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemoz2.cpp, 
line 789]
mime_output_fn [d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemoz2.cpp, 
line 789]
MimeOptions_write [d:\builds\seamonkey\mozilla\mailnews\mime\src\mimei.cpp, 
line 1255]
MimeObject_write [d:\builds\seamonkey\mozilla\mailnews\mime\src\mimei.cpp, line 
1275]
MimeInlineImage_parse_decoded_buffer 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimeiimg.cpp, line 213]
MimeLeaf_parse_buffer 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimeleaf.cpp, line 147]
MimeMultipart_parse_child_line 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemult.cpp, line 542]
MimeMultipart_parse_line 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemult.cpp, line 264]
convert_and_send_buffer 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimebuf.cpp, line 134]
mime_LineBuffer [d:\builds\seamonkey\mozilla\mailnews\mime\src\mimebuf.cpp, 
line 256]
MimeObject_parse_buffer 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimeobj.cpp, line 256]
MimeMessage_parse_line 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemsg.cpp, line 214]
convert_and_send_buffer 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimebuf.cpp, line 134]
mime_LineBuffer [d:\builds\seamonkey\mozilla\mailnews\mime\src\mimebuf.cpp, 
line 256]
MimeObject_parse_buffer 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimeobj.cpp, line 256]
MimeMessage_parse_line 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\mimemsg.cpp, line 131]
nsStorageTransport::nsReadRequest::Read 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStorageTransport.cpp, line 655]
nsStreamConverter::OnDataAvailable 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\nsStreamConverter.cpp, line 890]
nsStreamConverter::OnDataAvailable 
[d:\builds\seamonkey\mozilla\mailnews\mime\src\nsStreamConverter.cpp, line 890]
nsNntpCacheStreamListener::OnDataAvailable 
[d:\builds\seamonkey\mozilla\mailnews\news\src\nsNNTPProtocol.cpp, line 712]
nsStorageTransport::nsReadRequest::OnDataAvailable 
[d:\builds\seamonkey\mozilla\netwerk\base\src\nsStorageTransport.cpp, line 622]
XPTC_InvokeByIndex 
[d:\builds\seamonkey\mozilla\xpcom\reflect\xptcall\src\md\win32\xptcinvoke.cpp, 
line 139]
EventHandler [d:\builds\seamonkey\mozilla\xpcom\proxy\src\nsProxyEvent.cpp, 
line 510]
PL_HandleEvent [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, line 591]
PL_ProcessPendingEvents [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 524]
_md_EventReceiverProc [d:\builds\seamonkey\mozilla\xpcom\threads\plevent.c, 
line 1072]
nsAppShellService::Run 
[d:\builds\seamonkey\mozilla\xpfe\appshell\src\nsAppShellService.cpp, line 419]
main1 [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1181]
main [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1481]
WinMain [d:\builds\seamonkey\mozilla\xpfe\bootstrap\nsAppRunner.cpp, line 1499]
WinMainCRTStartup()
KERNEL32.DLL + 0x192a6 (0x77e992a6) 

Comment 2

[Keyser Sose]

*** This bug has been marked as a duplicate of 89595 ***

Comment 3

[[e-mail] (gone - use [e-mail] instead)]

I'm not crashing, and I can't find that message, but I did send myself a PNG
file attached to a newsposting on news.mozilla.org in netscape.test, and didn't
crash.  
If you have the image, can you attach it here?  Thanks.

Comment 4

[Tim Wunder]

A few days after I filed the bug (maybe less), the newsgroup message was gone, 
can't even find it in the google archives. 
Sorry. I guess I shoulda grabbed that .png file while I had the chance.

Comment 5

[[e-mail] (gone - use [e-mail] instead)]

Okay, the stack traces look like they cover the same area.  I'll verify this a 
DUP, but if you do see this again, please refile.  Thanks!