Bug 96498

BackTrace:

Using host libthread_db library "/lib/tls/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread 1110342976 (LWP 30234)]
[KCrash handler]
#3  0x4155e6a0 in DwHeaders::FindField () from /usr/lib/libmimelib.so.1
#4  0x4016214a in KMMessage::headerField () from /usr/lib/libkmailprivate.so.0
#5  0x4016160f in KMMessage::msgId () from /usr/lib/libkmailprivate.so.0
#6  0x4022d98a in KMReaderWin::parseMsg () from /usr/lib/libkmailprivate.so.0
#7  0x4022d203 in KMReaderWin::displayMessage ()
   from /usr/lib/libkmailprivate.so.0
#8  0x4022cdb9 in KMReaderWin::updateReaderWin ()
   from /usr/lib/libkmailprivate.so.0
#9  0x40233f2a in KMReaderWin::qt_invoke () from /usr/lib/libkmailprivate.so.0
#10 0x40b4252c in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#11 0x40b42354 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#12 0x40e8227b in QTimer::timeout () from /usr/lib/libqt-mt.so.3
#13 0x40b63d42 in QTimer::event () from /usr/lib/libqt-mt.so.3
#14 0x40ae5bcf in QApplication::internalNotify () from /usr/lib/libqt-mt.so.3
#15 0x40ae51ce in QApplication::notify () from /usr/lib/libqt-mt.so.3
#16 0x40715da3 in KApplication::notify () from /usr/lib/libkdecore.so.4
#17 0x40ad5405 in QEventLoop::activateTimers () from /usr/lib/libqt-mt.so.3
#18 0x40a8ec4b in QEventLoop::processEvents () from /usr/lib/libqt-mt.so.3
#19 0x40af7f28 in QEventLoop::enterLoop () from /usr/lib/libqt-mt.so.3
#20 0x40af7dd8 in QEventLoop::exec () from /usr/lib/libqt-mt.so.3
#21 0x40ae5e21 in QApplication::exec () from /usr/lib/libqt-mt.so.3
#22 0x0804a0b4 in ?? ()
#23 0xbffff9d0 in ?? ()
#24 0xbffff8e0 in ?? ()
#25 0x00000000 in ?? ()
#26 0x00000000 in ?? ()
#27 0x40f88620 in vtable for QGArray () from /usr/lib/libqt-mt.so.3
#28 0x0819cdf0 in ?? ()
#29 0x00000000 in ?? ()
#30 0x4066aa20 in __after_morecore_hook () from /lib/tls/libc.so.6
#31 0x4043c4f0 in vtable for KMKernel () from /usr/lib/libkmailprivate.so.0
#32 0x4066a620 in __after_morecore_hook () from /lib/tls/libc.so.6
#33 0x00000000 in ?? ()
#34 0x00000000 in ?? ()
#35 0x0821ace0 in ?? ()
#36 0x0821a9c0 in ?? ()
#37 0x0821b340 in ?? ()
#38 0x00000000 in ?? ()
#39 0x00000000 in ?? ()
#40 0x00000000 in ?? ()
#41 0x08263488 in ?? ()
#42 0x08265a68 in ?? ()
#43 0x082666d8 in ?? ()
#44 0x082679b8 in ?? ()
#45 0x0824add8 in ?? ()
#46 0x08228c18 in ?? ()
#47 0x082d2468 in ?? ()
#48 0x0822a728 in ?? ()
#49 0x0822adb0 in ?? ()
#50 0x08228bc0 in ?? ()
#51 0x08230140 in ?? ()
#52 0x0822a6a0 in ?? ()
#53 0x08228938 in ?? ()
#54 0x082d6768 in ?? ()
#55 0x08233440 in ?? ()
#56 0x082fdb98 in ?? ()
#57 0x084d2860 in ?? ()
#58 0x00000000 in ?? ()
#59 0x08215600 in ?? ()
#60 0x082287b8 in ?? ()
#61 0x01000000 in ?? ()
#62 0x08000001 in ?? ()
#63 0x0809f0e0 in ?? ()
#64 0x0805faa8 in ?? ()
#65 0x00000000 in ?? ()
#66 0x00000000 in ?? ()
#67 0x0821b2a8 in ?? ()
#68 0x0001d4c0 in ?? ()
#69 0x082fdda0 in ?? ()
#70 0x0821adb0 in ?? ()
#71 0x0821b0d0 in ?? ()
#72 0x00000000 in ?? ()
#73 0x08228710 in ?? ()
#74 0x41de2d70 in KDirListerCache::FilesRemoved () from /usr/lib/libkio.so.4
#75 0x4054e904 in __libc_start_main () from /lib/tls/libc.so.6
#76 0x08049e11 in ?? ()

I really don't know if this is the same problem I have but it certainly seems like it. Only my problem is on Gentoo with KDE 3.4 and it doesn't depend on whether or not I cancel the dialog window. Also it only happens with the second password dialog.

