Bug 672837 – [abrt] Crash in camel_pop3_engine_command_free

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 672837 - [abrt] Crash in camel_pop3_engine_command_free


Summary:	[abrt] Crash in camel_pop3_engine_command_free


Status:	RESOLVED FIXED

Product:	evolution-data-server
Classification:	Platform
Component:	Mailer
Version:	3.8.x (obsolete)
Hardware:	Other Linux

Importance:	Normal critical
Target Milestone:	---
Assigned To:	evolution-mail-maintainers
QA Contact:	Evolution QA team

URL:
Whiteboard:	evolution[pop]

Depends on:
Blocks:

Reported:	2012-03-26 09:28 UTC by Milan Crha
Modified:	2013-05-31 16:51 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
eds patch (1.46 KB, patch) 2013-05-31 16:48 UTC, Milan Crha	committed	Details \| Review

Description Milan Crha 2012-03-26 09:28:13 UTC

Moving this from a downstream bug report:
https://bugzilla.redhat.com/show_bug.cgi?id=806496

[abrt] evolution-3.2.3-2.fc16: Process /usr/bin/evolution was killed by signal 11 (SIGSEGV)

libreport version: 2.0.8
abrt_version:   2.0.7
backtrace_rating: 3
cmdline:        evolution
crash_function: camel_pop3_engine_command_free
executable:     /usr/bin/evolution
kernel:         3.3.0-4.fc16.i686.PAE
reason:         Process /usr/bin/evolution was killed by signal 11 (SIGSEGV)
time:           2012年03月24日 星期六 11时33分40秒

Core was generated by `evolution'.
Program terminated with signal 11, Segmentation fault.

+ Trace 229953

Thread 9 (Thread 0xb7736b00 (LWP 15105))

#0 pango_renderer_set_color
at pango-renderer.c line 1158
#1 pango_renderer_default_prepare_run
at pango-renderer.c line 1311
#2 pango_renderer_prepare_run
at pango-renderer.c line 1254
#3 pango_renderer_draw_layout_line
at pango-renderer.c line 502
#4 pango_renderer_draw_layout
at pango-renderer.c line 194
#5 _pango_cairo_do_layout
at pangocairo-render.c line 878
#6 ??
from /usr/lib/libgtk-3.so.0
#7 ??

Thread 1 (Thread 0xac6aeb40 (LWP 15152))

#0 camel_pop3_engine_command_free
at camel-pop3-engine.c line 423
#1 pop3_folder_dispose
at camel-pop3-folder.c line 225
#2 g_object_unref
from /lib/libgobject-2.0.so.0
#3 fetch_mail_exec
at mail-ops.c line 327
#4 mail_msg_proxy
at mail-mt.c line 416
#5 g_thread_foreach
from /lib/libglib-2.0.so.0
#6 ??
from /lib/libglib-2.0.so.0

Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Comment 1 Akhil Laddha 2012-03-27 05:03:54 UTC

also see bug 660221

Comment 2 Milan Crha 2012-03-27 08:53:54 UTC

(In reply to comment #1)
> also see bug 660221

Yup, this one is slightly different, it happens on pop3_folder_dispose, where the other one on pop3 folder creation. Though, of course, they both can have same reason.

Comment 3 Milan Crha 2013-01-07 12:23:07 UTC

Similar downstream bug report from 3.6.2 on disconnect:

Version-Release number of selected component:
evolution-3.6.2-3.fc18

Additional info:
backtrace_rating: 4
cmdline:        evolution
crash_function: camel_pop3_engine_command_free
executable:     /usr/bin/evolution
kernel:         3.6.11-3.fc18.x86_64

Core was generated by `evolution'.
Program terminated with signal 11, Segmentation fault.

