Error "bad email" effectively crashes 'vm'
blueman
viewed.
Specifically, when I view the email, I get the error message:
Wrong number of arguments: #<subr backtrace>, 1
Once this happens, I am no longer able to do basic functions such as
saving email or even quitting vm (though I can continue to view
emails).
The *Messages* buffers gives the following insight:
Parsing BBDB... (frobnicating...done)
1839 messages, 0 new, 315 unread, 0 deleted
Checking for new mail for /home/kosowsky/mail/Inbox...
1839 messages, 0 new, 315 unread, 0 deleted
Loading vm-undo...done
Mark set
Decoding MIME message...
Decoding quoted-printable...
/usr/bin/qp-decode exited non-zero (code 1)
line 20: something other than line break or hex digits after = in quoted-printable encoding
vm-mime-action-on-all-attachments: Wrong number of arguments: #<subr backtrace>, 1
-------------------------------------------------------------------------
The problem appears to be that the first section of the email is:
Content-type: text/plain; charset="ISO-8859-1"
Content-transfer-encoding: quoted-printable
But in this section there are url's that include an "=" symbol.
For example:
http://fmx.fidelity.com/cgi-bin/fmxRedirect.pl?id=E|KESRLEF
Presumably this "violates" the quoted printable standard.
However, even so, it seems VERY NON-FRIENDLY that this effectively
crashes vm makeing it impossible to even quit and/or save changes to
the Inbox.
Finally, since the sender is a big institution (Fidelity), I assume
that the emails must work fine under Internet Explorer.
This seems to be a VERY DANGEROUS bug in 'vm' since I can effectively
(whether intentionally or not) mess up your 'vm' session just by
sending you such a simply malformed email.
newsspam5...@robf.de
> I received an email that effectively crashes 'vm' whenever it is
> viewed.
> Specifically, when I view the email, I get the error message:
> Wrong number of arguments: #<subr backtrace>, 1
>
> Once this happens, I am no longer able to do basic functions such as
> saving email or even quitting vm (though I can continue to view
> emails).
>
> The *Messages* buffers gives the following insight:
>
> Parsing BBDB... (frobnicating...done)
> 1839 messages, 0 new, 315 unread, 0 deleted
> Checking for new mail for /home/kosowsky/mail/Inbox...
> 1839 messages, 0 new, 315 unread, 0 deleted
> Loading vm-undo...done
> Mark set
> Decoding MIME message...
> Decoding quoted-printable...
> /usr/bin/qp-decode exited non-zero (code 1)
> line 20: something other than line break or hex digits after = in quoted-printable encoding
> vm-mime-action-on-all-attachments: Wrong number of arguments: #<subr backtrace>, 1
Could you send a backtrace on that?
>
> -------------------------------------------------------------------------
>
> The problem appears to be that the first section of the email is:
>
> Content-type: text/plain; charset="ISO-8859-1"
> Content-transfer-encoding: quoted-printable
>
> But in this section there are url's that include an "=" symbol.
> For example:
>
> http://fmx.fidelity.com/cgi-bin/fmxRedirect.pl?id=E|KESRLEF
>
> Presumably this "violates" the quoted printable standard.
>
> However, even so, it seems VERY NON-FRIENDLY that this effectively
> crashes vm makeing it impossible to even quit and/or save changes to
> the Inbox.
>
> Finally, since the sender is a big institution (Fidelity), I assume
> that the emails must work fine under Internet Explorer.
>
> This seems to be a VERY DANGEROUS bug in 'vm' since I can effectively
> (whether intentionally or not) mess up your 'vm' session just by
> sending you such a simply malformed email.
Does it work with this patch to qp-decode?
Robert.
blueman
> blueman <NOS...@nospam.com> writes:
> > I received an email that effectively crashes 'vm' whenever it is
> > viewed.
> > Specifically, when I view the email, I get the error message:
> > Wrong number of arguments: #<subr backtrace>, 1
> >
> > Once this happens, I am no longer able to do basic functions such as
> > saving email or even quitting vm (though I can continue to view
> > emails).
