Bug 492120 - crash on parsing outlook event
Summary: crash on parsing outlook event
Status: RESOLVED FIXED
Alias: None
Product: Akonadi
Classification: Frameworks and Libraries
Component: EWS Resource (show other bugs)
Version: 6.1.2
Platform: openSUSE Linux
: NOR crash
Target Milestone: ---
Assignee: kdepim bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-08-24 08:47 UTC by Cyrille Dunant
Modified: 2024-09-28 15:45 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Cyrille Dunant 2024-08-24 08:47:02 UTC
***
If you're not sure this is actually a bug, instead post about it at https://discuss.kde.org

If you're reporting a crash, attach a backtrace with debug symbols; see https://community.kde.org/Guidelines_and_HOWTOs/Debugging/How_to_create_useful_crash_reports
***

SUMMARY
Crash on parsing outlook event

STEPS TO REPRODUCE
 systematic crash

OBSERVED RESULT

used valgrind to generate the following.

parse error from icalcomponent_new_from_string. string= "BEGIN:VCALENDAR\r\nMETHOD:PUBLISH\r\nPRODID:Microsoft Exchange Server 2010\r\nVERSION:2.0\r\nBEGIN:VTIMEZONE\r\nTZID:GMT Standard Time\r\nBEGIN:STANDARD\r\nDTSTART:16010101T020000\r\nTZOFFSETFROM:+0100\r\nTZOFFSETTO:+0000\r\nRRULE:FREQ=YEARLY;INTERVAL=1;BYDAY=-1SU;BYMONTH=10\r\nEND:STANDARD\r\nBEGIN:DAYLIGHT\r\nDTSTART:16010101T010000\r\nTZOFFSETFROM:+0000\r\nTZOFFSETTO:+0100\r\nRRULE:FREQ=YEARLY;INTERVAL=1;BYDAY=-1SU;BYMONTH=3\r\nEND:DAYLIGHT\r\nEND:VTIMEZONE\r\nBEGIN:VEVENT\r\nORGANIZER;CN=Lucy xxx:mailto:lucy.xxx@xxx.COM\r\nATTENDEE;ROLE=REQ-PARTICIPANT;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;CN=Sam xxx:m\r\n ailto:sam.xxx@xxx.com\r\nATTENDEE;ROLE=REQ-PARTICIPANT;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;CN=Lucy xxx\r\n :mailto:lucy.xxx@xxx.COM\r\nATTENDEE;ROLE=REQ-PARTICIPANT;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;CN=xxx Du\r\n nant:mailto:xxx@xxx.ac.uk\r\nATTENDEE;ROLE=REQ-PARTICIPANT;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;CN=xxx H\r\n xxx:mailto:xxx@xxx.ac.uk\r\nATTENDEE;ROLE=REQ-PARTICIPANT;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;CN=xxx Hor\r\n wood:mailto:rachel.xxx@xxx.com\r\nATTENDEE;ROLE=REQ-PARTICIPANT;PARTSTAT=NEEDS-ACTION;RSVP=TRUE;CN=XXX XXX:\r\n mailto:ian.xxx@xxx.com\r\nDESCRIPTION:\\nThis email was sent by XXXXXX\\, a\r\n  company registered in England and Wales\\, registered number: XXX\\, re\r\n gistered office: xxx Road\\, xxx\\, XXX XXX\\, UK. This transmiss\r\n ion is confidential and must not be used or disclosed by anyone other than\r\n  the intended recipient. The xxx xxx xxx (the xxx\r\n ) cannot accept any responsibility for any use or misuse of the transmissi\r\n on by anyone. For address and company registration details of certain enti\r\n ties within the Institute\\, please visit https://eur03.safelinks.protectio\r\n n.outlook.com/?url=http%3A%2F%2Fwww.XXX.com%2F&amp\\;data=05%7C01%7Ccfd30\r\n %40universityofcambridgecloud.onmicrosoft.com%7C2c775605761f4696072208da84\r\n 3a522d%7C49a50445bdfa4b79ade3547b4f3986e9%7C0%7C0%7C637967683386471340%7CU\r\n nknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiL\r\n CJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp\\;sdata=8D5CiDQKryfBe4%2FauFf2OfpAqi453%2\r\n FXnGzqtmeqyxWk%3D&amp\\;reserved=0\\n\r\nRRULE:FREQ=WEEKLY;INTERVAL=1;BYDAY=MO;WKST=SU\r\nUID:040000008200E00074C5B7101A82E00800000000C155B454A887D801000000000000000\r\n 010000000CA7E36147AB0114EBF83B5285A67F3F6\r\nRECURRENCE-ID:20220822T130000Z\r\nSUMMARY:Canceled: C2Z - xxx\r\nDTSTART;TZID=GMT Standard Time:20220822T140000\r\nDTEND;TZID=GMT Standard Time:20220822T142500\r\nCLASS:PUBLIC\r\nPRIORITY:1\r\nDTSTAMP:20220822T123158Z\r\nTRANSP:TRANSPARENT\r\nSTATUS:CANCELLED\r\nSEQUENCE:1\r\nLOCATION:\r\nX-MICROSOFT-CDO-APPT-SEQUENCE:1\r\nX-MICROSOFT-CDO-OWNERAPPTID:2120663745\r\nX-MICROSOFT-CDO-BUSYSTATUS:FREE\r\nX-MICROSOFT-CDO-INTENDEDSTATUS:BUSY\r\nX-MICROSOFT-CDO-ALLDAYEVENT:FALSE\r\nX-MICROSOFT-CDO-IMPORTANCE:2\r\nX-MICROSOFT-CDO-INSTTYPE:3\r\nX-MICROSOFT-ONLINEMEETINGINFORMATION:{\"OnlineMeetingChannelId\":null\\,\"Onlin\r\n eMeetingProvider\":3}\r\nX-MICROSOFT-SKYPETEAMSMEETINGURL:https://teams.microsoft.com/l/meetup-join/\r\n 19%3ameeting_OTE2NDRiY2EtODVjOS00Mzk1LWI1YjUtMDA1NWI1ZjNjZmFk%40thread.v2/\r\n 0?context=%7b%22Tid%22%3a%221250875b-14bb-40c2-99ef-769f1a5ffc5f%22%2c%22O\r\n id%22%3a%22a7671769-8649-47ae-96a1-5377aa7a0e0c%22%7d\r\nX-MICROSOFT-SCHEDULINGSERVICEUPDATEURL:https://api.scheduler.teams.microsof\r\n t.com/teams/1250875b-14bb-40c2-99ef-769f1a5ffc5f/a7671769-8649-47ae-96a1-5\r\n 377aa7a0e0c/19_meeting_OTE2NDRiY2EtODVjOS00Mzk1LWI1YjUtMDA1NWI1ZjNjZmFk@th\r\n read.v2/0\r\nX-MICROSOFT-SKYPETEAMSPROPERTIES:{\"cid\":\"19:meeting_OTE2NDRiY2EtODVjOS00Mzk\r\n 1LWI1YjUtMDA1NWI1ZjNjZmFk@thread.v2\"\\,\"rid\":0\\,\"mid\":0\\,\"uid\":null\\,\"priva\r\n te\":true\\,\"type\":0}\r\nX-MICROSOFT-ONLINEMEETINGCONFLINK:conf:sip:lucy.xxx@xxx.COM\\;gruu\\;opaq\r\n ue=app:conf:focus:id:teams:2:0!19:meeting_OTE2NDRiY2EtODVjOS00Mzk1LWI1YjUt\r\n MDA1NWI1ZjNjZmFk-thread.v2!a7671769864947ae96a15377aa7a0e0c!1250875b14bb40\r\n c299ef769f1a5ffc5f\r\nX-MICROSOFT-DONOTFORWARDMEETING:FALSE\r\nX-MICROSOFT-DISALLOW-COUNTER:FALSE\r\nX-MICROSOFT-REQUESTEDATTENDANCEMODE:DEFAULT\r\nX-MICROSOFT-ISRESPONSEREQUESTED:TRUE\r\nBEGIN:VALARM\r\nDESCRIPTION:REMINDER\r\nTRIGGER;RELATED=START:-PT15M\r\nACTION:DISPLAY\r\nEND:VALARM\r\nEND:VEVENT\r\nBEGIN:VEVENT\r\nUID:040000008200E00074C5B7101A82E00800000000C155B454A887D801000000000000000\r\n 010000000CA7E36147AB0114EBF83B5285A67F3F6\r\nEND:VEVENT\r\n"
==52006== Thread 1:
==52006== Invalid read of size 16
==52006==    at 0x1683CF: UnknownInlinedFun (qsharedpointer_impl.h:341)
==52006==    by 0x1683CF: EwsFetchCalendarDetailJob::exceptionItemsFetched(KJob*) (ewsfetchcalendardetailjob.cpp:179)
==52006==    by 0x11657F4F: UnknownInlinedFun (qobjectdefs_impl.h:469)
==52006==    by 0x11657F4F: void doActivate<false>(QObject*, int, void**) (qobject.cpp:4086)
==52006==    by 0x5272C64: KJob::result(KJob*, KJob::QPrivateSignal) (moc_kjob.cpp:622)
==52006==    by 0x5274EAA: KJob::finishJob(bool) (kjob.cpp:98)
==52006==    by 0x11657F4F: UnknownInlinedFun (qobjectdefs_impl.h:469)
==52006==    by 0x11657F4F: void doActivate<false>(QObject*, int, void**) (qobject.cpp:4086)
==52006==    by 0x5272C64: KJob::result(KJob*, KJob::QPrivateSignal) (moc_kjob.cpp:622)
==52006==    by 0x5274EAA: KJob::finishJob(bool) (kjob.cpp:98)
==52006==    by 0x11657F4F: UnknownInlinedFun (qobjectdefs_impl.h:469)
==52006==    by 0x11657F4F: void doActivate<false>(QObject*, int, void**) (qobject.cpp:4086)
==52006==    by 0x1019AB1D: QNetworkReplyHttpImplPrivate::finished() (qnetworkreplyhttpimpl.cpp:2147)
==52006==    by 0x11641DDA: QObject::event(QEvent*) (qobject.cpp:1452)
==52006==    by 0x10418F5D: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3287)
==52006==    by 0x115FEBEF: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1142)
==52006==  Address 0xfffffffffffffff0 is not stack'd, malloc'd or (recently) free'd


