xemacs crashes when using MH-E to view message with PNG attachment

[Mike Kupfer]

An email that contains a PNG attachment can crash XEmacs 21.4.22 when viewed using MH-E. I'll attach a C stacktrace from gdb and a sample message. I've reproduced this on x86_64 and i686 systems, both running Ubuntu 11.10. This appears to be the same as XEmacs issue570 (http://tracker.xemacs.org/XEmacs/its/issue570), for which there is a patch at
http://list-archive.xemacs.org/pipermail/xemacs-patches/2009-September/007961.html. The fix has been applied to the dev version of XEmacs 21.4, and a new release is planned soon, but I don't know if it will be in time for Precise.

ProblemType: Bug
DistroRelease: Ubuntu 11.10
Package: xemacs21 21.4.22-3.1ubuntu1
ProcVersionSignature: Ubuntu 3.0.0-15.26-generic 3.0.13
Uname: Linux 3.0.0-15-generic x86_64
ApportVersion: 1.23-0ubuntu4
Architecture: amd64
Date: Mon Jan 30 16:55:23 2012
Dependencies:

InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Release amd64 (20111012)
PackageArchitecture: all
ProcEnviron:
 LC_TIME=C
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: xemacs21
UpgradeStatus: No upgrade log present (probably fresh install)

[Mike Kupfer (mkupfer37)]

I verified the fix by building 21.4.22 from the original source tarball, reproducing the crash, applying the patch, and trying to reproduce the crash.

Here's the stack information from gdb:

(gdb) run -vanilla
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /usr/bin/xemacs -vanilla
[Thread debugging using libthread_db enabled]
Warning: Cannot convert string "-*-helvetica-bold-r-*-*-*-120-*-*-*-*-iso8859-*" to type FontStruct
*** glibc detected *** /usr/bin/xemacs: munmap_chunk(): invalid pointer: 0x000000000124fac0 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x78a96)[0x7ffff5121a96]
/lib/x86_64-linux-gnu/libz.so.1(inflateEnd+0x34)[0x7ffff4a8b424]
/lib/x86_64-linux-gnu/libpng12.so.0(png_read_destroy+0x21f)[0x7ffff76f4bbf]
/lib/x86_64-linux-gnu/libpng12.so.0(png_destroy_read_struct+0x7a)[0x7ffff76f4e5a]
/usr/bin/xemacs[0x4d4c24]
/usr/bin/xemacs(unbind_to_hairy+0x63)[0x470883]
/usr/bin/xemacs(unbind_to+0x86)[0x470966]
/usr/bin/xemacs[0x4d5428]
/usr/bin/xemacs[0x4d0c84]
/usr/bin/xemacs[0x4d2cf9]
/usr/bin/xemacs[0x472436]
/usr/bin/xemacs(internal_catch+0xb1)[0x471211]
/usr/bin/xemacs(call_with_suspended_errors+0x224)[0x477194]
/usr/bin/xemacs[0x529486]
/usr/bin/xemacs(specifier_instance+0x2a1)[0x529911]
/usr/bin/xemacs(glyph_image_instance+0x27)[0x4cda57]
/usr/bin/xemacs(glyph_width+0x16)[0x4cffb6]
/usr/bin/xemacs(Fglyph_width+0x21)[0x4d0301]
/usr/bin/xemacs(Ffuncall+0x44e)[0x473cae]
/usr/bin/xemacs[0x452805]
/usr/bin/xemacs(funcall_compiled_function+0x17c)[0x452ccc]
/usr/bin/xemacs(Ffuncall+0x345)[0x473ba5]
/usr/bin/xemacs[0x452805]
/usr/bin/xemacs(funcall_compiled_function+0x17c)[0x452ccc]
/usr/bin/xemacs(Ffuncall+0x345)[0x473ba5]
/usr/bin/xemacs[0x452805]
/usr/bin/xemacs(funcall_compiled_function+0x17c)[0x452ccc]
/usr/bin/xemacs(Ffuncall+0x345)[0x473ba5]
/usr/bin/xemacs[0x4bdda5]
/usr/bin/xemacs(Fmapcar+0xf9)[0x4c0019]
/usr/bin/xemacs(Ffuncall+0x44e)[0x473cae]
/usr/bin/xemacs[0x452805]
/usr/bin/xemacs(funcall_compiled_function+0x17c)[0x452ccc]
/usr/bin/xemacs(Ffuncall+0x345)[0x473ba5]
/usr/bin/xemacs[0x452805]
/usr/bin/xemacs(funcall_compiled_function+0x17c)[0x452ccc]
/usr/bin/xemacs(Ffuncall+0x345)[0x473ba5]
/usr/bin/xemacs[0x452805]
/usr/bin/xemacs(Fbyte_code+0xaa)[0x452afa]
/usr/bin/xemacs(Feval+0x971)[0x475a31]
/usr/bin/xemacs(condition_case_1+0x113)[0x4774a3]
/usr/bin/xemacs(execute_rare_opcode+0x1e6)[0x451776]
/usr/bin/xemacs[0x452925]
/usr/bin/xemacs(funcall_compiled_function+0x17c)[0x452ccc]
/usr/bin/xemacs(Ffuncall+0x345)[0x473ba5]
/usr/bin/xemacs[0x452805]
/usr/bin/xemacs(funcall_compiled_function+0x17c)[0x452ccc]
/usr/bin/xemacs(Ffuncall+0x345)[0x473ba5]
/usr/bin/xemacs[0x452805]
/usr/bin/xemacs(funcall_compiled_function+0x17c)[0x452ccc]
/usr/bin/xemacs(Ffuncall+0x345)[0x473ba5]
/usr/bin/xemacs[0x452805]
/usr/bin/xemacs(funcall_compiled_function+0x17c)[0x452ccc]
/usr/bin/xemacs(Ffuncall+0x345)[0x473ba5]
/usr/bin/xemacs(apply1+0x7f)[0x4750af]
/usr/bin/xemacs(Fcall_interactively+0x1467)[0x4546e7]
/usr/bin/xemacs(Fcommand_execute+0x17f)[0x47676f]
/usr/bin/xemacs[0x4a237d]
/usr/bin/xemacs(Fdispatch_event+0x172)[0x4a4082]
/usr/bin/xemacs(Fcommand_loop_1...