> >
> > The *Messages* buffers gives the following insight:
> >
> > Parsing BBDB... (frobnicating...done)
> > 1839 messages, 0 new, 315 unread, 0 deleted
> > Checking for new mail for /home/kosowsky/mail/Inbox...
> > 1839 messages, 0 new, 315 unread, 0 deleted
> > Loading vm-undo...done
> > Mark set
> > Decoding MIME message...
> > Decoding quoted-printable...
> > /usr/bin/qp-decode exited non-zero (code 1)
> > line 20: something other than line break or hex digits after = in quoted-printable encoding
>
>
>
> > vm-mime-action-on-all-attachments: Wrong number of arguments: #<subr backtrace>, 1
>
> Could you send a backtrace on that?
initially displays perfectly fine though it does print the error
message to the modeline about something other than a line break or hex
digits appearing after the equals sign -- the error and the subsequent
inability to delete or save buffers only occurs when I try to delete the email
Here is the backtrace of the error generated when I try to delete the file:
Debugger entered--Lisp error: (wrong-number-of-arguments #<subr backtrace> 1)
backtrace(#<buffer *backtrace*>)
vm-mime-action-on-all-attachments(nil #[(msg layout type file) " Tþÿ
blueman
So here is a rewrite of it...
newsspam5...@robf.de writes:
> blueman <NOS...@nospam.com> writes:
> > I received an email that effectively crashes 'vm' whenever it is
> > viewed.
> > Specifically, when I view the email, I get the error message:
> > Wrong number of arguments: #<subr backtrace>, 1
> >
> > Once this happens, I am no longer able to do basic functions such as
> > saving email or even quitting vm (though I can continue to view
> > emails).
> >
> > The *Messages* buffers gives the following insight:
> >
> > Parsing BBDB... (frobnicating...done)
> > 1839 messages, 0 new, 315 unread, 0 deleted
> > Checking for new mail for /home/kosowsky/mail/Inbox...
> > 1839 messages, 0 new, 315 unread, 0 deleted
> > Loading vm-undo...done
> > Mark set
> > Decoding MIME message...
> > Decoding quoted-printable...
> > /usr/bin/qp-decode exited non-zero (code 1)
> > line 20: something other than line break or hex digits after = in quoted-printable encoding
>
>
>
> > vm-mime-action-on-all-attachments: Wrong number of arguments: #<subr backtrace>, 1
>
> Could you send a backtrace on that?
One thing I hadn't realized before, is that the "corrupt" email
initially displays perfectly fine though it does print the error
message to the modeline about something other than a line break or hex
digits appearing after the equals sign -- the error and the subsequent
inability to delete or save buffers only occurs when I try to delete the email:
Here is the backtrace of the error generated when I try to delete the
file:
Debugger entered--Lisp error: (wrong-number-of-arguments #<subr backtrace> 1)
backtrace(#<buffer *backtrace*>)
vm-mime-action-on-all-attachments(nil #[(msg layout type file) "^HT\211^P\207" [attachments] 2] nil nil ([[#<marker at 13579 in mailfolder> #<marker at 13635 in mailfolder> #<marker at 16512 in mailfolder> #<marker at 16755 in mailfolder> #<marker at 26451 in mailfolder> #<marker at 26452 in mailfolder>] ["2" " 2" nil #<marker at 64 in mailfolder Summary> #<marker at 173 in mailfolder Summary> <<>> <-- nil "1" #<buffer mailfolder> nil nil nil nil nil nil "line 20: something other than line break or hex digits after = in quoted-printable encoding\n" none #<overlay from 64 to 173 in mailfolder Summary> nil] [nil nil t t nil nil nil t nil] [nil "Thursday" "4" "January" "2007" "10:16:17" "-0500" "Whatever" "some...@something.com" nil nil "Something (email reference: 16239271)." "^From:" nil nil "1" nil nil nil nil nil nil nil nil nil nil] [nil <v> nil nil nil t]]) t)
