Bug 217142

Summary: Evolution heap corruption
Product: [openSUSE] openSUSE 10.2 Reporter: Hans Petter Jansson <hpj>
Component: EvolutionAssignee: Harish Krishnaswamy <kharish>
Status: RESOLVED FIXED QA Contact: A Nagappan <anagappan>
Severity: Critical    
Priority: P5 - None    
Version: Beta 1 plus   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: Development Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Hans Petter Jansson 2006-11-01 20:46:28 UTC
Evolution crashes randomly for me, so frequently that I cannot read my mail at all. It seems to happen while it's checking my remote IMAP account. I have a decent stack trace, which indicates that there's a double free() or other heap corruption going on.

Crashing thread (Thread 7):

#5  0xb66bd801 in abort () from /lib/libc.so.6
#6  0xb66f7719 in malloc_printerr () from /lib/libc.so.6
#7  0xb66f8d45 in free () from /lib/libc.so.6
#8  0xb68000d1 in g_free (mem=0x2) at gmem.c:187
#9  0xb7ca7c9b in camel_mime_filter_set_size (filter=0x9e534a8, size=3942, 
    keep=0) at camel-mime-filter.c:310
#10 0xb7ca3626 in filter (f=0x9e534a8, 
    in=0xd6987e0 "TCH (FLAGS (\\Seen) UID 982)\r<BR>\nreceived: * 3 FETCH (FLAGS (\\Seen) UID 1015)\r<BR>\nreceived: * 4 FETCH (FLAGS (\\Seen) UID 1064)\r<BR>\nreceived: * 5 FETCH (FLAGS (\\Seen) UID 1080)\r<BR>\nreceived: * 6 FET"..., 
    len=6, prespace=256, out=0xb2248eb0, outlen=0xb2248eb4, 
    outprespace=0xb2248eb8) at camel-mime-filter-crlf.c:100
#11 0xb7ca7d8c in filter_run (f=0x9e534a8, 
    in=0xd6987e0 "TCH (FLAGS (\\Seen) UID 982)\r<BR>\nreceived: * 3 FETCH (FLAGS (\\Seen) UID 1015)\r<BR>\nreceived: * 4 FETCH (FLAGS (\\Seen) UID 1064)\r<BR>\nreceived: * 5 FETCH (FLAGS (\\Seen) UID 1080)\r<BR>\nreceived: * 6 FET"..., 
    len=3942, prespace=256, out=0xb2248eb0, outlen=0xb2248eb4, 
    outprespace=0xb2248eb8, filterfunc=0xb7ca3520 <filter>)
    at camel-mime-filter.c:189
#12 0xb7cbf5f6 in do_write (stream=0x9e51250, 
    buf=0xb2249f0c "�\017ͷP\225�\b����8\237$�&�ɷ([i\rP\022�\t�\216˷�\017ͷ8,�\bP\225�\bX\237$� �ɷP\225�\bP\022�\t 4�\t�\017ͷ�4�\tP\022�\tx\237$�R�ɷP\225�\bP\022�\t}\234̷�\017ͷ8,�\bP\225�\b\230\237$�`�ɷP\225�\b", n=4096)
    at camel-stream-filter.c:313
#13 0xb7cc11f6 in camel_stream_write (stream=0x9e51250, 
    buffer=0xb2248f0c "TCH (FLAGS (\\Seen) UID 982)=0D<BR>\nreceived: * 3 FETCH (FLAGS (\\Seen) UID 1015)=0D<BR>\nreceived: * 4 FETCH (FLAGS (\\Seen) UID 1064)=0D<BR>\nreceived: * 5 FETCH (FLAGS (\\Seen) UID 1080)=0D<BR>\nreceived:"..., 
    n=4096) at camel-stream.c:119
#14 0xb7cc14bb in camel_stream_write_to_stream (stream=0xd695b28, 
    output_stream=0x9e51250) at camel-stream.c:273
#15 0xb7c9c726 in write_to_stream (data_wrapper=0x8c49550, stream=0x9e51250)
    at camel-data-wrapper.c:147
#16 0xb7c9c320 in camel_data_wrapper_write_to_stream (data_wrapper=0x8c49550, 
    stream=0x9e51250) at camel-data-wrapper.c:175
#17 0xb7c9c652 in decode_to_stream (data_wrapper=0x8c49550, stream=0xd698400)
    at camel-data-wrapper.c:215
#18 0xb7c9c260 in camel_data_wrapper_decode_to_stream (data_wrapper=0x8c49550, 
    stream=0xd698400) at camel-data-wrapper.c:240
