Bug 712745

Description of problem:
The library Camel crashes when filtering an outgoing email. This filter aims to copy the email that is being sent to a directory called 'Sent'.

Version-Release number of selected component (if applicable):
I see this behavior since I use Fedora 15.

How reproducible:
Always.

Steps to Reproduce:
0. Use an IMAP account. I use the IMAPx backend (is it related with the bug?)
1. Set a filter for outgoing emails. This filter looks at the email address being used to send an email. If the sender is foo then this email will be copied to the IMAP folder called 'Sent'.
2. Send an email (that should be automatically copied in 'Sent')
  
Actual results:
Crash.

Expected results:
No crash and the sent email copied in 'Sent'.

Additional info:

I do not understand why but ABRT does not detect the crash. I so installed debug-infos packages and ran GDB. See comments in the backtrace!



(gdb) run
Starting program: /usr/bin/evolution 
[Thread debugging using libthread_db enabled]
Gtk-Message: Failed to load module "pk-gtk-module"

///---> What's that? I see this message in many applications.

[New Thread 0x7ffff0ec9700 (LWP 7773)]

///---> Many threads are started...


** (evolution:7769): CRITICAL **: categories_icon_theme_hack: assertion `filename != NULL && *filename != '\0'' failed

///---> What's that? 

[New Thread 0x7fffe1fa8700 (LWP 7774)]
[New Thread 0x7fffe17a7700 (LWP 7775)]

///---> Again many threads are started...
///--->
///---> I send an email!

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffc4faf700 (LWP 12680)]
0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00000037bf623ca4 in open_folder (driver=0x21aa9d0 [CamelFilterDriver], folder_url=0x7fffcc0097b0 "email://1301867700.3980.21@shaka/INBOX/Sent") at camel-filter-driver.c:1019
#2  0x00000037bf623d14 in do_move (f=<optimized out>, argc=1, argv=0x7fffc4fae940, driver=0x21aa9d0 [CamelFilterDriver]) at camel-filter-driver.c:531
#3  0x00000037bee131a1 in e_sexp_term_eval (f=0x26a9900, t=0x7fffcc009d20) at e-sexp.c:731
#4  0x00000037bee13320 in term_eval_begin (f=0x26a9900, argc=<optimized out>, argv=0x7fffcc00ada0, data=<optimized out>) at e-sexp.c:676
#5  0x00000037bee1327f in e_sexp_term_eval (f=0x26a9900, t=0x7fffcc009b40) at e-sexp.c:721
#6  0x00000037bee1420e in e_sexp_eval (f=0x26a9900) at e-sexp.c:1568
#7  0x00000037bf6256f5 in camel_filter_driver_filter_message (driver=0x21aa9d0 [CamelFilterDriver], message=<optimized out>, info=0x7fffc808cb40, uid=0x0, source=0x0, source_url=
    0x0, original_source_url=0x334bca24d9 "", cancellable=0x1ea7e60 [CamelOperation], error=0x7fffc4faeb28) at camel-filter-driver.c:1602
#8  0x000000334bc51aa7 in mail_session_send_to_thread (simple=0x2076240 [GSimpleAsyncResult], session=0x70f1a0 [EMailSession], cancellable=0x1ea7e60 [CamelOperation])
    at e-mail-session-utils.c:480
#9  0x00000037ae664b8c in run_in_thread (job=<optimized out>, c=0x1ea7e60 [CamelOperation], _data=0x26a8b00) at gsimpleasyncresult.c:838
#10 0x00000037ae656566 in io_job_thread (data=0x26a8300, user_data=<optimized out>) at gioscheduler.c:181
#11 0x00000037a966aa50 in g_thread_pool_thread_proxy (data=<optimized out>) at gthreadpool.c:319
#12 0x00000037a96683a6 in g_thread_create_proxy (data=0x15c4680) at gthread.c:1955
#13 0x00000037a8207af1 in start_thread (arg=0x7fffc4faf700) at pthread_create.c:305
#14 0x00000037a7adfc2d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
(gdb) frame 1
#1  0x00000037bf623ca4 in open_folder (driver=0x21aa9d0 [CamelFilterDriver], folder_url=0x7fffcc0097b0 "email://1301867700.3980.21@shaka/INBOX/Sent") at camel-filter-driver.c:1019
1019			camelfolder = p->get_folder (driver, folder_url, p->data, &p->error);
(gdb) list
1014		   in duplicate mails, just mail going to inbox.  Otherwise,
1015		   we want to know about exceptions and abort processing */
1016		if (p->defaultfolder) {
1017			camelfolder = p->get_folder (driver, folder_url, p->data, NULL);
1018		} else {
1019			camelfolder = p->get_folder (driver, folder_url, p->data, &p->error);
1020		}
1021	
1022		if (camelfolder) {
1023			g_hash_table_insert (p->folders, g_strdup (folder_url), camelfolder);
(gdb) print driver
$1 = 0x21aa9d0 [CamelFilterDriver]
(gdb) print folder_url
$2 = (const gchar *) 0x7fffcc0097b0 "email://1301867700.3980.21@shaka/INBOX/Sent"
(gdb) print p
$3 = (CamelFilterDriverPrivate *) 0x21aaa10
(gdb) print p->data
$4 = (gpointer) 0x0
(gdb) print p->error
$5 = (GError *) 0x0
(gdb) frame 0
#0  0x0000000000000000 in ?? ()
(gdb) list
1024			camel_folder_freeze (camelfolder);
1025		} else {
1026			g_hash_table_insert (p->folders, g_strdup (folder_url), FOLDER_INVALID);
1027		}
1028	
1029		return camelfolder;
1030	}
1031	
1032	static void
1033	close_folder (gpointer key, gpointer value, gpointer data)
(gdb) print camelfolder
No symbol "camelfolder" in current context.
(gdb) frame 1
#1  0x00000037bf623ca4 in open_folder (driver=0x21aa9d0 [CamelFilterDriver], folder_url=0x7fffcc0097b0 "email://1301867700.3980.21@shaka/INBOX/Sent") at camel-filter-driver.c:1019
1019			camelfolder = p->get_folder (driver, folder_url, p->data, &p->error);
(gdb) print camelfolder
$6 = 0x0
(gdb) print p
$7 = (CamelFilterDriverPrivate *) 0x21aaa10
(gdb) print *p
$8 = {globals = 0x212ea80, session = 0x70f1a0 [EMailSession], defaultfolder = 0x0, statusfunc = 0, statusdata = 0x0, shellfunc = 0x334bc8e850 <mail_execute_shell_command>, 
  shelldata = 0x0, playfunc = 0x334bc4e430 <session_play_sound>, playdata = 0x0, beep = 0x334bc4e420 <session_system_beep>, beepdata = 0x0, get_folder = 0, data = 0x0, folders = 
    0x212ead0, closed = 0, only_once = 0x212eb20, terminated = 0, deleted = 0, copied = 0, moved = 0, message = 0x1fb8ab0 [CamelMimeMessage], info = 0x7fffc808cb40, uid = 0x0, 
  source = 0x0, modified = 0, logfile = 0x0, rules = {head = 0x2617200, tail = 0x0, tailpred = 0x2617200}, error = 0x0, eval = 0x26a9900}
(gdb) print p->get_folder
$9 = (CamelFilterGetFolderFunc) 0
(gdb) 


Funny, the code tries to call a function (get_folder) through a null pointer (p).