After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 606316 - Mail with an attachment in a Junk folder crashes Evo
Mail with an attachment in a Junk folder crashes Evo
Status: RESOLVED FIXED
Product: evolution-data-server
Classification: Platform
Component: Mailer
2.30.x (obsolete)
Other Linux
: Normal blocker
: ---
Assigned To: Milan Crha
Evolution QA team
: 606065 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2010-01-07 14:10 UTC by Paul Smith
Modified: 2013-09-14 16:53 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
eds patch (2.77 KB, patch)
2010-01-07 17:16 UTC, Milan Crha
committed Details | Review
evo patch (1.76 KB, patch)
2010-01-07 17:30 UTC, Milan Crha
committed Details | Review

Description Paul Smith 2010-01-07 14:10:21 UTC
Actually now that I look this is probably a bug for evolution-data-server, but I've already entered it so...

I'm using a Dovecot IMAP server with Evo built from the latest git.  When I get mail with an attachment in my Junk folder, Evo crashes (maybe just when I try to view that mail?)  Backtrace and some debug info is below.

Milan writes on evolution-hackers:

Oh, my fault, IMAP with mail with an attachment in junk folder. I can
reproduce it too, with a message as an attachment.

Please file a bug report about it. Thanks.


Debug info:
-----------
Here's some stack info, followed by a bit of spelunking.  It looks like
the results returned from camel_folder_summary_uid() in
efhd_attachment_button() are bogus; we're getting back a
CamelMessageInfo pointer which looks OK, but then when we cast it into a
CamelMessageInfoBase we see the rest of the structure it points to seems
to be garbage.

This has happened to me before (recently) as well.  That time I was able
to get into the junk folder and delete/expunge and it was fixed.

If this doesn't seem familiar to anyone I'll file a bug report.  Does
anyone want more details than this?  I'm willing to provide them!


Core was generated by `/opt/evo-master/bin/evolution'.
Program terminated with signal 11, Segmentation fault.
  • #0 match_content_type
    at ../../../evolution-data-server/camel/camel-folder-summary.c line 5066
  • #0 match_content_type
    at ../../../evolution-data-server/camel/camel-folder-summary.c line 5066
  • #1 camel_folder_summary_guess_content_info
    at ../../../evolution-data-server/camel/camel-folder-summary.c line 5089
  • #2 efhd_attachment_button
    at ../../../evolution/mail/em-format-html-display.c line 812
  • #3 efh_object_requested
    at ../../../evolution/mail/em-format-html.c line 1519
  • #4 html_g_cclosure_marshal_BOOLEAN__OBJECT
    at ../../../gtkhtml/gtkhtml/htmlmarshal.c line 81
  • #5 IA__g_closure_invoke
    at /build/buildd/glib2.0-2.22.3/gobject/gclosure.c line 767
  • #6 signal_emit_unlocked_R
    at /build/buildd/glib2.0-2.22.3/gobject/gsignal.c line 3247
  • #7 IA__g_signal_emit_valist
    at /build/buildd/glib2.0-2.22.3/gobject/gsignal.c line 2990
  • #8 IA__g_signal_emit
    at /build/buildd/glib2.0-2.22.3/gobject/gsignal.c line 3037
  • #9 html_engine_object_requested_cb
    at ../../../gtkhtml/gtkhtml/gtkhtml.c line 549
  • #10 html_g_cclosure_marshal_BOOLEAN__OBJECT
    at ../../../gtkhtml/gtkhtml/htmlmarshal.c line 81
  • #11 IA__g_closure_invoke
    at /build/buildd/glib2.0-2.22.3/gobject/gclosure.c line 767
  • #12 signal_emit_unlocked_R
    at /build/buildd/glib2.0-2.22.3/gobject/gsignal.c line 3247
  • #13 IA__g_signal_emit_valist
    at /build/buildd/glib2.0-2.22.3/gobject/gsignal.c line 2990
  • #14 IA__g_signal_emit
    at /build/buildd/glib2.0-2.22.3/gobject/gsignal.c line 3037
  • #15 element_parse_object
    at ../../../gtkhtml/gtkhtml/htmlengine.c line 1624
  • #16 parse_one_token
    at ../../../gtkhtml/gtkhtml/htmlengine.c line 3975
  • #17 new_parse_body
    at ../../../gtkhtml/gtkhtml/htmlengine.c line 1429
  • #18 html_engine_timer_event
    at ../../../gtkhtml/gtkhtml/htmlengine.c line 4928
  • #19 html_engine_flush
    at ../../../gtkhtml/gtkhtml/htmlengine.c line 6907
  • #20 gtk_html_flush
    at ../../../gtkhtml/gtkhtml/gtkhtml.c line 6317
  • #21 emhs_sync_flush
    at ../../../evolution/mail/em-html-stream.c line 86
  • #22 emss_process_message
    at ../../../evolution/mail/em-sync-stream.c line 83
  • #23 g_main_dispatch
    at /build/buildd/glib2.0-2.22.3/glib/gmain.c line 1960
  • #24 IA__g_main_context_dispatch
    at /build/buildd/glib2.0-2.22.3/glib/gmain.c line 2513
  • #25 g_main_context_iterate
    at /build/buildd/glib2.0-2.22.3/glib/gmain.c line 2591
  • #26 IA__g_main_loop_run
    at /build/buildd/glib2.0-2.22.3/glib/gmain.c line 2799
  • #27 IA__gtk_main
    at /build/buildd/gtk+2.0-2.18.3/gtk/gtkmain.c line 1218
  • #28 main
    at ../../../evolution/shell/main.c line 609
  • #1 camel_folder_summary_guess_content_info
    at ../../../evolution-data-server/camel/camel-folder-summary.c line 5089
  • #2 efhd_attachment_button
    at ../../../evolution/mail/em-format-html-display.c line 812

