Bug 697650 – Crash using Template with attachment

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 697650 - Crash using Template with attachment


Summary:	Crash using Template with attachment


Status:	RESOLVED FIXED

Product:	evolution
Classification:	Applications
Component:	Mailer
Version:	3.6.x (obsolete)
Hardware:	Other Linux

Importance:	High critical
Target Milestone:	---
Assigned To:	evolution-mail-maintainers
QA Contact:	Evolution QA team

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2013-04-09 15:52 UTC by Jean-François Fortin Tam
Modified:	2015-03-12 11:37 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
sample email (202.94 KB, application/octet-stream) 2013-04-09 15:52 UTC, Jean-François Fortin Tam	Details
screenshot of the composer window while the backtrace occurs (42.39 KB, image/png) 2013-04-09 16:03 UTC, Jean-François Fortin Tam	Details

Description Jean-François Fortin Tam 2013-04-09 15:52:48 UTC

Created attachment 241072 [details]
sample email

Attached is a sample email that will consistently cause a crash in Evolution 3.6.x when using it as a template. The email is simply an HTML with some filler text and a random PDF file.

The bug will NOT be triggered if:
- The email is in plaintext instead of HTML
- The attachment is not a PDF file (tried a .patch, and I got two winmail.dat attachments shown instead of a crasher - haven't tried other mimetypes)

To reproduce:
- Drag and drop that sample email to your templates folder
- In your inbox, right-click any email, choose "Templates" from the popup menu and choose this template.

Comment 1 Jean-François Fortin Tam 2013-04-09 16:01:36 UTC

Backtrace:

(gdb) bt full

+ Trace 231758

#0 camel_content_type_simple
at camel-mime-utils.c line 3745
#1 attachment_load_from_mime_part_thread
at e-attachment.c line 1804
#2 run_in_thread
at gsimpleasyncresult.c line 869
#3 io_job_thread
at gioscheduler.c line 162
#4 g_thread_pool_thread_proxy
at gthreadpool.c line 309
#5 g_thread_proxy
at gthread.c line 797
#6 start_thread
at pthread_create.c line 308
#7 clone
at ../sysdeps/unix/sysv/linux/x86_64/clone.S line 114

Comment 2 Jean-François Fortin Tam 2013-04-09 16:03:32 UTC

Created attachment 241073 [details]
screenshot of the composer window while the backtrace occurs

For what it's worth, this screenshot reveals that evolution somehow sees three attachments instead of one... wth?

Comment 3 Milan Crha 2015-03-12 11:01:36 UTC

Thanks for a bug report. It's still crashing (git master, to be 3.15.92).

Comment 4 Milan Crha 2015-03-12 11:37:40 UTC

It didn't pick any part (no recursion in the multipart-s), thus it printed many runtime warnings and finally crashed.

Created commit 7b723b7 in evo master (3.15.92+)