vm-summary-function-A([[#<marker at 13579 in mailfolder> #<marker at 13635 in mailfolder> #<marker at 16512 in mailfolder> #<marker at 16755 in mailfolder> #<marker at 26451 in mailfolder> #<marker at 26452 in mailfolder>] ["2" " 2" nil #<marker at 64 in mailfolder Summary> #<marker at 173 in mailfolder Summary> <<>> <-- nil "1" #<buffer mailfolder> nil nil nil nil nil nil "line 20: something other than line break or hex digits after = in quoted-printable encoding\n" none #<overlay from 64 to 173 in mailfolder Summary> nil] [nil nil t t nil nil nil t nil] [nil "Thursday" "4" "January" "2007" "10:16:17" "-0500" "Whatever" "some...@something.com" nil nil "Something (email reference: 16239271)." "^From:" nil nil "1" nil nil nil nil nil nil nil nil nil nil] [nil <v> nil nil nil t]])
vm-run-user-summary-function(vm-summary-function-A [[#<marker at 13579 in mailfolder> #<marker at 13635 in mailfolder> #<marker at 16512 in mailfolder> #<marker at 16755 in mailfolder> #<marker at 26451 in mailfolder> #<marker at 26452 in mailfolder>] ["2" " 2" nil #<marker at 64 in mailfolder Summary> #<marker at 173 in mailfolder Summary> <<>> <-- nil "1" #<buffer mailfolder> nil nil nil nil nil nil "line 20: something other than line break or hex digits after = in quoted-printable encoding\n" none #<overlay from 64 to 173 in mailfolder Summary> nil] [nil nil t t nil nil nil t nil] [nil "Thursday" "4" "January" "2007" "10:16:17" "-0500" "Whatever" "some...@something.com" nil nil "Something (email reference: 16239271)." "^From:" nil nil "1" nil nil nil nil nil nil nil nil nil nil] [nil <v> nil nil nil t]])
(vm-decode-mime-encoded-words-in-string (vm-run-user-summary-function (quote vm-summary-function-A) vm-su-message))
(vm-right-justify-string (vm-decode-mime-encoded-words-in-string (vm-run-user-summary-function ... vm-su-message)) 1)
(vm-reencode-mime-encoded-words-in-string (vm-right-justify-string (vm-decode-mime-encoded-words-in-string ...) 1))
(format "%s%s %s %s %s %s %s " (vm-reencode-mime-encoded-words-in-string (vm-right-justify-string ... 1)) (vm-reencode-mime-encoded-words-in-string (vm-decode-mime-encoded-words-in-string ...)) (vm-reencode-mime-encoded-words-in-string (vm-truncate-string ... 17)) (vm-reencode-mime-encoded-words-in-string (vm-truncate-string ... 3)) (vm-reencode-mime-encoded-words-in-string (vm-right-justify-string ... 2)) (vm-reencode-mime-encoded-words-in-string (vm-decode-mime-encoded-words-in-string ...)) (vm-reencode-mime-encoded-words-in-string (vm-truncate-string ... 4)))
(list (quote number) (quote mark) (format "%s%s %s %s %s %s %s " (vm-reencode-mime-encoded-words-in-string ...) (vm-reencode-mime-encoded-words-in-string ...) (vm-reencode-mime-encoded-words-in-string ...) (vm-reencode-mime-encoded-words-in-string ...) (vm-reencode-mime-encoded-words-in-string ...) (vm-reencode-mime-encoded-words-in-string ...) (vm-reencode-mime-encoded-words-in-string ...)) (quote thread-indent) (format "%s\n" (vm-reencode-mime-encoded-words-in-string ...)))
eval((list (quote number) (quote mark) (format "%s%s %s %s %s %s %s " (vm-reencode-mime-encoded-words-in-string ...) (vm-reencode-mime-encoded-words-in-string ...) (vm-reencode-mime-encoded-words-in-string ...) (vm-reencode-mime-encoded-words-in-string ...) (vm-reencode-mime-encoded-words-in-string ...) (vm-reencode-mime-encoded-words-in-string ...) (vm-reencode-mime-encoded-words-in-string ...)) (quote thread-indent) (format "%s\n" (vm-reencode-mime-encoded-words-in-string ...))))
