Bug 4467 - Crash when unloading RSSyl plugin
Summary: Crash when unloading RSSyl plugin
Status: RESOLVED FIXED
Alias: None
Product: Claws Mail (Windows)
Classification: Unclassified
Component: default (show other bugs)
Version: 3.17.8
Hardware: PC Windows 10
: P3 normal
Assignee: Jonathan Boeing
URL:
Depends on:
Blocks:
 
Reported: 2021-04-06 03:12 UTC by Jonathan Boeing
Modified: 2021-09-12 11:18 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Jonathan Boeing 2021-04-06 03:12:35 UTC 
Claws crashes with heap corruption or an access violation when unloading the RSSyl plugin, depending on the configuration.

rssyl_destroy_folder() calls folder_local_destroy_folder() on the Folder* parameter, which doesn't appear to be a LocalFolder.

With appverifier enabled, the Folder is allocated at the end of a page with an unmapped page immediately following.  Casting it to a LocalFolder and accessing rootpath crosses into the unmapped page.

The crash happens in folder_local_folder_destroy() either when trying to access the rootpath member, or shortly afterwards when freeing it.  

Backtrace:
 # Call Site
00 claws_mail!folder_local_folder_destroy+0x45 [..\..\claws-mail-3.17.8\src\localfolder.c @ 38] 
01 rssyl!rssyl_destroy_folder+0x15 [..\..\..\..\claws-mail-3.17.8\src\plugins\rssyl\rssyl.c @ 263] 
02 claws_mail!folder_destroy+0xa2 [..\..\claws-mail-3.17.8\src\folder.c @ 279] 
03 claws_mail!folder_unregister_class+0xc7 [..\..\claws-mail-3.17.8\src\folder.c @ 165] 
04 rssyl!rssyl_done+0x4d [..\..\..\..\claws-mail-3.17.8\src\plugins\rssyl\rssyl.c @ 177] 
05 rssyl!plugin_done+0xd [..\..\..\..\claws-mail-3.17.8\src\plugins\rssyl\plugin.c @ 55] 
06 claws_mail!plugin_unload+0x74 [..\..\..\claws-mail-3.17.8\src\common\plugin.c @ 547] 
07 claws_mail!unload_cb+0x68 [..\..\..\claws-mail-3.17.8\src\gtk\pluginwindow.c @ 190] 
08 libgobject_2_0_0!g_closure_invoke+0x183
09 libgobject_2_0_0!g_signal_handler_disconnect+0x11d5
0a libgobject_2_0_0!g_signal_emit_valist+0x94d
0b libgobject_2_0_0!g_signal_emit+0x18
0c libgtk_win32_2_0_0!gtk_button_clicked+0x205
0d libgobject_2_0_0!g_closure_invoke+0x183
0e libgobject_2_0_0!g_signal_handler_disconnect+0x1333
0f libgobject_2_0_0!g_signal_emit_valist+0x94d
10 libgobject_2_0_0!g_signal_emit+0x18
11 libgtk_win32_2_0_0!gtk_button_released+0x89
12 libgtk_win32_2_0_0!gtk_marshal_VOID__UINT_STRING+0x117
13 libgobject_2_0_0!g_closure_invoke+0x183
14 libgobject_2_0_0!g_signal_handler_disconnect+0x93c
15 libgobject_2_0_0!g_signal_emit_valist+0x65f
16 libgobject_2_0_0!g_signal_emit+0x18
17 libgtk_win32_2_0_0!gtk_widget_translate_coordinates+0x4ed
18 libgtk_win32_2_0_0!gtk_propagate_event+0xa1
19 libgtk_win32_2_0_0!gtk_main_do_event+0x2ab
1a libgdk_win32_2_0_0!gdk_win32_drawable_get_handle+0xcda
1b libglib_2_0_0!g_main_context_dispatch+0x253
1c libglib_2_0_0!g_main_context_dispatch+0x458
1d libglib_2_0_0!g_main_loop_run+0x74
1e libgtk_win32_2_0_0!gtk_main+0xa0
1f claws_mail!main+0x151e [..\..\claws-mail-3.17.8\src\main.c @ 1666] 
20 claws_mail!__tmainCRTStartup+0x247 [.\mingw-w64-crt\crt\crtexe.c @ 341] 
21 claws_mail!WinMainCRTStartup+0x1b [.\mingw-w64-crt\crt\crtexe.c @ 197] 
22 KERNEL32!BaseThreadInitThunk+0x14
23 ntdll!RtlUserThreadStart+0x21
Note You need to log in before you can comment on or make changes to this bug.