https://bugs.kde.org/show_bug.cgi?id=169646
Siu Chung (Clement) Cheung <clement...@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |clement...@gmail.com --- Comment #4 from Siu Chung (Clement) Cheung <clement cc gmail com> 2010-04-17 05:41:45 --- This bug is still happening. kmail 1.13.2 KDE 4.4.2 linux kernel 2.6.33-gentoo-r1 (x86_64) Gentoo packages. Interestingly, my other setup with 32-bit linux on Sabayon Linux doesn't crash using exact same rule. Not sure why. Backtrace: Thread 1 (Thread 0x7f457240c750 (LWP 11155)): [KCrash Handler] #5 0x00007f4570dbfb62 in KMail::ActionScheduler::actionMessage(KMFilterAction::ReturnCode) () from /usr/lib64/libkmailprivate.so.4 #6 0x00007f4570dbfe1a in KMail::ActionScheduler::filterMessage() () from /usr/lib64/libkmailprivate.so.4 #7 0x00007f4570dc05ba in KMail::ActionScheduler::qt_metacall(QMetaObject::Call, int, void**) () from /usr/lib64/libkmailprivate.so.4 #8 0x00007f456ccb7147 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) () from /usr/lib64/qt4/libQtCore.so.4 #9 0x00007f456ccb3bd3 in QObject::event(QEvent*) () from /usr/lib64/qt4/libQtCore.so.4 Liberal sprinkling of debug statements in the area reveals that the variable "action" is pointing at 0x21, an invalid but non-zero address which passes the mFilterAction check in actionMessage(). This causes a segfault when accessed later. How does that happen? Here's the current code that checks for the end of the action list: 498 KMFilterAction *action = mFilterAction; 499 // mFilterAction = (*mFilterIt).actions()->next(); 500 if ( ++mFilterActionIt == (*mFilterIt)->actions()->end() ) 501 mFilterAction = 0; 502 else mFilterAction = (*mFilterActionIt); 503 action->processAsync( *mMessageIt ); 504 } The problem is we're checking if the *NEXT* action is the end. What about the *CURRENT* one? Sure it's supposed to be already checked when we advance the pointer there. Except that the first action isn't assigned by this iterator advancing code. It's initialized in filterMessage(): mFilterActionIt = (*mFilterIt)->actions()->begin(); mFilterAction = (*mFilterActionIt); actionMessage(); What's happening here is that begin() == end() since the list is empty. We didn't verify that mFilterActionIt isn't end (and therefore invalid) before dereferencing it. Since this is an iterator, not a pointer, we won't crash -- yet. But mFilterAction will get random garbage. If said random garbage happens to be non-zero, actionMessage() will then try to dereference it as a pointer and hence the crash. -- Configure bugmail: https://bugs.kde.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug. _______________________________________________ Kdepim-bugs mailing list Kdepim-bugs@kde.org https://mail.kde.org/mailman/listinfo/kdepim-bugs