vm-summary-sprintf("%n%*%1UA%a %-17.17F %-3.3m %2d %UY %-4.4US %I%s\n" [[#<marker at 13579 in mailfolder> #<marker at 13635 in mailfolder> #<marker at 16512 in mailfolder> #<marker at 16755 in mailfolder> #<marker at 26451 in mailfolder> #<marker at 26452 in mailfolder>] ["2" " 2" nil #<marker at 64 in mailfolder Summary> #<marker at 173 in mailfolder Summary> <<>> <-- nil "1" #<buffer mailfolder> nil nil nil nil nil nil "line 20: something other than line break or hex digits after = in quoted-printable encoding\n" none #<overlay from 64 to 173 in mailfolder Summary> nil] [nil nil t t nil nil nil t nil] [nil "Thursday" "4" "January" "2007" "10:16:17" "-0500" "Whatever" "some...@something.com" nil nil "Something (email reference: 16239271)." "^From:" nil nil "1" nil nil nil nil nil nil nil nil nil nil] [nil <v> nil nil nil t]] t)
vm-su-summary([[#<marker at 13579 in mailfolder> #<marker at 13635 in mailfolder> #<marker at 16512 in mailfolder> #<marker at 16755 in mailfolder> #<marker at 26451 in mailfolder> #<marker at 26452 in mailfolder>] ["2" " 2" nil #<marker at 64 in mailfolder Summary> #<marker at 173 in mailfolder Summary> <<>> <-- nil "1" #<buffer mailfolder> nil nil nil nil nil nil "line 20: something other than line break or hex digits after = in quoted-printable encoding\n" none #<overlay from 64 to 173 in mailfolder Summary> nil] [nil nil t t nil nil nil t nil] [nil "Thursday" "4" "January" "2007" "10:16:17" "-0500" "Whatever" "some...@something.com" nil nil "Something (email reference: 16239271)." "^From:" nil nil "1" nil nil nil nil nil nil nil nil nil nil] [nil <v> nil nil nil t]])
vm-stuff-attributes([[#<marker at 13579 in mailfolder> #<marker at 13635 in mailfolder> #<marker at 16512 in mailfolder> #<marker at 16755 in mailfolder> #<marker at 26451 in mailfolder> #<marker at 26452 in mailfolder>] ["2" " 2" nil #<marker at 64 in mailfolder Summary> #<marker at 173 in mailfolder Summary> <<>> <-- nil "1" #<buffer mailfolder> nil nil nil nil nil nil "line 20: something other than line break or hex digits after = in quoted-printable encoding\n" none #<overlay from 64 to 173 in mailfolder Summary> nil] [nil nil t t nil nil nil t nil] [nil "Thursday" "4" "January" "2007" "10:16:17" "-0500" "Whatever" "some...@something.com" nil nil "Something (email reference: 16239271)." "^From:" nil nil "1" nil nil nil nil nil nil nil nil nil nil] [nil <v> nil nil nil t]])
vm-stuff-virtual-attributes([[#<marker at 13579 in mailfolder> #<marker at 13635 in mailfolder> #<marker at 16512 in mailfolder> #<marker at 16755 in mailfolder> #<marker at 26451 in mailfolder> #<marker at 26452 in mailfolder>] ["2" " 2" nil #<marker at 64 in mailfolder Summary> #<marker at 173 in mailfolder Summary> <<>> <-- nil "1" #<buffer mailfolder> nil nil nil nil nil nil "line 20: something other than line break or hex digits after = in quoted-printable encoding\n" none #<overlay from 64 to 173 in mailfolder Summary> nil] [nil nil t t nil nil nil t nil] [nil "Thursday" "4" "January" "2007" "10:16:17" "-0500" "Whatever" "some...@something.com" nil nil "Something (email reference: 16239271)." "^From:" nil nil "1" nil nil nil nil nil nil nil nil nil nil] [nil <v> nil nil nil t]])
