#7 NULL dereference crash

[Marc Marais]

I've encountered an intermittent null deference crash
in JabberCOM 2.4.2.1 at instruction 0x00F140BB.

Assembler instruction:

mov eax, dword_ptr [ebp-0Ch]
push eax
crash: mov eax, dword ptr [eax]
call dword ptr [eax+1Ch]
call 00EA58DC

call stack:

JabberCOM.dll!00f140bb
JabberCOM.dll!00f1014b
JabberCOM.dll!00ec6fce
USER32.dll!77e12e98
USER32.dll!77e130e0
USER32.dll!77e15824

I am developing on Win2K SP2.

The crash occurs after processing
OnSubscriptionApproved.

[Marc Marais]

Logged In: YES
user_id=451016

Dr Watson log on Win98 where crash occurs also - appears to
be the same address

> MWEBM caused an invalid page fault in
> module JABBERCOM.DLL at 0167:00c440bb.
> Registers:
> EAX=00000000 CS=0167 EIP=00c440bb EFLGS=00010246
> EBX=00c82fbc SS=016f ESP=0067faa0 EBP=0067faec
> ECX=c9490710 DS=016f ESI=00000003 FS=487f
> EDX=0045001c ES=016f EDI=00000003 GS=0000
> Bytes at CS:EIP:
> 8b 00 ff 50 1c e8 17 18 f9 ff 8b 45 e8 ba 60 43
> Stack dump:
> 00000000 0067fad4 0067faf4 00c44321 0067faec 0067fb94
00c82fbc
> 00c82a80 00464d1c 00464a80 00465cc8 00464aa4 00000000
00000000
> 00000006 00000000

[Marc Marais]

Logged In: YES
user_id=451016

Hello??? Anyone here???

I can try find it myself but I dont have Delphi! Is there
a .map file with symbol info I can use?? Please!!

[Marc Marais]

Logged In: YES
user_id=451016

Ok, I have determined the cause.

It appears to be a synchronisation issue in JabberCOM.dll.
What happens is that while I am processing the
OnSubscriptionApproved event another <presence> message
arrives from the server which JabberCOM then processes and
in the process corrupts the current XMLTag (I think)
object/pointer, looks like its getting released and then
set to NULL. So there you have it - you need to lock the
current XMLTag while the event is being processed before
processing the new XML message to prevent this.

This is fairly urgent - could someone please get back to me
on this - I would really appreciate it!

Hello???

</me hears a pin drop>

[Marc Marais]

Logged In: YES
user_id=451016

Here is the patch (if anyone cares) - this project seems
pretty dead to me:

-------------
97d96
< _Busy: boolean;
397,400c396,409
< if Copy(fData, 1, 8) = '</stream' then
< PostMessage(sHandle, WM_DROPPED, 0, 0)
< else
< PostMessage(sHandle, WM_XML, 0, 0);
---
> if Copy(fData, 1, 8) = '</stream' then
begin
> PostMessage(sHandle, WM_DROPPED, 0,
0);
> end
> else begin
> // M. Marais:
> // Changed PostMessage to SendMessage
to
> // prevent simultaneous access to the
WM_XML handler
> // as this procedure is non-
reentrant! due to the .clear
> // of the object var fXML at the end.
> // This procedure is being reentered
because if any
> // of the events being called process
windows messages
> // the WM_XML handler will get called
again.
> SendMessage(sHandle, WM_XML, 0, 0);
> end;
1469d1477
< _busy := true;
1563d1570
< _busy := false;
------------------------

[Nobody/Anonymous]

Logged In: NO

im having this problem to, i run XP sp1, and it happens when
a user signs on, sometimes it dont and 95% of the time is
does