[Bug 169646] Kmail crashes when applying filter with no rules

[Siu Chung Cheung (Clement)]

https://bugs.kde.org/show_bug.cgi?id=169646


Siu Chung (Clement) Cheung <clement.cc at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |clement.cc at gmail.com




--- Comment #4 from Siu Chung (Clement) Cheung <clement cc gmail com>  2010-04-17 05:41:45 ---
This bug is still happening.

kmail 1.13.2
KDE 4.4.2
linux kernel 2.6.33-gentoo-r1 (x86_64)
Gentoo packages.

Interestingly, my other setup with 32-bit linux on Sabayon Linux doesn't crash
using exact same rule. Not sure why.

Backtrace:
Thread 1 (Thread 0x7f457240c750 (LWP 11155)):
[KCrash Handler]
#5  0x00007f4570dbfb62 in
KMail::ActionScheduler::actionMessage(KMFilterAction::ReturnCode) () from
/usr/lib64/libkmailprivate.so.4
#6  0x00007f4570dbfe1a in KMail::ActionScheduler::filterMessage() () from
/usr/lib64/libkmailprivate.so.4
#7  0x00007f4570dc05ba in
KMail::ActionScheduler::qt_metacall(QMetaObject::Call, int, void**) () from
/usr/lib64/libkmailprivate.so.4
#8  0x00007f456ccb7147 in QMetaObject::activate(QObject*, QMetaObject const*,
int, void**) () from /usr/lib64/qt4/libQtCore.so.4
#9  0x00007f456ccb3bd3 in QObject::event(QEvent*) () from
/usr/lib64/qt4/libQtCore.so.4

Liberal sprinkling of debug statements in the area reveals that the variable
"action" is pointing at 0x21, an invalid but non-zero address which passes the
mFilterAction check in actionMessage(). This causes a segfault when accessed
later.

How does that happen? Here's the current code that checks for the end of the
action list:
498      KMFilterAction *action = mFilterAction;
499     // mFilterAction = (*mFilterIt).actions()->next();
500     if ( ++mFilterActionIt == (*mFilterIt)->actions()->end() )
501     mFilterAction = 0;
502     else mFilterAction = (*mFilterActionIt);
503     action->processAsync( *mMessageIt );
504     }

The problem is we're checking if the *NEXT* action is the end. What about the
*CURRENT* one? Sure it's supposed to be already checked when we advance the
pointer there. Except that the first action isn't assigned by this iterator
advancing code. It's initialized in filterMessage():
      mFilterActionIt = (*mFilterIt)->actions()->begin();
      mFilterAction = (*mFilterActionIt);
      actionMessage();

What's happening here is that begin() == end() since the list is empty. We
didn't verify that mFilterActionIt isn't end (and therefore invalid) before
dereferencing it. Since this is an iterator, not a pointer, we won't crash --
yet. But mFilterAction will get random garbage. If said random garbage happens
to be non-zero, actionMessage() will then try to dereference it as a pointer
and hence the crash.

-- 
Configure bugmail: https://bugs.kde.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.