Bug 509582

Description of problem:

Thunderbird on Fedora 11 crashes with a segfault when pasting code on the text pane while writing a mail, both with the middle mouse button or from the clipboard using standard menu copy and paste. The crash doesn't occur reliably, but it's easy to reproduce. The system is a 64 bit install, but I've not tested with a 32 bit one (nor with a 32 bit package). Also, the crash I've experienced only happens in the text area, not for example in the "subject" text field or in the various "to", "cc" etc text fields. Finally, I've only tried on the Gnome destktop.

Version-Release number of selected component (if applicable):

thunderbird-3.0-2.3.beta2.fc11.x86_64

How reproducible:

Cut and paste code from other applications.

Steps to Reproduce:
1. Write a new mail
2. Copy some text from another applicaiton, i.e. gedit
3. paste the text on the text pane in the mail window.
  
Actual results:

Text is pasted

Expected results:

Segfault.

Additional info:

The bug seems to be related to a call to strcmp with the first argument passed as NULL. I'm not sure if strcmp should survive a NULL argument, but I did some simple test on linux and I can indeed pass a NULL argument happily, but of course this doesn't prove much as the test were too simple. I say this because it may hide a glibc bug but honestly I didn't really checked deep enough.

The code that fails is this in

thunderbird-3.0/mozilla/widget/src/gtk2/nsClipboard.cpp:

for (PRInt32 j = 0; j < n_targets; j++) {
   gchar *atom_name = gdk_atom_name(targets[j]);
   if (!strcmp(atom_name, aFlavorList[i]))
     *_retval = PR_TRUE;

   // X clipboard wants image/jpeg, not image/jpg
   if (!strcmp(aFlavorList[i], kJPEGImageMime) &
      ...

(line 449)

where the NULL argument is atom_name returned by gdk_atom_name.

Attached is a patch bypass this problem, but there are other places where a NULL argument may be passed to strcmp in the same file.