vm-set-xxxx-flag([[#<marker at 13579 in mailfolder> #<marker at 13635 in mailfolder> #<marker at 16512 in mailfolder> #<marker at 16755 in mailfolder> #<marker at 26451 in mailfolder> #<marker at 26452 in mailfolder>] ["2" " 2" nil #<marker at 64 in mailfolder Summary> #<marker at 173 in mailfolder Summary> <<>> <-- nil "1" #<buffer mailfolder> nil nil nil nil nil nil "line 20: something other than line break or hex digits after = in quoted-printable encoding\n" none #<overlay from 64 to 173 in mailfolder Summary> nil] [nil nil t t nil nil nil t nil] [nil "Thursday" "4" "January" "2007" "10:16:17" "-0500" "Whatever" "some...@something.com" nil nil "Something (email reference: 16239271)." "^From:" nil nil "1" nil nil nil nil nil nil nil nil nil nil] [nil <v> nil nil nil t]] t nil vm-set-deleted-flag 2)
vm-set-deleted-flag([[#<marker at 13579 in mailfolder> #<marker at 13635 in mailfolder> #<marker at 16512 in mailfolder> #<marker at 16755 in mailfolder> #<marker at 26451 in mailfolder> #<marker at 26452 in mailfolder>] ["2" " 2" nil #<marker at 64 in mailfolder Summary> #<marker at 173 in mailfolder Summary> <<>> <-- nil "1" #<buffer mailfolder> nil nil nil nil nil nil "line 20: something other than line break or hex digits after = in quoted-printable encoding\n" none #<overlay from 64 to 173 in mailfolder Summary> nil] [nil nil t t nil nil nil t nil] [nil "Thursday" "4" "January" "2007" "10:16:17" "-0500" "Whatever" "some...@something.com" nil nil "Something (email reference: 16239271)." "^From:" nil nil "1" nil nil nil nil nil nil nil nil nil nil] [nil <v> nil nil nil t]] t)
vm-delete-message(1)
* call-interactively(vm-delete-message)
> >
> > -------------------------------------------------------------------------
> >
> > The problem appears to be that the first section of the email is:
> >
> > Content-type: text/plain; charset="ISO-8859-1"
> > Content-transfer-encoding: quoted-printable
> >
> > But in this section there are url's that include an "=" symbol.
> > For example:
> >
> > http://fmx.fidelity.com/cgi-bin/fmxRedirect.pl?id=E|KESRLEF
> >
> > Presumably this "violates" the quoted printable standard.
> >
> > However, even so, it seems VERY NON-FRIENDLY that this effectively
> > crashes vm makeing it impossible to even quit and/or save changes to
> > the Inbox.
> >
> > Finally, since the sender is a big institution (Fidelity), I assume
> > that the emails must work fine under Internet Explorer.
> >
> > This seems to be a VERY DANGEROUS bug in 'vm' since I can effectively
> > (whether intentionally or not) mess up your 'vm' session just by
> > sending you such a simply malformed email.
>
> Does it work with this patch to qp-decode?
>
> Robert.
>
>
> === modified file 'qp-decode.c'
> --- qp-decode.c 2005-11-11 01:37:00 +0000
> +++ qp-decode.c 2007-01-04 23:40:46 +0000
> @@ -88,8 +88,8 @@
> for (stop++; *stop && (*stop == ' ' || *stop == '\t'); stop++)
> ;
> } else {
> - fprintf(stderr, "line %d: something other than line break or hex digits after = in quoted-printable encoding\n", lineno);
> - exit(1);
> + printf("\nline %d: something other than line break or hex digits after = in quoted-printable encoding\n", lineno);
> +/* exit(1); */
> }
> start = stop;
> goto keep_processing;
The patch above doesn't work for two reasons (which I am sure you
realized since the version you sent me by private email does work):
- The printf statement ends up getting printed to the email
presentation buffer itself
- The 'illegal' but still desired content after the '=' is
skipped and not written to the presentation buffer.
The version you sent me works, but I would suggest the following
revised patch that does the following:
- Still prints an error message to 'stderr' (as in the
original version). This doesn't cause any problems to 'vm'
but may be useful if another program decides to call
'qp-decode' or if you use the decoder directly on
qp-encoded text.
- Also prints the string that is the cause of the error (as
you do in your patch above).