+ Trace 231348

Thread 2 (Thread 0x7fa5c4b61a00 (LWP 6354))

#0 _int_free
at malloc.c line 3905
#1 recompute_visible_regions_internal
at gdkwindow.c line 1031
#2 recompute_visible_regions_internal
at gdkwindow.c line 1105
#3 recompute_visible_regions
at gdkwindow.c line 1145
#4 gdk_window_hide
at gdkwindow.c line 5667
#5 gdk_window_hide
at gdkwindow.c line 5607
#6 gtk_button_unmap
at gtkbutton.c line 1465
#7 g_closure_invoke
at gclosure.c line 777
#8 signal_emit_unlocked_R
at gsignal.c line 3481
#9 g_signal_emit_valist
at gsignal.c line 3300
#10 g_signal_emit
at gsignal.c line 3356
#11 gtk_widget_unmap
at gtkwidget.c line 4273
#12 gtk_box_forall
at gtkbox.c line 1865
#13 _g_closure_invoke_va
at gclosure.c line 840
#14 g_signal_emit_valist
at gsignal.c line 3211
#15 g_signal_emit
at gsignal.c line 3356
#16 gtk_widget_unmap
at gtkwidget.c line 4273
#17 gtk_grid_forall
at gtkgrid.c line 502
#18 _g_closure_invoke_va
at gclosure.c line 840
#19 g_signal_emit_valist
at gsignal.c line 3211
#20 g_signal_emit
at gsignal.c line 3356
#21 gtk_widget_unmap
at gtkwidget.c line 4273
#22 gtk_box_forall
at gtkbox.c line 1865
#23 _g_closure_invoke_va
at gclosure.c line 840
#24 g_signal_emit_valist
at gsignal.c line 3211
#25 g_signal_emit
at gsignal.c line 3356
#26 gtk_widget_unmap
at gtkwidget.c line 4273
#27 g_closure_invoke
at gclosure.c line 777
#28 signal_emit_unlocked_R
at gsignal.c line 3481
#29 g_signal_emit_valist
at gsignal.c line 3300
#30 g_signal_emit
at gsignal.c line 3356
#31 gtk_widget_unmap
at gtkwidget.c line 4273
#32 gtk_window_hide
at gtkwindow.c line 4921
#33 g_closure_invoke
at gclosure.c line 777
#34 signal_emit_unlocked_R
at gsignal.c line 3481
#35 g_signal_emit_valist
at gsignal.c line 3300
#36 g_signal_emit
at gsignal.c line 3356
#37 gtk_widget_hide
at gtkwidget.c line 4140
#38 gtk_widget_hide
at gtkwidget.c line 4118
#39 gtk_widget_dispose
at gtkwidget.c line 10259
#40 g_object_run_dispose
at gobject.c line 1061
#41 gtk_widget_destroy
at gtkwidget.c line 3974
#42 mail_config_window_commit_cb
at e-mail-config-window.c line 172
#43 g_simple_async_result_complete
at gsimpleasyncresult.c line 775
#44 mail_config_notebook_page_submit_cb
at e-mail-config-notebook.c line 722
#45 g_simple_async_result_complete
at gsimpleasyncresult.c line 775
#46 complete_in_idle_cb
at gsimpleasyncresult.c line 787
#47 g_main_dispatch
at gmain.c line 2715
#48 g_main_context_dispatch
at gmain.c line 3219
#49 g_main_context_iterate
at gmain.c line 3290
#50 g_main_loop_run
at gmain.c line 3484
#51 gtk_main
at gtkmain.c line 1160
#52 main
at main.c line 711

Comment 4 Milan Crha 2013-05-30 07:49:38 UTC

Similar downstream bug report from 3.8.2:
https://bugzilla.redhat.com/show_bug.cgi?id=967191

when check or uncheck "leave messages on server" in account editor, this happen. I am using hotmail email.

Core was generated by `evolution'.
Program terminated with signal 11, Segmentation fault.

