+++ This bug was initially created as a clone of Bug #218755 +++ Description of problem: evolution crashes on the spam mail I'll attach as mbox; the crash may well turn out to be a security issue in itself. But just crashing is serious since the next time evo opens it immediately goes back to the same mail and crashes again, so a non-expert user cannot recover from this. I suspect RHEL5 is affected too -- Additional comment from arjan.com on 2006-12-07 06:07 EST -- Created an attachment (id=143043) mbox with the crashing mail -- Additional comment from lkundrak on 2006-12-08 10:08 EST -- The file "navigable.gif" is incorrectly encoded. I think evolution should not feed underlying gdk with the corrupted data, but I doubt an assertion failure there is the right way to handle the faulty gif. When you extract the file (with reformime or evolution) and either try to view it with firefox or gqview or embed it in another email message and open in evolution it is correctly reported as being broken. Moreover there's some interesting stuff in the broken base64 data: for example the IN-SB-8XX-PLATFORMS string encoded there. How could it happen to came there? Maybe this message was meant to exploit some windows software or encoded by a horribly broken software? I got no smarter after disassembling the 8bit parts of the part. -- Additional comment from lkundrak on 2006-12-08 10:18 EST -- Created an attachment (id=143153) Backtrace from FC6 evolution-2.8.2.1-2.fc6 gtk2-2.10.4-6.fc6 -- Additional comment from mclasen on 2006-12-08 11:10 EST -- Looks like memory corruption to me. I don't see how that assert can trigger, unless something scribbles over the pixbuf, since all pixbuf_new calls in the gif loader create pixbufs with alpha. -- Additional comment from mclasen on 2006-12-09 23:12 EST -- I found that gtkhtml ignores the return value of gdk_pixbuf_loader_write() and just continues throwing invalid data at the loader. Admittedly, the GdkPixbufLoader documentation makes it sound as if that was ok, since it says that the loader is closed if write() returns FALSE. This is not actually the case right now. I'll attach a patch which changes gdk-pixbuf to behave as documented. This fixes the bug. -- Additional comment from mclasen on 2006-12-09 23:12 EST -- Created an attachment (id=143235) close-loader.patch
*** Bug 218931 has been marked as a duplicate of this bug. ***
Fix is in gtk2-2.10.4-10.el5
Pls ignore comment #4 Tested in gtk2-2.10.4-8.el5, imported mbox with the crashing mail to evolution, try to open it, crash happened. Verified in gtk2-2.10.4-10.el5, no crash, so will resolve it when the package is in the tree.
Verified gtk2-2.10.4-10.el5 has been included in RHEL5-Client-20061213.nightly, so resolve this bug.