Here is the revised patch:
--- qp-decode.c.orig 2007-01-06 19:02:22.000000000 -0500
+++ qp-decode.c 2007-01-06 19:17:35.000000000 -0500
@@ -2,6 +2,7 @@
/* Quoted Printable on stdin -> converted data on stdout */
+#include <stdlib.h>
#include <stdio.h>
#include <string.h>
@@ -87,8 +88,11 @@
for (stop++; *stop && (*stop == ' ' || *stop == '\t'); stop++)
;
} else {
- fprintf(stderr, "line %d: something other than line break or hex digits after = in quoted-printable encoding\n", lineno);
- exit(1);
+ fprintf(stderr, "line %d: '%c' something other than line break or hex digits after = in quoted-printable encoding\n", lineno, *stop);
+ putchar('=');
+ putchar(*stop);
+ stop++;
+ /* exit(1); */
}
start = stop;
goto keep_processing;
---------------------------------------------------------------------------
If you agree that this is the right solution to the bug, then would
you mind adding this to your combined vm-7.19.patch file (note you
already are patching qp-decode.c anyway :)
Thanks,
Jeff
blueman
>???????????????????????????????????????????????????????????????????....
Sorry about the messed up message...
It was caused by the fact that the 'backtrace' had some control
characters which caused problems when posted using the 'gnus' news
program.
Interestingly, while the entire message looks corrputed under gnus
(all question marks), the google groups version prints out ok until
the control characters but the rest of the message is cut off.
Seems like another character/encoding issue but this time with gnus :)
newsspam5...@robf.de
Interesting ... I will have to digg on thing a bit more.
[...]
>> Does it work with this patch to qp-decode?
[...]
>> goto keep_processing;
>
> The patch above seems to be different from the qp-decode.c version
> that you sent me.
> The one you sent me works fine and seems to fix the problem.
> The patch here won't work properly, for two reasons:
> - The printf spews the error message into the text of the email
> - The stuff after the equals sign is dropped whereas in the
> version you sent me, it is printe
Yeah, it was a untested quicky ;-)
>
> Still, I would recommend the following slightly different patch based
> on the version you sent me privately:
[...]
> If you agree that this is the right solution, would you mind adding it
> to your vm-7.19.patch file
Never.
> (note that you are already patching qp-decode.c anyway already
> :)
Which was a accident ;-/
Robert.
blueman
Hmmmm. That sounds pretty absolute... Can you explain?
This seems to be a very SERIOUS bug. It allows anyone to either
intentionally or unintentionally send you an email that then cripples
'vm' making it impossible for you to delete or save the vm folder
anymore unless you quit and restart emacs.
I would think that fixing such a vulnerability would be MORE important
than many of the various minor fixes extensions that are already
included in your patch... I am surprised.
On the other hand, maybe you just mean that this is not the right
long-term fix. But still, I think that the patched version of
qp-decode.c is actually an improvement over the original. If the file is
properly qp-encoded, then the behavior of qp-decode.c is unchanged. If
the file is not properly encoded, then an error message is still
generated to stderr, but now the program still does its best to decode
the file. I would have thought that this behavior is consistent with
the overall Unix philosophy of having input filters be maximally
permissive and output filters maximally conforming.
newsspam5...@robf.de
I tried to say, "I never mind adding it".
Sorry for causing confusion ;-)
Robert.
John J Foerch
>>> > If you agree that this is the right solution, would you mind adding it
>>> > to your vm-7.19.patch file
>>>
>>> Never.
>>
>> Hmmmm. That sounds pretty absolute... Can you explain?
>
> I tried to say, "I never mind adding it".
hahaha.. this has been a hilarious thread to read.
--John
blueman
No problem. I was really surprised because you are one of the most
helpful people around going so far as to write code to solve other
peoples' problems. That is why I was so surprised when it seemed like
you responded with the one word absolute "Never" -- I couldn't believe
that you wanted to leave a bad bug in place -- it was so out of
character.
Thanks for clarifying... and I will try never to doubt you again :)
blueman
Agreed... I laughed too at this typo that flipped not just the meaning
but also the tone 180 degrees!