segfault in ctl_mboxlist -d with 2.5.4

Chris Stromsoe cbs at ucla.edu
Wed Jul 8 11:06:58 EDT 2015


I'm seeing a segfault running ctl_mboxlist -d with 2.5.4.  mailboxes.db 
format is twoskip.  All mailbxoes are on the default partition.

gdb traces it back to this printf() in dump_cb():

     case DUMP:
         if (!d->partition || !strcmpsafe(d->partition, part)) {
             printf("%s\t%d %s %s\n", name, mbtype, part, acl);
             if (d->purge) {
                 cyrusdb_delete(mbdb, key, keylen, &(d->tid), 0);
             }
         }
         break;


Initializing part to NULL at the start of the function fixes the segfault.

The mailbox causing the problem has MBTYPE_DELETED.  Tracing through the 
logic earlier in dump_cb(), the call to dlist_getatom() is failing but the 
partition is not being set to NULL because the if explicitly excludes 
mailboxes of MBTYPE_DELETED.

             // The partition is always there...
             r = dlist_getatom(dl, "P", (const char **)&part);

             if (!r && !(mbtype & MBTYPE_DELETED)) {
                 syslog(
                         LOG_ERR,
                         "No partition for mailbox '%s'",
                         name
                     );

                 part = NULL;
             }

The test should probably be rewritten to be:

             if (!r) {
                 if (!(mbtype & MBTYPE_DELETED)) {
                     syslog(
                             LOG_ERR,
                             "No partition for mailbox '%s'",
                             name
                         );
                 }
                 part = NULL;
             }



-Chris


More information about the Cyrus-devel mailing list