<<< Date Index >>>     <<< Thread Index >>>

Re: mutt_free_header -> free -> mutt_sort_headers -> segfault



ok, should be easy to reproduce.
seems like you have to enable thread sorting and
have  return-path: <>

$ cd /tmp

$ muttrc
set delete=yes
mailboxes "/tmp/mutttest"
set sort=threads

$ maildirmake mutttest

$ gdb /usr/local/src/mutt/mutt
(gdb) efe
(gdb) run -F /tmp/muttrc -f /tmp/mutttest

( commands starting with $ executed in another shell )

$ printf 'return-path: <>\nsubject: barbar\nmessage-id: <001@invalid>\n' |
safecat mutttest/tmp mutttest/new

[tab] [enter] [q] [d] [$]

$ printf 'return-path: <>\nsubject: barbar\nmessage-id: <002@invalid>\n' |
safecat mutttest/tmp mutttest/new

[tab] [enter] [q] [d] [$]

$ printf 'return-path: <>\nsubject: barbar\nmessage-id: <003@invalid>\n' |
safecat mutttest/tmp mutttest/new

[tab] [crash'n'burn]

Sorting mailbox...                                                              
               
(gdb) print *ctx
$1 = {path = 0x41202ff0 "/tmp/mutttest", fp = 0x0, mtime = 1067963800, 
  mtime_cur = 1067962089, size = 58, vsize = 0, pattern = 0x0, limit_pattern = 
0x0, 
  hdrs = 0x4129af9c, tree = 0x0, id_hash = 0x0, subj_hash = 0x412a9ff8, 
  thread_hash = 0x412a1ff8, v2r = 0x4129df9c, hdrmax = 25, msgcount = 1, vcount 
= 1, 
  tagged = 0, new = 1, unread = 1, deleted = 0, flagged = 0, msgnotreadyet = 
-1, data = 0x0, 
  magic = 4, locked = 0, changed = 0, readonly = 0, dontwrite = 0, append = 0, 
quiet = 0, 
  collapsed = 0, closing = 0}
(gdb) print *cur
$2 = {security = 0, mime = 0, flagged = 0, tagged = 0, deleted = 0, changed = 
0, 
  attach_del = 0, old = 0, read = 0, expired = 0, superseded = 0, replied = 0, 
  subject_changed = 0, threaded = 0, display_subject = 0, recip_valid = 0, 
active = 0, 
  trash = 0, zhours = 0, zminutes = 0, zoccident = 0, searched = 0, matched = 
0, 
  collapsed = 0, limited = 0, num_hidden = 0, recipient = 0, pair = 0, 
date_sent = 0, 
  received = 0, offset = 0, lines = 0, index = 0, msgno = 0, virtual = 0, score 
= 0, 
  env = 0x41429fbc, content = 0x4142dfbc, 
  path = 0x4141afd0 "new/1067963810.8072859724.safari.finland.fbi", tree = 0x0, 
thread = 0x0, 
  chain = 0x0, refno = 0, data = 0x0, maildir_flags = 0x0}
(gdb) print *cur->env
$3 = {return_path = 0x41431ff0, from = 0x0, to = 0x0, cc = 0x0, bcc = 0x0, 
sender = 0x0, 
  reply_to = 0x0, mail_followup_to = 0x0, subject = 0x4143bff8 "barbar", 
  real_subj = 0x4143bff8 "barbar", message_id = 0x41437ff0 "<003@invalid>", 
supersedes = 0x0, 
  date = 0x0, x_label = 0x0, references = 0x0, in_reply_to = 0x0, userhdrs = 
0x0}


OR another way to crash, with different subjects

$ printf 'return-path: <>\nsubject: barbar001\nmessage-id: <000@invalid>\n' |
safecat mutttest/tmp mutttest/new

[tab] [enter] [q] [d] [$]

$ printf 'return-path: <>\nsubject: barbar002\nmessage-id: <001@invalid>\n' |
safecat mutttest/tmp mutttest/new

[tab] [enter] [q] [d] [$]

$ printf 'return-path: <>\nsubject: barbar003\nmessage-id: <002@invalid>\n' |
safecat mutttest/tmp mutttest/new

[tab] [enter] [q] [d] [$]

$ printf 'return-path: <>\nsubject: barbar004\nmessage-id: <003@invalid>\n' |
safecat mutttest/tmp mutttest/new

[tab] [crash'n'burn]
 

---Mutt: /tmp/mutttest 
[Msgs:0]---(threads/date)---------------------------------------(all)---
Sorting mailbox...                                                              
               
Program received signal SIGSEGV, Segmentation fault.
0x080b38db in mutt_sort_subthreads (thread=0x0, init=0) at thread.c:597
597         if (init || !thread->sort_key)
(gdb) bt
#0  0x080b38db in mutt_sort_subthreads (thread=0x0, init=0) at thread.c:597
#1  0x080b43f9 in mutt_sort_threads (ctx=0x8152f38, init=0) at thread.c:950
#2  0x080b12e2 in mutt_sort_headers (ctx=0x8152f38, init=0) at sort.c:234
#3  0x0806319c in update_index (menu=0x8154b10, ctx=0x8152f38, check=1, 
oldcount=0, 
    index_hint=0) at curs_main.c:313
#4  0x080637f7 in mutt_index_menu () at curs_main.c:488
#5  0x080802c1 in main (argc=5, argv=0xbfffea84) at main.c:907
#6  0x40213907 in __libc_start_main () from /lib/libc.so.6
(gdb) frame 3
#3  0x0806319c in update_index (menu=0x8154b10, ctx=0x8152f38, check=1, 
oldcount=0, 
    index_hint=0) at curs_main.c:313
313       mutt_sort_headers (Context, (check == M_REOPENED));
(gdb) print *ctx
$1 = {path = 0x8154a90 "/tmp/mutttest", fp = 0x0, mtime = 1067964007, mtime_cur 
= 1067962089, 
  size = 61, vsize = 0, pattern = 0x0, limit_pattern = 0x0, hdrs = 0x8155c40, 
tree = 0x0, 
  id_hash = 0x0, subj_hash = 0x8155b20, thread_hash = 0x8155af0, v2r = 
0x8155a88, 
  hdrmax = 25, msgcount = 1, vcount = 1, tagged = 0, new = 1, unread = 1, 
deleted = 0, 
  flagged = 0, msgnotreadyet = -1, data = 0x0, magic = 4, locked = 0, changed = 
0, 
  readonly = 0, dontwrite = 0, append = 0, quiet = 0, collapsed = 0, closing = 
0}
(gdb)