#19 0xb7d466e7 in match_words_1message (object=0x8c49550, words=0xd623f50, 
---Type <return> to continue, or q <return> to quit---
    mask=0xb224a048) at camel-folder-search.c:1097
#20 0xb7d467e9 in match_words_1message (object=<value optimized out>, 
    words=0xd623f50, mask=0xb224a048) at camel-folder-search.c:1087
#21 0xb7d46876 in match_words_message (folder=<value optimized out>, 
    uid=<value optimized out>, words=0xd623f50, ex=0x0)
    at camel-folder-search.c:1126
#22 0xb7d46d83 in search_body_contains (f=0xd6021f0, argc=1, argv=0xb224a0e0, 
    search=0xd158cd0) at camel-folder-search.c:1165
#23 0xb79b205e in e_sexp_term_eval (f=0xd6021f0, t=0xd623ef0) at e-sexp.c:710
#24 0xb79b2de7 in term_eval_and (f=0xd6021f0, argc=2, argv=0xd6029f0, 
    data=0xb7a577a0) at e-sexp.c:255
#25 0xb79b20a6 in e_sexp_term_eval (f=0xd6021f0, t=0xd623e00) at e-sexp.c:700
#26 0xb79b2120 in e_sexp_eval (f=0xd6021f0) at e-sexp.c:1304
#27 0xb7d45177 in camel_folder_search_search (search=0xd158cd0, 
    expr=0x8216fc8 " (and\n  \n\t(body-contains  \"flow\")\n     \n  \n\t(body-contains  \"vfs\")\n     \n  )\n", uids=0x0, ex=0x0)
    at camel-folder-search.c:486
#28 0xb449d589 in local_search_by_expression (folder=0xd160498, 
    expression=0x8216fc8 " (and\n  \n\t(body-contains  \"flow\")\n     \n  \n\t(body-contains  \"vfs\")\n     \n  )\n", ex=0x0) at camel-local-folder.c:571
#29 0xb7d4f1ba in camel_folder_search_by_expression (folder=0xd160498, 
    expression=0x8216fc8 " (and\n  \n\t(body-contains  \"flow\")\n     \n  \n\t(body-contains  \"vfs\")\n     \n  )\n", ex=0x0) at camel-folder.c:1269
#30 0xb7d6d7ae in vee_rebuild_folder (vf=0x81e8340, source=0xd160498, ex=0x0)
    at camel-vee-folder.c:911
#31 0xb7d6d850 in vee_add_folder (vf=0x81e8340, sub=0xd160498)
    at camel-vee-folder.c:1601
#32 0xb7d6bcb5 in camel_vee_folder_add_folder (vf=0x81e8340, sub=0xd160498)
    at camel-vee-folder.c:223
#33 0xb458e21c in vfolder_adduri_do (mm=0x8603f10) at mail-vfolder.c:280
#34 0xb45817a5 in mail_msg_received (e=0x81851a8, msg=0x8603f10, data=0x0)
    at mail-mt.c:570
#35 0xb79af744 in thread_dispatch (din=0x81851a8) at e-msgport.c:987
#36 0xb690f112 in start_thread () from /lib/libpthread.so.0
#37 0xb675230e in clone () from /lib/libc.so.6

The other threads are doing nothing in particular, or do not show useful debug info. The main thread is in GLib's poll().

Evolution RPM version: evolution-2.8.1-12

Last changelog message:
* Mon Oct 02 2006 - jhargadon@suse.de
- update to version 2.8.1
- translation updates
-  many bug fixes
Comment 1 Hans Petter Jansson 2006-11-02 01:52:49 UTC
Could be related to this GNOME bug, for which I've filed a patch:

http://bugzilla.gnome.org/show_bug.cgi?id=369168
Comment 2 Harish Krishnaswamy 2006-11-02 06:30:55 UTC
Agree with Hans on comment #1. The patch has been committed upstream. I will submit this patch to autobuild as well.
Comment 3 Hans Petter Jansson 2006-11-02 16:43:25 UTC
It would be nice to have the patch for

http://bugzilla.gnome.org/show_bug.cgi?id=369259

in autobuild too.
Comment 4 Harish Krishnaswamy 2006-11-08 05:33:49 UTC
Submitted to autobuild.