bug#40049: 26.1; Coredump on GNUS reading e-mail

[Sergey Organov]

Emacs coredumps when GNUS tries to read some kinds of mails.

To reproduce from 'emacs -Q', untar attached file that will create
'gnus-coredump' directory with a single mail file in it, then:

$ emacs -Q
M-x gnus
G D ;; gnus-group-enter-directory
<type directory name> RET

GNUS then tries to open this directory as group and Emacs crashes. The
backtrace and other information follows:

#0  0x00007ffbe74bb5cb in raise (sig=sig@entry=6) at 
../sysdeps/unix/sysv/linux/raise.c:50
        set = {__val = {402653184, 0 <repeats 15 times>}}
        pid = <optimized out>
        tid = <optimized out>
#1  0x00000000004f6f37 in terminate_due_to_signal
    (sig=sig@entry=6, backtrace_limit=backtrace_limit@entry=40)
    at ./debian/build-src/src/emacs.c:394
#2  0x0000000000511643 in emacs_abort () at ./debian/build-src/src/sysdep.c:2426
#3  0x00000000004c3f23 in x_connection_closed
    (dpy=dpy@entry=0x4809290, error_message=<optimized out>, 
    error_message@entry=0x7ffc028a98c0 "X protocol error: BadLength (poly 
request too large or internal Xlib length error) on protocol request 139", 
ioerror=ioerror@entry=false)
    at ./debian/build-src/src/xterm.c:9816
        dpyinfo = <optimized out>
        frame = <optimized out>
        tail = <optimized out>
        idx = <optimized out>
#4  0x00000000004c7d49 in x_error_quitter
    (display=0x4809290, event=<optimized out>, event=<optimized out>)
    at ./debian/build-src/src/xterm.c:9904
        buf = "BadLength (poly request too large or internal Xlib length 
error)", '\000' <repeats 191 times>
        buf1 = "X protocol error: BadLength (poly request too large or internal 
Xlib length error) on protocol request 139", '\000' <repeats 28 times>, 
"\360?", '\000' <repeats 62 times>, "\360?"...
#5  0x00000000004c7dcb in x_error_handler (display=0x4809290, 
event=0x7ffc028a9a80)
    at ./debian/build-src/src/xterm.c:9874
#6  0x00007ffbe94e011a in _XError () at /lib/x86_64-linux-gnu/libX11.so.6
#7  0x00007ffbe94dd077 in  () at /lib/x86_64-linux-gnu/libX11.so.6
#8  0x00007ffbe94dd11d in  () at /lib/x86_64-linux-gnu/libX11.so.6
#9  0x00007ffbe94dda55 in _XEventsQueued () at /lib/x86_64-linux-gnu/libX11.so.6
#10 0x00007ffbe94cf7b7 in XPending () at /lib/x86_64-linux-gnu/libX11.so.6
#11 0x00007ffbe9d7920d in  () at /lib/x86_64-linux-gnu/libgdk-3.so.0
#12 0x00007ffbe9852669 in g_main_context_prepare () at 
/lib/x86_64-linux-gnu/libglib-2.0.so.0
#13 0x00007ffbe985306b in  () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#14 0x00007ffbe9853207 in g_main_context_pending () at 
/lib/x86_64-linux-gnu/libglib-2.0.so.0
#15 0x00007ffbea047b9d in gtk_events_pending () at 
/lib/x86_64-linux-gnu/libgtk-3.so.0
#16 0x00000000004c4917 in XTread_socket (terminal=<optimized out>, 
hold_quit=0x7ffc028a9d80) at ./debian/build-src/src/xterm.c:9142
        count = 0
        dpyinfo = 0x48c3890
#17 0x00000000004fe1c9 in gobble_input () at 
./debian/build-src/src/keyboard.c:6910
        nr = <optimized out>
        hold_quit = {kind = NO_EVENT, part = scroll_bar_nowhere, code = 0, 
modifiers = 0, x = 0, y = 0, timestamp = 0, frame_or_window = 0, arg = 0}
        next = 0x0
        nread = 0
        err = false
        t = 0x114de40 <bss_sbrk_buffer+7579168>
#18 0x00000000004fe875 in handle_async_input () at 
./debian/build-src/src/keyboard.c:7146
        nread = <optimized out>
#19 0x00000000004fe875 in process_pending_signals () at 
./debian/build-src/src/keyboard.c:7160