For explanation of that: KMail automatically pops up two password dialogs whenever I select an encrypted message. Only the second one can be used at first and the message gets correctly decrypted after entering the correct passphrase. But whatever I do with the remaining password window (cancel, just close, enter incorrect or correct passphrase) kmail will crash. Unfortunately I don't have much of a backtrace, maybe this is somehow useful though:

Using host libthread_db library "/lib/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread 16384 (LWP 17255)]

0x42233618 in waitpid () from /lib/libpthread.so.0
#0  0x42233618 in waitpid () from /lib/libpthread.so.0
#1  0x417ff5e8 in ?? () from /usr/kde/3.4/lib/libkdecore.so.4
#2  0x4171efee in KCrash::defaultCrashHandler(int) ()
   from /usr/kde/3.4/lib/libkdecore.so.4
#3  0x4180d704 in kde_malloc_is_used () from /usr/kde/3.4/lib/libkdecore.so.4
#4  0x00000001 in ?? ()
#5  0x4180d720 in kde_malloc_is_used () from /usr/kde/3.4/lib/libkdecore.so.4
#6  0x417ff5e8 in ?? () from /usr/kde/3.4/lib/libkdecore.so.4
#7  0x4180d704 in kde_malloc_is_used () from /usr/kde/3.4/lib/libkdecore.so.4
#8  0x00000001 in ?? ()

*** Bug 103906 has been marked as a duplicate of this bug. ***

*** Bug 107426 has been marked as a duplicate of this bug. ***

I think this is related to a problem I'm getting. I opened this bug at the Ubuntu bugzilla:

This bug is a bit of a strange one, which most people will probably never
encounter, but I did...
If you select a PGP encrypted message, then cancel the passphrase entry
dialogue, then select another folder, then cancel the invalid passphrase
dialogue, KMail crashes.

To reproduce:
1. Select a PGP encrypted message;
2. You will be prompted for the GPG passphrase - click cancel;
3. There is now an invalid passphrase dialogue - ignore it for the moment;
4. Click on a folder other than the one your encrypted message is in;
5. Click cancel on the invalid passphrase dialogue;
6. KMail crashes.

I'm running Hoary on AMD64.

See: http://bugzilla.ubuntu.com/show_bug.cgi?id=13204
There's a backtrace there too.

My installation: KDE Version: 1.8.2 (KDE 3.4.2, Debian Package 4:3.4.2-4 (testing/unstable))

I have the same problem, but I noticed that it only happens when using inline encryption. Hitting escape when being asked for the passphrase lets KMail crash - but not all of the time.

*** This bug has been confirmed by popular vote. ***

A backtrace with a self-compiled (debug) version of kdepim would be useful; the backtraces in this report until now are unfortunately useless.

I just confirm this bug (kmail1.9.5, kontact 1.2.3, ArchLinux 0.8):

The following sequence will shurly crash kmail:
- receive an encrypted email
- select this email (to read you must type the passphrase)
- leave this mail selected
- choose another folder
- switch back to the 1st folder (a msgbox is opened to type the passphrase)
- (do not type the passphrase) select a different mail
- click cancel in the passphrase-dialog
- CRASH ! (SIGSEGV)

The following scenario also will let kmail crash (recently checked with 1.9.6 using imap folders):

- Select encrypted mail for reading - password dialog opens
- Select different folder without entering password (password dialog still open)
- Click "Cancel" in password dialog 
-> Crash

