Bug 88840

Created attachment 7405 [details]
The trace when korganizer crashes

The versions I am using:
piou@calimero:~$ korganizer --version
Qt: 3.3.3
KDE: 3.3.0
KOrganizer: 3.3
piou@calimero:~$

Hi Lionel,

On Saturday 04 September 2004 19:16, Lionel Bouchpan-Lerust-Juery wrote:
> When I try to import an Apple iCal 1.5 generated file from my home
> directory I have the "You have no ical file in your home directory." error
> message. 

This menu item is for importing files from the old command-line application 
"ical", not for Apple's iCal. You need to use the menu item "Import 
Calendar..." for iCalendar files.

> Before trying to import this file, I inserted manually the 
> VERSION:2.0 and PRODID:-//Apple Computer\, Inc//iCal 1.5//EN  tags in the
> file. 

can you send us such a .ics file, please?

Thanks,
Reinhold

Hello Reinhold,

Of course you need of the calendars :-)
Find attached one of the Apple's iCal calendar that causes the crash and the trace that is produced while trying to load it.

A+
 Lionel

Created attachment 7415 [details]
One of tha calendars that crashes korganizer

All the calendars I am using produce the same effect

Created attachment 7416 [details]
The trace when korganizer attempts to load the YES2 calendar

On Sunday 05 September 2004 13:04, Lionel Bouchpan-Lerust-Juery wrote:
> One of tha calendars that crashes korganizer

Thanks a lot. The problematic line is the ATTACH;VALUE=URI:... I extracted 
just the small part of the ics file that causes the problems. The following 
calendar file also crashes korganizer:
BEGIN:VCALENDAR
VERSION:2.0
BEGIN:VEVENT
DTSTART;TZID=Europe/Paris:20040528T100000
SUMMARY:Ellen
UID:7A14E757-B078-11D8-B41D-0003939BE42C
DURATION:PT30M
BEGIN:VALARM
ACTION:PROCEDURE
ATTACH;VALUE=URI:file://localhost/Users/piou/Music/iTunes/iTunes%20Music
 /Depeche%20Mode/Singles%2081-85/Its%20Called%20A%20Heart.mp3
TRIGGER:-PT2M
END:VALARM
END:VEVENT
END:VCALENDAR

As soon as you remove the ";VALUE=URI" (so that it's just ATTACH:file://...), 
korganizer doesn't crash any more. I'll have to take a look at how the ATTACH 
lines are extracted from the calendar file.

Thanks,
Reinhold

OK so, we know where it comes from. The problem is that a lot of Mac users are likely to add action (launch a program, play an mp3 ...) to their event.

Next week I will write a function to process calendars extracted from Apple's iCal.
If I understand correctly it is a matter of adding a kind of header:
VERSION:2.0
PRODID:-//Apple Computer\, Inc//iCal 1.5//EN
and to substitute the ATTATCH;VALUE=URI: by ATTACH:file://
I don't know if other patterns are problematic in the Apple's interpretation.

Is it OK ?

That would be nice, but please look at the problem in more depth:

it's much more of a problem that korganizer crashes when loading files, than any failure to interpret them sensibly. It's obvious that an invalid char* is passed to the QCString constructor, causing a strlen() function to crash. This can only be a wild pointer (not a NULL pointer, according to Trolltech's documentation!) or a character string not terminated by \0.

IMHO, access violations in the context of file formats usually shared over the internet are a very serious problem for themselves, as
- it's a denial-of-service attack on somebody elses calendar application
- it may well provide a means of introducing malicious code into the calendar application.

Please be careful with the impression that some alternations to the file cured the problem - I found out that even an unchanged "broken" calendar file will load OK at times - supporting the wild pointer hypothesis. Still, the ATTACH lines may very well be the trigger of the bug - at least they were present in any iCal file that caused a crash.

Finally - this bug is still reproducible with KOrganizer 3.3.1!

I can confirm this bug is still open in SuSE Linux 10.1, running with KDE 3.5.3 from the SuSE build service.

I have filed a bug at SuSE, see there for detailed information:

https://bugzilla.novell.com/show_bug.cgi?id=192730

A resolution on how to reset korganizer would be VERY welcome since I cannot use it at the moment, it always crashes at startup.

I have updated the bug entry at Novell's with the things I have tried and found out so far. Check https://bugzilla.novell.com/show_bug.cgi?id=192730 please.

I found a workaround and isolated what probably causes the bug. It's a stupid behaviour in korgac. Just head over here:

https://bugzilla.novell.com/show_bug.cgi?id=192730

Thanks to AppArmor!! :-)

SVN commit 600496 by mkoller:

BUG: 127095
BUG: 88840

When parsing an ATTACH;VALUE=URI: element, take care of casting
to the right datatype



 M  +15 -8     icalformatimpl.cpp  


--- branches/KDE/3.5/kdepim/libkcal/icalformatimpl.cpp #600495:600496
@@ -1183,19 +1183,26 @@
 
 Attachment *ICalFormatImpl::readAttachment(icalproperty *attach)
 {
-  icalattach *a = icalproperty_get_attach(attach);
-
   Attachment *attachment = 0;
 
-  int isurl = icalattach_get_is_url (a);
-  if (isurl == 0)
-    attachment = new Attachment((const char*)icalattach_get_data(a));
-  else {
-    attachment = new Attachment(QString(icalattach_get_url(a)));
+  icalvalue_kind value_kind = icalvalue_isa(icalproperty_get_value(attach));
+
+  if ( value_kind == ICAL_ATTACH_VALUE ) {
+    icalattach *a = icalproperty_get_attach(attach);
+
+    int isurl = icalattach_get_is_url (a);
+    if (isurl == 0)
+      attachment = new Attachment((const char*)icalattach_get_data(a));
+    else {
+      attachment = new Attachment(QString(icalattach_get_url(a)));
+    }
   }
+  else if ( value_kind == ICAL_URI_VALUE ) {
+    attachment = new Attachment(QString(icalvalue_get_uri(icalproperty_get_value(attach))));
+  }
 
   icalparameter *p = icalproperty_get_first_parameter(attach, ICAL_FMTTYPE_PARAMETER);
-  if (p)
+  if (p && attachment)
     attachment->setMimeType(QString(icalparameter_get_fmttype(p)));
 
   return attachment;