#20 0x000000000056f5ad in maybe_quit () at ./debian/build-src/src/eval.c:1494
#21 0x00000000005766f2 in Flength (sequence=0, sequence@entry=20216131) at 
./debian/build-src/src/lisp.h:1221
        li = {tortoise = 20216131, max = 2, n = 0, q = 0}
        i = 2
        val = <optimized out>
#22 0x0000000000577739 in concat (nargs=nargs@entry=1, 
args=args@entry=0x7ffc028a9f38, target_type=Lisp_Cons, 
last_special=last_special@entry=false) at ./debian/build-src/src/fns.c:582
        len = <optimized out>
        val = <optimized out>
        tail = 0
        this = 20216131
        toindex = <optimized out>
        toindex_byte = 0
        result_len = 0
        result_len_byte = 0
        argnum = 0
        last_tail = 0
        prev = <optimized out>
        some_multibyte = false
        textprops = 0x0
        num_textprops = 0
        sa_avail = 16384
        sa_count = 4
        sa_must_free = false
#23 0x0000000000578356 in Fcopy_sequence (arg=<optimized out>) at 
./debian/build-src/src/lisp.h:615
#24 0x00000000004fd323 in timer_check () at 
./debian/build-src/src/keyboard.c:4516
        nexttime = <optimized out>
        timers = 90191187
        idle_timers = <optimized out>
        tem = 0
#25 0x00000000004fd875 in readable_events (flags=flags@entry=1) at 
./debian/build-src/src/keyboard.c:3340
#26 0x00000000004fe368 in get_input_pending (flags=flags@entry=1) at 
./debian/build-src/src/keyboard.c:6827
#27 0x0000000000500bc8 in detect_input_pending_run_timers 
(do_display=do_display@entry=true) at ./debian/build-src/src/keyboard.c:9951
        old_timers_run = <optimized out>
#28 0x00000000005b0387 in wait_reading_process_output 
(time_limit=time_limit@entry=30, nsecs=nsecs@entry=0, 
read_kbd=read_kbd@entry=-1, do_display=do_display@entry=true, 
wait_for_cell=wait_for_cell@entry=0, wait_proc=wait_proc@entry=0x0, 
just_wait_proc=0) at ./debian/build-src/src/process.c:5514
        old_timers_run = 41
        old_buffer = 0x56fb080
        old_window = 18897973
        leave = false
        process_skipped = <optimized out>
        channel = <optimized out>
        nfds = 1
        Available = {fds_bits = {32, 0 <repeats 15 times>}}
        Writeok = {fds_bits = {0 <repeats 16 times>}}
        check_write = <optimized out>
        check_delay = <optimized out>
        no_avail = false
        xerrno = 11
        proc = <optimized out>
        timeout = {tv_sec = 0, tv_nsec = 0}
        end_time = {tv_sec = 1584075114, tv_nsec = 412240713}
        timer_delay = <optimized out>
        got_output_end_time = {tv_sec = 1584075114, tv_nsec = 412240713}
        wait = TIMEOUT
        got_some_output = -1
        retry_for_async = <optimized out>
        count = 3
        now = {tv_sec = 0, tv_nsec = -1}
#29 0x00000000004244ba in sit_for (timeout=122, reading=reading@entry=true, 
display_option=display_option@entry=1) at ./debian/build-src/src/lisp.h:855
        sec = 30
        nsec = 0
        do_display = true
#30 0x000000000050323b in read_char (commandflag=commandflag@entry=1, 
map=map@entry=79079075, prev_event=0, 
used_mouse_menu=used_mouse_menu@entry=0x7ffc028aab5b, 
end_time=end_time@entry=0x0) at ./debian/build-src/src/lisp.h:944
        tem0 = <optimized out>
        timeout = <optimized out>
        delay_level = 4
        buffer_size = <optimized out>
        c = <optimized out>
        jmpcount = 3
        local_getcjmp = {{__jmpbuf = {1, -1075357801172022359, 86242312, 
79079075, 0, 140720351128656, 1075105577972157353, -1075358214119994455}, 