[KCrash handler]
#6  0x084c1009 in ?? ()
#7  0xb543fb5f in KMReaderWin::parseMsg () from /usr/lib/libkmailprivate.so
#8  0xb5346343 in KMReaderWin::displayMessage ()
   from /usr/lib/libkmailprivate.so
#9  0xb5375eae in KMReaderWin::updateReaderWin ()
   from /usr/lib/libkmailprivate.so
#10 0xb5433fd0 in KMReaderWin::update () from /usr/lib/libkmailprivate.so
#11 0xb51a2342 in KMail::ISubject::notify () from /usr/lib/libkmailprivate.so
#12 0xb5334d16 in KMMessage::updateBodyPart ()
   from /usr/lib/libkmailprivate.so
#13 0xb535fadb in KMail::ImapJob::slotGetMessageResult ()
   from /usr/lib/libkmailprivate.so
#14 0xb541b415 in KMail::ImapJob::qt_invoke ()
   from /usr/lib/libkmailprivate.so
#15 0xb6fbd957 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#16 0xb6a9cc0e in KIO::Job::result () from /usr/lib/libkio.so.4
#17 0xb6adf5ed in KIO::Job::emitResult () from /usr/lib/libkio.so.4
#18 0xb6adfa4e in KIO::SimpleJob::slotFinished () from /usr/lib/libkio.so.4
#19 0xb6ae015d in KIO::TransferJob::slotFinished () from /usr/lib/libkio.so.4
#20 0xb6adf21a in KIO::TransferJob::qt_invoke () from /usr/lib/libkio.so.4
#21 0xb6fbd957 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#22 0xb6fbe3fc in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#23 0xb6a981ac in KIO::SlaveInterface::finished () from /usr/lib/libkio.so.4
#24 0xb6afcff0 in KIO::SlaveInterface::dispatch () from /usr/lib/libkio.so.4
#25 0xb6b0558a in KIO::SlaveInterface::dispatch () from /usr/lib/libkio.so.4
#26 0xb6aac50c in KIO::Slave::gotInput () from /usr/lib/libkio.so.4
#27 0xb6af5a90 in KIO::Slave::qt_invoke () from /usr/lib/libkio.so.4
#28 0xb6fbd957 in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#29 0xb6fbe26e in QObject::activate_signal () from /usr/lib/libqt-mt.so.3
#30 0xb734acdb in QSocketNotifier::activated () from /usr/lib/libqt-mt.so.3
#31 0xb6fe0516 in QSocketNotifier::event () from /usr/lib/libqt-mt.so.3
#32 0xb6f54b88 in QApplication::internalNotify () from /usr/lib/libqt-mt.so.3
#33 0xb6f569b7 in QApplication::notify () from /usr/lib/libqt-mt.so.3
#34 0xb765cc82 in KApplication::notify () from /usr/lib/libkdecore.so.4
#35 0xb6ee7389 in QApplication::sendEvent () from /usr/lib/libqt-mt.so.3
#36 0xb6f46f81 in QEventLoop::activateSocketNotifiers ()
   from /usr/lib/libqt-mt.so.3
#37 0xb6efbea7 in QEventLoop::processEvents () from /usr/lib/libqt-mt.so.3
#38 0xb6f6f25e in QEventLoop::enterLoop () from /usr/lib/libqt-mt.so.3
#39 0xb6f6f06e in QEventLoop::exec () from /usr/lib/libqt-mt.so.3
#40 0xb6f56731 in QApplication::exec () from /usr/lib/libqt-mt.so.3
#41 0x08061095 in ?? ()
#42 0xbfac087c in ?? ()
#43 0x00000001 in ?? ()
#44 0x00000001 in ?? ()
#45 0x00000000 in ?? ()

Kmail (1.9.6) will also crash when you select an encrypted mail (password dialog opens), select another mail in same folder and then click "Cancel" on the password dialog. 

*** Bug 139590 has been marked as a duplicate of this bug. ***

*** Bug 107114 has been marked as a duplicate of this bug. ***

For the interested reader:

