Version:           1.9.7 (compiled from svn) (using KDE KDE 3.5.7)
Installed from:    Debian testing/unstable Packages
Compiler:          gcc 4.1.3 
OS:                Linux

Hello,

I just found a bug in KMail when playing around with GPG. If no gpg-agent is running you will be asked for a passphrase to be able to decrypt your message.

Once this dialog is open, select a different folder in your folder list (choosing a different mail should do the trick too) and click CANCEL in the gpg passphrase dialog.

You end up with a crash, here is the backtrace:
Using host libthread_db library "/lib/libthread_db.so.1".
[Thread debugging using libthread_db enabled]
[New Thread 48000762883616 (LWP 10488)]
[New Thread 1107310928 (LWP 10492)]
[New Thread 1098918224 (LWP 10491)]
[New Thread 1090525520 (LWP 10490)]
[New Thread 1082132816 (LWP 10489)]
[KCrash handler]
#5  0x0000000000000021 in ?? ()
#6  0x00002ba801b4e0f6 in KMReaderWin::parseMsg (this=0x8d5600, aMsg=0xaceb90)
    at kmreaderwin.cpp:1562
#7  0x00002ba801b47060 in KMReaderWin::displayMessage (this=0x8d5600)
    at kmreaderwin.cpp:1484
#8  0x00002ba801b471c1 in KMReaderWin::updateReaderWin (this=0x8d5600)
    at kmreaderwin.cpp:1420
#9  0x00002ba801b49e9d in KMReaderWin::qt_invoke (this=0x8d5600, _id=48, 
    _o=0x7fffa9583ed0) at kmreaderwin.moc:282
#10 0x00002ba80897b4ee in QObject::activate_signal ()
   from /usr/lib/libqt-mt.so.3
#11 0x00002ba80897c088 in QObject::activate_signal ()
   from /usr/lib/libqt-mt.so.3
#12 0x00002ba808ceb0e2 in QTimer::timeout () from /usr/lib/libqt-mt.so.3
#13 0x00002ba8089a19a3 in QTimer::event () from /usr/lib/libqt-mt.so.3
#14 0x00002ba808916842 in QApplication::internalNotify ()
   from /usr/lib/libqt-mt.so.3
#15 0x00002ba8089185f0 in QApplication::notify () from /usr/lib/libqt-mt.so.3
#16 0x00002ba8076943f8 in KApplication::notify ()
   from /usr/lib/libkdecore.so.4
#17 0x00002ba8088a97f2 in QApplication::sendEvent ()
   from /usr/lib/libqt-mt.so.3
#18 0x00002ba808909b28 in QEventLoop::activateTimers ()
   from /usr/lib/libqt-mt.so.3
#19 0x00002ba8088bd865 in QEventLoop::processEvents ()
   from /usr/lib/libqt-mt.so.3
#20 0x00002ba80892fe27 in QEventLoop::enterLoop () from /usr/lib/libqt-mt.so.3
#21 0x00002ba80892fc2f in QEventLoop::exec () from /usr/lib/libqt-mt.so.3
#22 0x00002ba808918324 in QApplication::exec () from /usr/lib/libqt-mt.so.3
#23 0x0000000000403576 in main (argc=1, argv=0x7fffa9584c58) at main.cpp:110

This is actually in KMReaderWin::parseMsg (kmreaderwin.cpp). The message is parsed:
  ObjectTreeParser otp( this );
  otp.parseObjectTree( mRootNode );

Selecting a different folder in the meanwhile means that aMsg has been (I think) freed, and this line causes the crash:
  aMsg->setEncryptionState( encryptionState );

My C++ knowledge is far from perfect, therefore I don't know of a way to check if the memory is still valid or not.

Cheers,
acp