__mask_was_saved = 0, __saved_mask = {__val = {140720351127968, 91205765, 
32400, 91205760, 5653333, 0, 4, 0, 91205760, 42, 0, 10, 140720351127584, 0, 0, 
0}}}}
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 
0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0
        also_record = 0
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x486af30
#31 0x00000000005049a0 in read_key_sequence 
(keybuf=keybuf@entry=0x7ffc028aac50, prompt=prompt@entry=0, 
dont_downcase_last=dont_downcase_last@entry=false, 
can_return_switch_frame=can_return_switch_frame@entry=true, 
fix_current_buffer=fix_current_buffer@entry=true, 
prevent_redisplay=prevent_redisplay@entry=false, bufsize=30) at 
./debian/build-src/src/keyboard.c:9147
        interrupted_kboard = <optimized out>
        interrupted_frame = 0x1204c30 <bss_sbrk_buffer+8328208>
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        new_binding = <optimized out>
        count = 3
        t = 0
        echo_start = 0
        keys_start = 0
        current_binding = 79079075
        first_event = 0
        first_unbound = 31
        mock_input = 0
        fkey = {parent = 15197123, map = 15197123, start = 0, end = 0}
        keytran = {parent = 11008659, map = 11008659, start = 0, end = 0}
        indec = {parent = 15197283, map = 15197283, start = 0, end = 0}
        shift_translated = false
        delayed_switch_frame = 0
        original_uppercase = 0
        original_uppercase_position = -1
        dummyflag = false
        starting_buffer = 0x56fb080
        fake_prefixed_keys = 0
#32 0x00000000005060a4 in command_loop_1 () at ./debian/build-src/src/lisp.h:855
        cmd = <optimized out>
        keybuf = {286, 274, 0, 5989246615430861824, 0, 17483521, 4, 7818336, 
10341984, 10507232, 140720351128928, 5700864, 271, 320, -920, 4, 223338299410, 
0, 0, 472446402651, 511101108348, 5989246615430861824, 120, 140720351128880, 0, 
11315811, -1, 5691065, 5, 31200}
        i = <optimized out>
        prev_modiff = 6
        prev_buffer = 0x50cd760
#33 0x000000000056cd9e in internal_condition_case (bfun=bfun@entry=0x505e80 
<command_loop_1>, handlers=handlers@entry=21072, hfun=hfun@entry=0x4fc780 
<cmd_error>) at ./debian/build-src/src/eval.c:1332
        val = <optimized out>
        c = 0x47e9980
#34 0x00000000004f7344 in command_loop_2 (ignore=ignore@entry=0) at 
./debian/build-src/src/lisp.h:855
        val = <optimized out>
#35 0x000000000056cd0d in internal_catch (tag=tag@entry=50928, 
func=func@entry=0x4f7320 <command_loop_2>, arg=arg@entry=0) at 
./debian/build-src/src/eval.c:1097
        val = <optimized out>
        c = 0x47e9860
#36 0x00000000004f72db in command_loop () at ./debian/build-src/src/lisp.h:855
#37 0x00000000004fc363 in recursive_edit_1 () at 
./debian/build-src/src/keyboard.c:695
        count = 1
        val = <optimized out>
#38 0x00000000004fc6a8 in Frecursive_edit () at 
./debian/build-src/src/keyboard.c:766
        buffer = <optimized out>
#39 0x000000000041a631 in main (argc=<optimized out>, argv=0x7ffc028ab008) at 
./debian/build-src/src/emacs.c:1713
        stack_bottom_variable = 0x7ffbe70181a2 <__libc_calloc+130>
        do_initial_setlocale = <optimized out>
        dumping = <optimized out>
        skip_args = 0
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = <optimized out>
        disable_aslr = <optimized out>
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        sockfd = -1
Undefined command: "xbacktrace".  Try "help".

