Bug 350395 – Evolution crash with bad ics attachment

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 350395 - Evolution crash with bad ics attachment


Summary:	Evolution crash with bad ics attachment


Status:	RESOLVED FIXED

Product:	evolution
Classification:	Applications
Component:	Mailer
Version:	2.6.x (obsolete)
Hardware:	Other All

Importance:	Normal critical
Target Milestone:	---
Assigned To:	evolution-mail-maintainers
QA Contact:	Evolution QA team

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2006-08-08 09:16 UTC by Øystein Gisnås
Modified:	2013-09-10 14:04 UTC

See Also:
GNOME target:	---
GNOME version:	2.13/2.14

Attachments
Patch that fixes the problem (1.40 KB, patch) 2006-08-08 09:19 UTC, Øystein Gisnås	committed	Details \| Review

Description Øystein Gisnås 2006-08-08 09:16:17 UTC

Steps to reproduce:
Evolution crashes with the attached dump (from bug buddy) when it
receives a bad (but not corrupted) ics attachment in an email
(embedded below in case you read this in evolution and it crashes for
you). It's annoying because I now have to delete the email through an
alternate means to be able to use Evolution again (because it remembers
that email as the last I selected when it starts up again *sigh*).

BTW: I think it's clear that the problem is that the date is before 1900
(I know it's the broken Outlook that the real problem but anyway,
Evolution should crash and burn because of it).

Thanks,
Christian

--BEGIN ICAL
BEGIN:VCALENDAR
METHOD:PUBLISH
PRODID:-//Oracle/Outlook Connector//EN
VERSION:2.0
BEGIN:VEVENT
DTEND:16010101T000000Z
DTSTART:16010101T000000Z
ORGANIZER;SENT-BY=xxx;CN=xxx
DESCRIPTION:Proposed By: XXX\nSensitivity:Normal\nImportance:
  Normal\n\nWhen: Friday\, May 26\, 2006 11:00 AM-12:00 PM (GMT-05:00)
  Eastern Time (US & Canada).\n\n*~*~*~*~*~*~*~*~*~*\n\n
SUMMARY:XXX
PRIORITY:5
SEQUENCE:0
TRANSP:OPAQUE
ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=FALSE;CN=xxx
ATTENDEE;ROLE=REQ-PARTICIPANT;RSVP=FALSE;CN=xxxx
DTSTAMP:20060525T193504Z
UID:xxx
END:VEVENT
END:VCALENDAR

--END ICAL


Stack trace:
Backtrace was generated from '/usr/bin/evolution-2.6'

Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread -1500494144 (LWP 8325)]
[New Thread -1564402768 (LWP 8336)]
[New Thread -1555850320 (LWP 8335)]
[New Thread -1547457616 (LWP 8334)]
[New Thread -1530475600 (LWP 8332)]
[New Thread -1538872400 (LWP 8331)]
[New Thread -1522082896 (LWP 8329)]
[New Thread -1513690192 (LWP 8328)]
[New Thread -1505293392 (LWP 8326)]
0xffffe410 in __kernel_vsyscall ()

+ Trace 70075

Thread 1 (Thread -1500494144 (LWP 8325))

#0 __kernel_vsyscall
#1 __waitpid_nocancel
from /lib/tls/i686/cmov/libpthread.so.0
#2 libgnomeui_module_info_get
from /usr/lib/libgnomeui-2.so.0
#3 segv_redirect
at main.c line 424
#4 <signal handler called>
#5 format_date_and_time_x
at itip-view.c line 166
#6 itip_view_set_start
at itip-view.c line 565
#7 format_itip_object
at itip-formatter.c line 1706
#8 efh_object_requested
at em-format-html.c line 590
#9 html_g_cclosure_marshal_BOOLEAN__OBJECT
from /usr/lib/libgtkhtml-3.8.so.15
#10 g_closure_invoke
from /usr/lib/libgobject-2.0.so.0
#11 g_signal_stop_emission
from /usr/lib/libgobject-2.0.so.0
#12 g_signal_emit_valist
from /usr/lib/libgobject-2.0.so.0
#13 g_signal_emit
from /usr/lib/libgobject-2.0.so.0
#14 gtk_html_get_editable
from /usr/lib/libgtkhtml-3.8.so.15
#15 html_g_cclosure_marshal_BOOLEAN__OBJECT
from /usr/lib/libgtkhtml-3.8.so.15
#16 g_closure_invoke
from /usr/lib/libgobject-2.0.so.0
#17 g_signal_stop_emission
from /usr/lib/libgobject-2.0.so.0
#18 g_signal_emit_valist
from /usr/lib/libgobject-2.0.so.0
#19 g_signal_emit
from /usr/lib/libgobject-2.0.so.0
#20 html_engine_replace_do
from /usr/lib/libgtkhtml-3.8.so.15
#21 html_engine_add_object_with_id
from /usr/lib/libgtkhtml-3.8.so.15
#22 html_engine_refresh_fonts
from /usr/lib/libgtkhtml-3.8.so.15
#23 html_engine_flush
from /usr/lib/libgtkhtml-3.8.so.15
#24 gtk_html_flush
from /usr/lib/libgtkhtml-3.8.so.15
#25 emhs_sync_flush
at em-html-stream.c line 127
#26 emcs_gui_received
at em-sync-stream.c line 161
#27 g_vasprintf
from /usr/lib/libglib-2.0.so.0
#28 g_main_context_dispatch
from /usr/lib/libglib-2.0.so.0
#29 g_main_context_check
from /usr/lib/libglib-2.0.so.0
#30 g_main_loop_run
from /usr/lib/libglib-2.0.so.0
#31 bonobo_main
from /usr/lib/libbonobo-2.so.0
#32 main
at main.c line 612
#0 __kernel_vsyscall



Other information:
This problem was originally posted at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=368920

Comment 1 Øystein Gisnås 2006-08-08 09:19:00 UTC

Created attachment 70468 [details] [review]
Patch that fixes the problem

The patch adds some extra checks to avoid the crash. It's been used in Debian since Jun 11 2006.

Please assign to Harish.

Comment 2 Christian Kirbach 2006-08-08 18:26:25 UTC

thanks for submitting the patch

Comment 3 Harish Krishnaswamy 2006-08-10 13:00:23 UTC

Set target milestone to 2.8

Comment 4 André Klapper 2006-08-13 19:31:01 UTC

Øystein: just out of curiosity, what does your comment "Also, year assumption won't fail." exactly mean in this case?

Comment 5 Chenthill P 2006-08-22 11:36:23 UTC

The patch can be committed to gnome-2-14 branch and HEAD.

Comment 6 Srinivasa Ragavan 2006-08-23 06:14:22 UTC

Fixed to head and stable.