==21822== Invalid write of size 1
==21822==    at 0x4422A82: partNode::setProcessed(bool, bool) (partNode.h:192)
==21822==    by 0x441C71C: KMail::ObjectTreeParser::parseObjectTree(partNode*) (objecttreeparser.cpp:284)
==21822==    by 0x43097EC: KMReaderWin::parseMsg(KMMessage*) (kmreaderwin.cpp:1546)
==21822==    by 0x4302508: KMReaderWin::displayMessage() (kmreaderwin.cpp:1481)
==21822==    by 0x4302648: KMReaderWin::updateReaderWin() (kmreaderwin.cpp:1417)
==21822==    by 0x4302BDF: KMReaderWin::setMsg(KMMessage*, bool) (kmreaderwin.cpp:1223)
==21822==    by 0x42FDB29: KMReaderWin::slotMessageArrived(KMMessage*) (kmreaderwin.cpp:822)
==21822==    by 0x4305499: KMReaderWin::qt_invoke(int, QUObject*) (kmreaderwin.moc:311)
==21822==    by 0x5DA7F1C: QObject::activate_signal(QConnectionList*, QUObject*) (in /usr/lib/qt3/lib/libqt-mt.so.3.3.8)
==21822==    by 0x4478166: KMail::FolderJob::messageRetrieved(KMMessage*) (folderjob.moc:129)
==21822==    by 0x447FC16: KMail::ImapJob::slotGetMessageResult(KIO::Job*) (imapjob.cpp:444)
==21822==    by 0x44805AA: KMail::ImapJob::qt_invoke(int, QUObject*) (imapjob.moc:126)
==21822==    by 0x5DA7F1C: QObject::activate_signal(QConnectionList*, QUObject*) (in /usr/lib/qt3/lib/libqt-mt.so.3.3.8)
==21822==    by 0x5307EB0: KIO::Job::result(KIO::Job*) (in /opt/kde3/lib/libkio.so.4.2.0)
==21822==  Address 0xD6D47EC is 12 bytes inside a block of size 176 free'd
==21822==    at 0x4022D21: operator delete(void*) (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so)
==21822==    by 0x430930C: KMReaderWin::parseMsg(KMMessage*) (kmreaderwin.cpp:1507)
==21822==    by 0x4302508: KMReaderWin::displayMessage() (kmreaderwin.cpp:1481)
==21822==    by 0x4302648: KMReaderWin::updateReaderWin() (kmreaderwin.cpp:1417)
==21822==    by 0x4302BDF: KMReaderWin::setMsg(KMMessage*, bool) (kmreaderwin.cpp:1223)
==21822==    by 0x42FDB29: KMReaderWin::slotMessageArrived(KMMessage*) (kmreaderwin.cpp:822)
==21822==    by 0x4305499: KMReaderWin::qt_invoke(int, QUObject*) (kmreaderwin.moc:311)
==21822==    by 0x5DA7F1C: QObject::activate_signal(QConnectionList*, QUObject*) (in /usr/lib/qt3/lib/libqt-mt.so.3.3.8)
==21822==    by 0x4478166: KMail::FolderJob::messageRetrieved(KMMessage*) (folderjob.moc:129)
==21822==    by 0x447FC16: KMail::ImapJob::slotGetMessageResult(KIO::Job*) (imapjob.cpp:444)
==21822==    by 0x44805AA: KMail::ImapJob::qt_invoke(int, QUObject*) (imapjob.moc:126)
==21822==    by 0x5DA7F1C: QObject::activate_signal(QConnectionList*, QUObject*) (in /usr/lib/qt3/lib/libqt-mt.so.3.3.8)
==21822==    by 0x5307EB0: KIO::Job::result(KIO::Job*) (in /opt/kde3/lib/libkio.so.4.2.0)
==21822==    by 0x53470DC: KIO::Job::emitResult() (in /opt/kde3/lib/libkio.so.4.2.0)

SVN commit 645047 by coolo:

another one of my most hated kmail crashes: if you cancel
gpg passphrase, kmail will crash in most cases you was careless.
After some fiddling I didn't find a better solution to this
problem than adding a direct protection member to the message.
BUG: 96498


 M  +12 -0     kmheaders.cpp  
 M  +2 -0      kmmessage.cpp  
 M  +7 -0      kmmessage.h  
 M  +10 -1     kmreaderwin.cpp  


--- branches/KDE/3.5/kdepim/kmail/kmheaders.cpp #645046:645047
@@ -1731,6 +1731,9 @@
 
 void KMHeaders::selectNextMessage()
 {
+  KMMessage *cm = currentMsg();
+  if ( cm && cm->isBeingParsed() )
+    return;
   QListViewItem *lvi = currentItem();
   if( lvi ) {
     QListViewItem *below = lvi->itemBelow();
@@ -1765,6 +1768,9 @@
 
 void KMHeaders::selectPrevMessage()
 {
+  KMMessage *cm = currentMsg();
+  if ( cm && cm->isBeingParsed() )
+    return;
   QListViewItem *lvi = currentItem();
   if( lvi ) {
     QListViewItem *above = lvi->itemAbove();
@@ -1788,6 +1794,9 @@
 
 void KMHeaders::incCurrentMessage()
 {
+  KMMessage *cm = currentMsg();
+  if ( cm && cm->isBeingParsed() )
+    return;
   QListViewItem *lvi = currentItem();
   if ( lvi && lvi->itemBelow() ) {
 