In GNU Emacs 26.1 (build 2, x86_64-pc-linux-gnu, GTK+ Version 3.24.5)
 of 2019-09-23, modified by Debian built on x86-grnet-01
Windowing system distributor 'The X.Org Foundation', version 11.0.12004000
System Description:     Debian GNU/Linux 10 (buster)

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.

Configured using:
 'configure --build x86_64-linux-gnu --prefix=/usr
 --sharedstatedir=/var/lib --libexecdir=/usr/lib
 --localstatedir=/var/lib --infodir=/usr/share/info
 --mandir=/usr/share/man --enable-libsystemd --with-pop=yes
 
--enable-locallisppath=/etc/emacs:/usr/local/share/emacs/26.1/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/26.1/site-lisp:/usr/share/emacs/site-lisp
 --with-sound=alsa --without-gconf --with-mailutils --build
 x86_64-linux-gnu --prefix=/usr --sharedstatedir=/var/lib
 --libexecdir=/usr/lib --localstatedir=/var/lib
 --infodir=/usr/share/info --mandir=/usr/share/man --enable-libsystemd
 --with-pop=yes
 
--enable-locallisppath=/etc/emacs:/usr/local/share/emacs/26.1/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/26.1/site-lisp:/usr/share/emacs/site-lisp
 --with-sound=alsa --without-gconf --with-mailutils --with-x=yes
 --with-x-toolkit=gtk3 --with-toolkit-scroll-bars 'CFLAGS=-g -O2
 -fdebug-prefix-map=/build/emacs-StqULU/emacs-26.1+1=. -fstack-protector-strong
 -Wformat -Werror=format-security -Wall' 'CPPFLAGS=-Wdate-time
 -D_FORTIFY_SOURCE=2' LDFLAGS=-Wl,-z,relro'

Configured features:
XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND GPM DBUS GSETTINGS NOTIFY
ACL LIBSELINUX GNUTLS LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB
TOOLKIT_SCROLL_BARS GTK3 X11 THREADS LIBSYSTEMD LCMS2

Important settings:
  value of $LC_MONETARY: en_US.UTF-8
  value of $LC_NUMERIC: en_US.UTF-8
  value of $LC_TIME: en_US.UTF-8
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message rmc puny seq byte-opt gv
bytecomp byte-compile cconv cl-loaddefs cl-lib dired dired-loaddefs
format-spec rfc822 mml easymenu mml-sec password-cache epa derived epg
epg-config gnus-util rmail rmail-loaddefs mm-decode mm-bodies mm-encode
mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail rfc2047
rfc2045 ietf-drums mm-util mail-prsvr mail-utils elec-pair time-date
mule-util tooltip eldoc electric uniquify ediff-hook vc-hooks
lisp-float-type mwheel term/x-win x-win term/common-win x-dnd tool-bar
dnd fontset image regexp-opt fringe tabulated-list replace newcomment
text-mode elisp-mode lisp-mode prog-mode register page menu-bar
rfn-eshadow isearch timer select scroll-bar mouse jit-lock font-lock
syntax facemenu font-core term/tty-colors frame cl-generic cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european
ethiopic indian cyrillic chinese composite charscript charprop
case-table epa-hook jka-cmpr-hook help simple abbrev obarray minibuffer
cl-preloaded nadvice loaddefs button faces cus-face macroexp files
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget hashtable-print-readable backquote dbusbind inotify lcms2
dynamic-setting system-font-setting font-render-setting move-toolbar gtk
x-toolkit x multi-tty make-network-process emacs)

Memory information:
((conses 16 95339 8813)
 (symbols 48 20366 1)
 (miscs 40 44 118)
 (strings 32 28351 1037)
 (string-bytes 1 743311)
 (vectors 16 14643)
 (vector-slots 8 496406 10266)
 (floats 8 49 99)
 (intervals 56 264 0)
 (buffers 992 11))

gnus-coredump.tar.gz
Description: Mail folder that provokes GNUS crash