RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 906267 - [abrt] Use-after-free in impl_ShellView_setButtonIcon()
Summary: [abrt] Use-after-free in impl_ShellView_setButtonIcon()
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: evolution
Version: 6.4
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Matthew Barnes
QA Contact: Desktop QE
URL:
Whiteboard: abrt_hash:7027d480e9ccee3f3d115057f11...
: 845052 (view as bug list)
Depends On: 883010
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-01-31 10:34 UTC by David Jaša
Modified: 2014-01-02 09:07 UTC (History)
3 users (show)

Fixed In Version: evolution-2.32.3-2.el6
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-11-21 05:10:03 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
File: maps (88.82 KB, text/plain)
2013-01-31 10:34 UTC, David Jaša 		no flags Details
File: var_log_messages (412 bytes, text/plain)
2013-01-31 10:34 UTC, David Jaša 		no flags Details
File: open_fds (2.26 KB, text/plain)
2013-01-31 10:34 UTC, David Jaša 		no flags Details
File: environ (1.53 KB, text/plain)
2013-01-31 10:34 UTC, David Jaša 		no flags Details
File: dso_list (18.88 KB, text/plain)
2013-01-31 10:34 UTC, David Jaša 		no flags Details
File: limits (1.29 KB, text/plain)
2013-01-31 10:34 UTC, David Jaša 		no flags Details
File: sosreport.tar.xz (1.77 MB, text/plain)
2013-01-31 10:34 UTC, David Jaša 		no flags Details
File: backtrace (63.24 KB, text/plain)
2013-01-31 10:34 UTC, David Jaša 		no flags Details
File: build_ids (8.41 KB, text/plain)
2013-01-31 10:34 UTC, David Jaša 		no flags Details
File: cgroup (88 bytes, text/plain)
2013-01-31 10:34 UTC, David Jaša 		no flags Details
evolution-2.28.3-button-icon-crash.patch (1.22 KB, patch)
2013-02-05 15:53 UTC, Milan Crha 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:1540 0 normal SHIPPED_LIVE Low: evolution security, bug fix, and enhancement update 2013-11-21 00:40:51 UTC

Description David Jaša 2013-01-31 10:34:01 UTC 
Description of problem:
Evolution crashed during "downloading messages for offline use" phase of email synchronization after it was put offline and online again.

Version-Release number of selected component:
evolution-2.28.3-30.el6

Additional info:
libreport version: 2.0.9
abrt_version:   2.0.8
backtrace_rating: 4
cmdline:        evolution -c mail
crash_function: g_type_check_instance_is_a
kernel:         2.6.32-356.el6.x86_64

truncated backtrace:
:Thread no. 1 (8 frames)
: #0 g_type_check_instance_is_a at gtype.c
: #1 e_shell_window_peek_shell at e-shell-window.c
: #2 impl_ShellView_setButtonIcon at e-shell-view.c
: #3 GNOME_Evolution_ShellView_setButtonIcon at Evolution-stubs.c
: #4 e_component_view_set_button_icon at e-component-view.c
: #5 emfv_list_done_message_selected at em-folder-view.c
: #6 mail_msg_idle_cb at mail-mt.c
: #11 bonobo_main at bonobo-main.c
Comment 1 David Jaša 2013-01-31 10:34:05 UTC 
Created attachment 690831 [details]
File: maps
Comment 2 David Jaša 2013-01-31 10:34:07 UTC 
Created attachment 690832 [details]
File: var_log_messages
Comment 3 David Jaša 2013-01-31 10:34:09 UTC 
Created attachment 690833 [details]
File: open_fds
Comment 4 David Jaša 2013-01-31 10:34:11 UTC 
Created attachment 690834 [details]
File: environ
Comment 5 David Jaša 2013-01-31 10:34:14 UTC 
Created attachment 690835 [details]
File: dso_list
Comment 6 David Jaša 2013-01-31 10:34:16 UTC 
Created attachment 690836 [details]
File: limits
Comment 7 David Jaša 2013-01-31 10:34:26 UTC 
Created attachment 690837 [details]
File: sosreport.tar.xz
Comment 8 David Jaša 2013-01-31 10:34:29 UTC 
Created attachment 690838 [details]
File: backtrace
Comment 9 David Jaša 2013-01-31 10:34:31 UTC 
Created attachment 690839 [details]
File: build_ids
Comment 10 David Jaša 2013-01-31 10:34:33 UTC 
Created attachment 690840 [details]
File: cgroup
Comment 12 Milan Crha 2013-02-01 07:49:20 UTC 
This [1] is an upstream bugzilla with basically the same backtrace, but it is was not resolved.

Are you able to reproduce this consistently? I do not know, maybe you had opened a new mail window (File->New Window), then you closed it and then switched online/offline?

[1] https://bugzilla.gnome.org/show_bug.cgi?id=585104
Comment 13 David Jaša 2013-02-01 09:43:00 UTC 
(In reply to comment #12)
> This [1] is an upstream bugzilla with basically the same backtrace, but it
> is was not resolved.
> 
> Are you able to reproduce this consistently? I do not know, maybe you had
> opened a new mail window (File->New Window), then you closed it and then
> switched online/offline?
> 
> [1] https://bugzilla.gnome.org/show_bug.cgi?id=585104

Yes, when I tried the same now, evo crashed few minutes after it went online (the process was apparently finished this time because I synced my mail short time ago).
Comment 14 RHEL Program Management 2013-02-05 06:48:12 UTC 
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 15 Milan Crha 2013-02-05 15:53:43 UTC 
Created attachment 693456 [details]
evolution-2.28.3-button-icon-crash.patch

for evolution;

Patch to fix the problem. With respect of reproducer:
a) run evolution in mail (evolution -c mail)
b) choose menu File->New Window
c) close the new window
d) change folder in the left folder tree

it either crashes, or prints a runtime warning about e_shell_window_peek_shell(), or just run it under valgrind (valgrind evolution) and see an invalid meory read in impl_ShellView_setButtonIcon()/e_shell_window_peek_shell().
Comment 18 Milan Crha 2013-05-09 18:50:51 UTC 
*** Bug 845052 has been marked as a duplicate of this bug. ***
Comment 19 Milan Crha 2013-05-09 18:53:58 UTC 
The patch might be obsolete, if the rebase bug will make it in, thus I make this depend on it.
Comment 27 errata-xmlrpc 2013-11-21 05:10:03 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-1540.html
Note You need to log in before you can comment on or make changes to this bug.