GNOME Bugzilla – Bug 321139
evolution will crash on solaris when print error message
Last modified: 2013-09-13 00:57:54 UTC
Steps to reproduce: Evo crashed while clicking around in imap folders. Stack trace. Stack trace: current thread: t@7 [1] __lwp_park(0x0, 0x0), at 0xd07c2749 [2] mutex_lock_queue(0xcc480c00, 0x0, 0x8079f5c, 0x0), at 0xd07bb56c [3] slow_lock(0xcc480c00, 0x8079f5c, 0x0), at 0xd07bbe40 [4] mutex_lock_impl(0x8079f5c, 0x0), at 0xd07bbf36 [5] _mutex_lock(0x8079f5c), at 0xd07bc042 [6] segv_redirect(0xb, 0x0, 0xcc1acad8), at 0x8064029 [7] __sighndlr(0xb, 0x0, 0xcc1acad8, 0x8063fc3), at 0xd07c27ef ---- called from signal handler with signal 11 (SIGSEGV) ------ [8] strlen(0x0), at 0xd0764dc0 [9] _ndoprnt(0xcc72cce5, 0xcc1adb40, 0xcc1ada90, 0x0), at 0xd079c2a2 [10] vsnprintf(0xcc1adad0, 0x1, 0xcc72ccbc, 0xcc1adb40), at 0xd079f3d7 [11] g_printf_string_upper_bound(0xcc72ccbc, 0xcc1adb40), at 0xd08563a1 [12] g_vasprintf(0xcc1adb30, 0xcc72ccbc, 0xcc1adb40), at 0xd0876fe4 =>[13] g_strdup_printf(0xcc72ccbc, 0x0), at 0xd0865020 [14] imap_auth_loop(0x81902d8, 0x0), at 0xcc723713 [15] imap_connect_online(0x81902d8, 0x0), at 0xcc723863 [16] disco_connect(0x81902d8, 0x0), at 0xcd1b107e [17] camel_service_connect(0x81902d8, 0x0), at 0xcd1d09d7 [18] camel_imap_store_connected(0x81902d8, 0x0), at 0xcc7277b1 [19] camel_imap_folder_fetch_data(0x964f514, 0xa168ec0, 0xa169040, 0x0, 0x0), at 0xcc71f035 [20] write_to_stream(0x9a65d50, 0x9060b20), at 0xcc72b528 [21] camel_data_wrapper_write_to_stream(0x9a65d50, 0x9060b20), at 0xcee836ad [22] efh_text_plain(0x83e8958, 0x905dfb8, 0x9d485b0, 0xcd0325b0), at 0xccfc3e74 [23] em_format_part_as(0x83e8958, 0x905dfb8, 0x9d485b0, 0x9a67960), at 0xccfc7dae [24] emf_multipart_mixed(0x83e8958, 0x905dfb8, 0x90adfb8, 0xcd032748), at 0xccfc8cd0 [25] em_format_part_as(0x83e8958, 0x905dfb8, 0x90adfb8, 0x918ba18), at 0xccfc7dae [26] em_format_part(0x83e8958, 0x905dfb8, 0x90adfb8), at 0xccfc7e43 [27] efh_format_message(0x83e8958, 0x905dfb8, 0x90adfb8, 0xcd032640), at 0xccfc61cc [28] efh_format_do(0xa2a8c68), at 0xccfc4c0e [29] mail_msg_received(0x8177b18, 0xa2a8c68, 0x0), at 0xccfe6087 [30] thread_dispatch(0x8177b18), at 0xd03df700 [31] _thr_setup(0xcc480c00), at 0xd07c22ea [32] _lwp_start(), at 0xd07c26f0 Examining the memory at 0xcc72ccbc (1st arg of g_strdup_printf) shows: (dbx) examine 0xcc72ccbc 0xcc72ccbc: _PROCEDURE_LINKAGE_TABLE_+0x17770: "Unable to authenticate to IMAP server.\n%s\n\n" So this is line 1357 in camel-imap-store.c. The 2nd arg is NULL, hence the crash. Other information: obviously, this is an error related with function printf. function 'camel_exception_get_description' shouldn't return NULL, instead, it's better to return an empty string.
Hmm... The problem with changing 'camel_exception_get_description' to return empty string is that, a lot of checks are made based on the return value. Have to change a lot of code. But either way we have to change a lot of code.sigh!
There are three types of references of this function. One is judging whether the return value of the func is NULL, such as: fprintf(log, "%p: Replied to GUI thread (exception `%s'\n", m, camel_exception_get_description(&m->ex)? camel_exception_get_description(&m->ex):"None"); in mail_msgport_replied(), mail/mail-mt.c. and also mail_msg_free() in this file. Other references of this function are in the condition of printing the information of the CamelException, such as: g_warning ("couldn't get service %s: %s\n", uri, camel_exception_get_description (&ex)); The last type is for the output messages to customer, such as: e_error_run((GtkWindow *)gtk_widget_get_toplevel((GtkWidget *)bar), "mail-composer:no-attach", file_name, camel_exception_get_description(&ex), NULL); I have done a patch on this bug, it return _("No exception description") if the input param ex of camel_exception_get_description() is NULL. And now the upper check's choice would not "None".
Created attachment 55511 [details] [review] Don't return NULL If param of camel_exception_get_description(CamelException *) is NULL, this func will return a NULL pointer. this patch do a change on the return value and avoid it happen.
Patch committed into cvs HEAD and gnome-2-12 branch with suggested changes.
Closing bug based on Comment #4