Unexplainable behavior from pop3proxyd

[Eli Ben-Shoshan]

I have observed a weird behaviour out of the pop3 proxy. When the proxy 
quits it dumps core. When I examine the core with gdb it tells me that 
it dumps core when calling FD_SET in function prot_fill line 402 of 
prot.c. I then proceeded to run the program in gdb and found out that 
pop3proxyd was dumping core becasue the file descriptor passed to FD_SET 
is invalid. When I steped through the program, I found that s->fd 
changed after the call to prot_flush(s->flushonread) in line 371 of 
prot.c. It usually changes to either a very large integer (1.7 million) 
or a negative number. What is even more strange is that if I put an 
empty syslog in function shut_down at line 406 of pop3proxyd, the 
problem stops occuring most of the time. This really boggled my brain 
for a few days since I could not see anything in prot_flush that could 
do this. Has anyone had this problem? I did come up with a patch that 
seems to have stoped the problem from occuring which I have attached to 
this email. Here are the stats for the system I am running this on:

AIX 4.3.3
cyrus-imapd 2.1.11
cyrus-sasl 2.1.7
BerkleyDB 4.0.14

Any assistance would be great. Thanks.

-- 
Eli Ben-Shoshan                                  ebs at nersp.nerdc.ufl.edu
Computer Programmer-Analyst
University of Florida Computing and Networking Services
VOX: (352) 392-2061				 FAX: (352) 392-9440
-------------- next part --------------
--- cyrus-imapd-2.1.11/lib/prot.c	Mon Oct 21 16:44:22 2002
+++ cyrus-imapd-2.1.11-hacked/lib/prot.c	Fri Feb 28 11:05:24 2003
@@ -333,6 +333,7 @@
     int haveinput; 
     time_t read_timeout;
     struct prot_waitevent *event, *next;
+    int fd_before, fd_after = s->fd;
    
     assert(!s->write);
 
@@ -368,11 +369,18 @@
 		    s->readcallback_proc = 0;
 		    s->readcallback_rock = 0;
 		}
+		fd_before = s->fd;
 		if (s->flushonread) prot_flush(s->flushonread);
+		fd_after = s->fd;
 	    }
 	    else {
 		haveinput = 1;
 	    }
+	}
+
+	if ( fd_before != fd_after ) {
+	  syslog(LOG_DEBUG,"[OSG] file descriptor changed: [%d] [%d]", fd_before, fd_after);
+	  s->fd = fd_before;
 	}
 
 	if (!haveinput && (s->read_timeout || s->dontblock)) {