[OTR-dev] Crash when receiving message after canceling encrypted chat (with gdb backtrace)

[Evan Schoenberg]

I get this crash in 1.9.9 every time I take the following steps with  
two accounts, A and B. The crash seems to only occur if I handle and  
return 0 in my display_otr_message UI callback.

A messages B.  OTR session begins.
A then cancels encryption.  B is told that A is no longer using  
encryption.
Without canceling encryption, B messages A.  B is told that he sent  
encrypted data to A when A wasn't expecting it.  B then promptly  
crashes.
(meanwhile, A is told that an encrypted message was received but  
unreadable... and then the OTR connected callback is called again,  
indicating I suppose that encryption was re-negotiated).

Here's the backtrace from B.

(gdb) bt
#0  0x9000d280 in strcat ()
#1  0x075032c0 in otrl_proto_create_data (encmessagep=0xf0130ed4,  
context=0x285de00, msg=0x71de368 "[resent] [resent] [resent] [resent]  
[resent] [resent] [resent] [resent] [resent] [resent] [resent] [resent]  
[resent] [resent] [resent] [resent] [resent] [resent] [resent] [resent]  
[resent] [resent] [r"..., tlvs=0x0) at  
/Users/evands/libgaim/Libraries/libotr/src/proto.c:832
#2  0x074ff99c in otrl_message_receiving (us=0x5f2e7f0, ops=0x773b5ec,  
opdata=0x0, accountname=0x5f59dd0 "[ACCOUNTNAME B]", protocol=0x5f5a4d0  
"prpl-oscar", sender=0x8518480 "[ACCOUNTNAME A]", message=0x2995600  
"?OTR:AAEKAAAAAIDsMkToII3TCsxkkgpxpGxfdVufygvmrQv+cP0Baz/ 
ae58HNuUFmWbXCygaI++jO4Hn81N5vVMS5AhFKFvzSayYiQr7tTB/ 
y6gEUk7JmIbSSG+MjmBm9BlbcxV4nECIZA1GaS2rocIhZTMz56NxbLV5rPTA921CezTANSJl 
gqPYrwAAABTtzgwsoBV"..., newmessagep=0xf0130f60, tlvsp=0xf0130f64,  
add_appdata=0, data=0x0) at  
/Users/evands/libgaim/Libraries/libotr/src/message.c:533
#3  0x074fc780 in process_receiving_im (account=0x5f59e10,  
who=0xf0131130, message=0xf0131134, flags=0xf0131194, m=0x0) at  
/Users/evands/libgaim/Gaim projects/gaim-otr/otr-plugin.c:359
#4  0x07486074 in gaim_marshal_BOOLEAN__POINTER_POINTER_POINTER_POINTER  
(cb=0x74fc654 <process_receiving_im>, args=0xf0131110  
"\360\023\0210\360\023\021\224\220", data=0x0, return_val=0xf013105c)  
at /Users/evands/libgaim/Libgaim/src/signals.c:824
#5  0x07485098 in gaim_signal_emit_vargs_return_1 (instance=0x7742234,  
signal=0x761129c "receiving-im-msg", args=0xf0131100  
"\005\365\236\020\360\023\0210\360\023\0214\360\023\021\224\360\023\0210 
\360\023\021\224\220") at  
/Users/evands/libgaim/Libgaim/src/signals.c:526
#6  0x07484e8c in gaim_signal_emit_return_1 (instance=0x7742234,  
signal=0x761129c "receiving-im-msg") at  
/Users/evands/libgaim/Libgaim/src/signals.c:477
#7  0x07481984 in serv_got_im (gc=0x7112c10, who=0x8526760  
"[ACCOUNTNAME A]", msg=0x2a24e00  
"?OTR:AAEKAAAAAIDsMkToII3TCsxkkgpxpGxfdVufygvmrQv+cP0Baz/ 
ae58HNuUFmWbXCygaI++jO4Hn81N5vVMS5AhFKFvzSayYiQr7tTB/ 
y6gEUk7JmIbSSG+MjmBm9BlbcxV4nECIZA1GaS2rocIhZTMz56NxbLV5rPTA921CezTANSJl 
gqPYrwAAABTtzgwsoBV"..., imflags=0, mtime=1107937497) at  
/Users/evands/libgaim/Libgaim/src/server.c:872
#8  0x074440d4 in incomingim_chan1 (sess=0x296e000, conn=0x712b700,  
userinfo=0xf01313d0, args=0xf0131320) at  
/Users/evands/libgaim/Libgaim/src/protocols/oscar/oscar.c:3371
#9  0x07445f2c in gaim_parse_incoming_im (sess=0x296e000, fr=0x71b9410)  
at /Users/evands/libgaim/Libgaim/src/protocols/oscar/oscar.c:3915
#10 0x07433a04 in incomingim_ch1 (sess=0x296e000, mod=0x712cab0,  
rx=0x71b9410, snac=0xf0131530, channel=1, userinfo=0xf01313d0,  
bs=0x71b941c, cookie=0xf01313b8 "\323\376\355\245\325\363\331\344") at  
/Users/evands/libgaim/Libgaim/src/protocols/oscar/im.c:1521
#11 0x07434b58 in incomingim (sess=0x296e000, mod=0x712cab0,  
rx=0x71b9410, snac=0xf0131530, bs=0x71b941c) at  
/Users/evands/libgaim/Libgaim/src/protocols/oscar/im.c:2018
#12 0x07435ab0 in snachandler (sess=0x296e000, mod=0x712cab0,  
rx=0x71b9410, snac=0xf0131530, bs=0x71b941c) at  
/Users/evands/libgaim/Libgaim/src/protocols/oscar/im.c:2352
#13 0x0745300c in consumesnac (sess=0x296e000, rx=0x71b9410) at  
/Users/evands/libgaim/Libgaim/src/protocols/oscar/rxhandlers.c:138
#14 0x07453c14 in aim_rxdispatch (sess=0x296e000) at  
/Users/evands/libgaim/Libgaim/src/protocols/oscar/rxhandlers.c:525
#15 0x0743e578 in oscar_callback (data=0x712b700, source=41,  
condition=GAIM_INPUT_READ) at  
/Users/evands/libgaim/Libgaim/src/protocols/oscar/oscar.c:1578
#16 0x064331dc in socketCallback (s=0x713b410,  
callbackType=kCFSocketReadCallBack, address=0x0, data=0x0,  
infoVoid=0x71642e0) at /Users/evands/adium/Plugins/Gaim  
Service/adiumGaimEventloop.m:207
#17 0x901a2948 in __CFSocketPerform ()
#18 0x90193ca8 in __CFRunLoopDoSources0 ()
#19 0x90191560 in __CFRunLoopRun ()
#20 0x90195e8c in CFRunLoopRunSpecific ()
#21 0x901ff328 in CFRunLoopRun ()
#22 0x0641e520 in -[SLGaimCocoaAdapter init] (self=0x5f1a750,  
_cmd=0x9083ed94) at /Users/evands/adium/Plugins/Gaim  
Service/SLGaimCocoaAdapter.m:136
#23 0x0641e108 in +[SLGaimCocoaAdapter createThreadedGaimCocoaAdapter]  
(self=0x644672c, _cmd=0x643afe4) at /Users/evands/adium/Plugins/Gaim  
Service/SLGaimCocoaAdapter.m:73
#24 0x90a39b74 in forkThreadForFunction ()
#25 0x900246e8 in _pthread_body ()