(gdb) l
807
808             /* FIXME: handle default shown case */
809             d(printf("adding attachment button/content\n"));
810
811             mi = camel_folder_summary_uid (emf->folder->summary, emf->uid);
812             ci = camel_folder_summary_guess_content_info (mi, ((CamelDataWrapper *)pobject->part)->mime_type);
813             if (ci) {
814                     size = ci->size;
815                     /* what if its not encoded in base64 ? is it a case to consider? */
816                     if (ci->encoding && !g_ascii_strcasecmp (ci->encoding, "base64"))

(gdb) p *emf->folder->summary
$10 = {parent = {klass = 0x7f05980251c0, magic = 2007188717, hooks = 0x0, ref_count = 1, flags = 0, next = 0x1dc3210, prev = 0x1dc3410}, priv = 0x7f05980afdb0, version = 13, flags = 1, nextuid = 0, time = 0, saved_count = 0, unread_count = 8, deleted_count = 0, junk_count = 9, junk_not_deleted_count = 9, visible_count = 0, message_info_size = 48, content_info_size = 0, message_info_chunks = 0x0, content_info_chunks = 0x0, summary_path = 0x0, build_content = 0, uids = 0x1c40aa0, loaded_infos = 0x1c41940, folder = 0x1dcddd0, meta_summary = 0x7f05980ae640, cache_load_time = 0, timeout_handle = 0, collate = 0x0, sort_by = 0x0, later = {0x0, 0x0, 0x0, 0x0}}

(gdb) p *emf->uid
$11 = 52 '4'
Comment 1 Milan Crha 2010-01-07 17:16:03 UTC
Created attachment 150982 [details] [review]
eds patch

for evolution-data-server;

This is enough to let it work properly. What Chen overlooked is a fact the virtual folder's CamelMessageInfo-s are proxies to real message infos, thus one cannot access its internal members directly. I guess this all will be fixed once for ever on camel move to GObject.
Comment 2 Milan Crha 2010-01-07 17:30:02 UTC
Created attachment 150984 [details] [review]
evo patch

for evolution;

but with this it's even better, as not accessing other private member, not leaking message infos, not using uninitialized memory, and checking availability of the message info in a summary (it returned mi=NULL when I "not junk" a message and it moved itself on the next one).
Comment 3 Milan Crha 2010-01-07 17:34:53 UTC
Created commit 93f3612 in eds master (2.29.5+)
Created commit d52040f in evo master (2.29.5+)
Comment 4 Paul Smith 2010-01-07 20:14:21 UTC
OK I got the latest git and rebuilt.  I'll let you know if I see this again.
Comment 5 Milan Crha 2010-01-08 17:02:03 UTC
*** Bug 606065 has been marked as a duplicate of this bug. ***
Comment 6 Milan Crha 2010-02-09 13:33:59 UTC
It wasn't fixed completely, see bug #606811