+ Trace 232003

Thread 9 (Thread 0x7fb5b4a78a40 (LWP 2519))

#0 INT_cairo_region_destroy
at cairo-region.c line 425
#1 recompute_visible_regions_internal
at gdkwindow.c line 1051
#2 recompute_visible_regions_internal
at gdkwindow.c line 1129
#3 recompute_visible_regions
at gdkwindow.c line 1169
#4 gdk_window_hide
at gdkwindow.c line 5814
#5 gtk_button_unmap
at gtkbutton.c line 1465
#6 g_closure_invoke
at gclosure.c line 777
#7 signal_emit_unlocked_R
at gsignal.c line 3514
#8 g_signal_emit_valist
at gsignal.c line 3328
#9 g_signal_emit
at gsignal.c line 3384
#10 gtk_widget_unmap
at gtkwidget.c line 4392
#11 gtk_box_forall
at gtkbox.c line 1865
#12 _g_closure_invoke_va
at gclosure.c line 840
#13 g_signal_emit_valist
at gsignal.c line 3234
#14 g_signal_emit
at gsignal.c line 3384
#15 gtk_widget_unmap
at gtkwidget.c line 4392
#16 gtk_grid_forall
at gtkgrid.c line 502
#17 _g_closure_invoke_va
at gclosure.c line 840
#18 g_signal_emit_valist
at gsignal.c line 3234
#19 g_signal_emit
at gsignal.c line 3384
#20 gtk_widget_unmap
at gtkwidget.c line 4392
#21 gtk_box_forall
at gtkbox.c line 1865
#22 _g_closure_invoke_va
at gclosure.c line 840
#23 g_signal_emit_valist
at gsignal.c line 3234
#24 g_signal_emit
at gsignal.c line 3384
#25 gtk_widget_unmap
at gtkwidget.c line 4392
#26 g_closure_invoke
at gclosure.c line 777
#27 signal_emit_unlocked_R
at gsignal.c line 3514
#28 g_signal_emit_valist
at gsignal.c line 3328
#29 g_signal_emit
at gsignal.c line 3384
#30 gtk_widget_unmap
at gtkwidget.c line 4392
#31 gtk_window_hide
at gtkwindow.c line 4870
#32 g_closure_invoke
at gclosure.c line 777
#33 signal_emit_unlocked_R
at gsignal.c line 3514
#34 g_signal_emit_valist
at gsignal.c line 3328
#35 g_signal_emit
at gsignal.c line 3384
#36 gtk_widget_hide
at gtkwidget.c line 4259
#37 gtk_widget_dispose
at gtkwidget.c line 10762
#38 g_object_run_dispose
at gobject.c line 1062
#39 gtk_widget_destroy
at gtkwidget.c line 4093
#40 mail_config_window_commit_cb
at e-mail-config-window.c line 170
#41 g_simple_async_result_complete
at gsimpleasyncresult.c line 777
#42 mail_config_notebook_page_submit_cb
at e-mail-config-notebook.c line 730
#43 g_simple_async_result_complete
at gsimpleasyncresult.c line 777
#44 complete_in_idle_cb
at gsimpleasyncresult.c line 789
#45 g_main_dispatch
at gmain.c line 3054
#46 g_main_context_dispatch
at gmain.c line 3630
#47 g_main_context_iterate
at gmain.c line 3701
#48 g_main_loop_run
at gmain.c line 3895
#49 gtk_main
at gtkmain.c line 1156
#50 main
at main.c line 707

Comment 5 Milan Crha 2013-05-31 16:31:35 UTC

(In reply to comment #4)
> when check or uncheck "leave messages on server" in account editor, this
> happen. I am using hotmail email.

I can reproduce the crash with the above steps.

Comment 6 Milan Crha 2013-05-31 16:48:58 UTC

Created attachment 245758 [details] [review]
eds patch

for evolution-data-server;

It happens when the POP3 is asked to disconnect when it's not connected. The patch also ensures that there will be no NULL-dereferencing in camel_pop3_engine_command_free(), which was the cause for this crash.

Comment 7 Milan Crha 2013-05-31 16:51:10 UTC

Created commit b75c916 in eds master (3.9.3+)
Created commit 6608756 in eds gnome-3-8 (3.8.3+)