EXPECTED RESULT


SOFTWARE/OS VERSIONS
Operating System: openSUSE Tumbleweed 20240820
KDE Plasma Version: 6.1.4
KDE Frameworks Version: 6.5.0
Qt Version: 6.7.2
Kernel Version: 6.10.5-1-default (64-bit)
Graphics Platform: Wayland

ADDITIONAL INFORMATION
Comment 1 Allen Winter 2024-08-24 16:24:48 UTC
A few observations:

As a libical guy, I can see right away that the calendar string is invalid since it doesn't end with a "END:VCALENDAR\r\n"

then looking in EwsFetchCalendarDetailJob::processItems() I see
format.fromString(memcal, mimeContent); not being checked for a failure return and then properly handled.

maybe something as simple as
`if(!format.fromString(memcal, mimeContent) continue;`
or somesuch

anyway, I can't help test and I'm not up on Akonadi either.
this one interested me because I thought it might point to a bug in libical.  I don't that that's the case.
Comment 2 Cyrille Dunant 2024-08-24 16:27:50 UTC
I'm a mere user, but this is quite common, for whichever reason -- I have wayyy too many calendars and sadly some are outlook.

But because it causes crashes, effectively it makes the ews calendar fetching fail
Comment 3 Cyrille Dunant 2024-08-24 16:36:44 UTC
(In reply to Allen Winter from comment #1)
> A few observations:
> 
> As a libical guy, I can see right away that the calendar string is invalid
> since it doesn't end with a "END:VCALENDAR\r\n"
> 
> then looking in EwsFetchCalendarDetailJob::processItems() I see
> format.fromString(memcal, mimeContent); not being checked for a failure
> return and then properly handled.
> 
> maybe something as simple as
> `if(!format.fromString(memcal, mimeContent) continue;`
> or somesuch
> 
> anyway, I can't help test and I'm not up on Akonadi either.
> this one interested me because I thought it might point to a bug in libical.
> I don't that that's the case.

Sorry, I think it may still be in effect a parsing bug: the string is malformed, yes, but all the information is there, so it would be right, I think, to still be able to handle this case, as a matter of robustness.

Of course, this is my opinion as a user, for what it's worth.
Comment 4 Cyrille Dunant 2024-08-24 16:42:35 UTC
This is a duplicate of Bug 491681 (based on the comment below by Allen Winter)
Comment 5 Bug Janitor Service 2024-09-13 10:22:19 UTC
A possibly relevant merge request was started @ https://invent.kde.org/pim/kdepim-runtime/-/merge_requests/183
Comment 6 Daniel Vrátil 2024-09-13 10:53:11 UTC
Git commit 2c4d702e630e832237f02b762890ca8ed03bd08c by Daniel Vrátil.
Committed on 13/09/2024 at 10:21.
Pushed by dvratil into branch 'release/24.08'.

Attempt to workaround EWS servers sometimes returning broken iCal

Apparently it's a known issue that some versions of EWS (including Outlook365)
in some situations return an invalid iCal that is missing the closing
END:VCALENDAR entry. This causes the event to be missing at best or to
crash the EWS code at worst.

This workaround simply checks for presence of END:VCALENDAR in the response
and if it's missing it will simply append it to the end.
Related: bug 491681
FIXED-IN: 24.08.2

M  +22   -2    resources/ews/calendar/ewsfetchcalendardetailjob.cpp

https://invent.kde.org/pim/kdepim-runtime/-/commit/2c4d702e630e832237f02b762890ca8ed03bd08c
Comment 7 Cyrille Dunant 2024-09-28 15:45:15 UTC
It works for me, now with the patch.