@@ -1803,6 +1812,9 @@
 
 void KMHeaders::decCurrentMessage()
 {
+  KMMessage *cm = currentMsg();
+  if ( cm && cm->isBeingParsed() )
+    return;
   QListViewItem *lvi = currentItem();
   if ( lvi && lvi->itemAbove() ) {
     disconnect(this,SIGNAL(currentChanged(QListViewItem*)),
--- branches/KDE/3.5/kdepim/kmail/kmmessage.cpp #645046:645047
@@ -152,6 +152,7 @@
   mUnencryptedMsg = 0;
   mLastUpdated = 0;
   mCursorPos = 0;
+  mIsParsed = false;
 }
 
 void KMMessage::assign( const KMMessage& other )
@@ -174,6 +175,7 @@
   mEncryptionState = other.mEncryptionState;
   mSignatureState = other.mSignatureState;
   mMDNSentState = other.mMDNSentState;
+  mIsParsed = other.mIsParsed;
   mDate    = other.mDate;
   if( other.hasUnencryptedMsg() )
     mUnencryptedMsg = new KMMessage( *other.unencryptedMsg() );
--- branches/KDE/3.5/kdepim/kmail/kmmessage.h #645046:645047
@@ -855,6 +855,12 @@
   /** Set cursor position as offset from message start */
   void setCursorPos(int pos) { mCursorPos = pos; };
 
+  /* This is set in kmreaderwin if a message is being parsed to avoid
+     other parts of kmail (e.g. kmheaders) destroying the message. 
+     Parsing can take longer and can be async (in case of gpg mails) */
+  bool isBeingParsed() const { return mIsParsed; }
+  void setIsBeingParsed( bool t ) { mIsParsed = t; }
+
 private:
 
   /** Initialization shared by the ctors. */
@@ -869,6 +875,7 @@
   bool mDecodeHTML :1;
   bool mReadyToShow :1;
   bool mComplete :1;
+  bool mIsParsed : 1;
   static const KMail::HeaderStrategy * sHeaderStrategy;
   static QString sForwardStr;
   const QTextCodec * mOverrideCodec;
--- branches/KDE/3.5/kdepim/kmail/kmreaderwin.cpp #645046:645047
@@ -1504,7 +1504,14 @@
 
   assert(aMsg!=0);
 
-  delete mRootNode;
+  aMsg->setIsBeingParsed( true );
+
+  if ( mRootNode && !mRootNode->processed() )
+  {
+    kdWarning() << "The root node is not yet processed! Danger!\n";
+    return;
+  } else
+    delete mRootNode;
   mRootNode = partNode::fromMessage( aMsg );
   const QCString mainCntTypeStr = mRootNode->typeString() + '/' + mRootNode->subTypeString();
 
@@ -1642,6 +1649,8 @@
     showHideMimeTree( rootNodeCntType == DwMime::kTypeText &&
 		      rootNodeCntSubtype == DwMime::kSubtypePlain );
   }
+
+  aMsg->setIsBeingParsed( false );
 }
 
 

This crash is not resolved for me. I am using KMail Version 1.11.1 using KDE 4.2.1 (KDE 4.2.1) from Debian experimental. Steps to reproduce just as in comment #11:
1) Select GPG encrypted mail.
2) Passphrase dialog opens.
3) Select different mail in same or different folder.
4) Cancel dialog.
5) SIGSEGV

Hi,
I have the described problem, too.
However it is irrelevant, whether to press cancel or enter the passphrase and click ok. KMail does not always crash, but quite often (at roughly estimated 50% or even more).
This is the sequence, to get this crash:
- Select an encrypted e-mail, so that it shall be shown in the viewer (this can even be directly after launching KMail, if the mail selected in the last KMail-session is encrypted)
- The warning "Danger, recursion while displaying a message!" is written from ViewerPrivate::updateReaderWin() -- if this warning does not appear, KMail will not crash
- The dialog to enter the passphrase is shown
- User closes the dialog (does not matter how, press ok, cancel or close "x")
- CRASH

I discovered, that the bug I have just described is listed as bug 279749.