reproducable segfaults when using --with-auth=krb5

[Jukka Salmi]

Hi,

on a NetBSD (1.6.2) i386 system I'm using the following software:

	cyrus-imapd-2.2.3
	cyrus-sasl-2.1.18
	heimdal-0.6.1

When compiling Cyrus IMAPd using the krb5 authorisation module
(--with-auth=krb5), there are repoducable segfaults with pop3d and
lmtpd. The following is logged:

Apr 16 11:21:30 bart master[16202]: about to exec /usr/pkg/cyrus/bin/pop3d
Apr 16 11:21:30 bart pop3[16202]: executed
Apr 16 11:21:30 bart pop3[16202]: accepted connection
Apr 16 11:21:33 bart pop3[16202]: login: bart.local[192.168.12.104] jukka plaintext 
Apr 16 11:21:33 bart master[16160]: process 16202 exited, signaled to death by 11
Apr 16 11:21:33 bart master[16160]: service pop3 pid 16202 in BUSY state: terminated abnormally
[...]
Apr 16 11:24:29 bart master[16298]: about to exec /usr/pkg/cyrus/bin/lmtpd
Apr 16 11:24:29 bart lmtpunix[16298]: executed
Apr 16 11:24:29 bart lmtpunix[16298]: accepted connection
Apr 16 11:24:29 bart lmtpunix[16298]: lmtp connection preauth'd as postman
Apr 16 11:24:29 bart master[16160]: process 16298 exited, signaled to death by 11
Apr 16 11:24:29 bart master[16160]: service lmtpunix pid 16298 in BUSY state: terminated abnormally


pop3test gets the following:

$ pop3test -m user bart.local
[...]
Please enter your password: 
C: USER jukka
S: +OK Name is a valid mailbox
C: PASS <omitted>
failure: prot layer failure

Exactly the same happens when using GSSAPI (pop3test -m gssaspi).


My Postfix LMTP client logs this:

Apr 16 11:24:29 bart postfix/lmtp[16278]: D7DF65342: to=<jukka at bart.local>, orig_to=<root at bart.local>, relay=/socket/lmtp[/socket/lmtp], delay=29218, status=deferred (lost connection with /socket/lmtp[/socket/lmtp] while sending MAIL FROM)

BTW, is it possible to use lmtptest when lmtpd is listening on a unix
socket only?


However, imapd is working fine, no segfaults so far...


A trace of a pop3d process:
[...]
 15918 pop3d    CALL  open(0xbfbf85f4,0x2,0)
 15918 pop3d    NAMI  "/var/spool/imap/user/jukka/cyrus.header"
 15918 pop3d    RET   open 9
 15918 pop3d    CALL  __fstat13(0x9,0xbfbf8594)
 15918 pop3d    RET   __fstat13 0
 15918 pop3d    CALL  mmap(0,0x97,0x1,0x1,0x9,0,0,0)
 15918 pop3d    RET   mmap 1231323136/0x49648000
 15918 pop3d    PSIG  SIGSEGV SIG_DFL
 15918 pop3d    NAMI  "pop3d.core"

I already tried what's suggested in the FAQ about NetBSD systems (using
map_nommap) without success, pop3d still segfaults. Here's the trace:
[...]
  1418 pop3d    CALL  open(0xbfbf85fc,0x2,0)
  1418 pop3d    NAMI  "/var/spool/imap/user/jukka/cyrus.header"
  1418 pop3d    RET   open 9
  1418 pop3d    CALL  __fstat13(0x9,0xbfbf859c)
  1418 pop3d    RET   __fstat13 0
  1418 pop3d    CALL  lseek(0x9,0,0,0,0)
  1418 pop3d    RET   lseek 0
  1418 pop3d    CALL  read(0x9,0x8109800,0x97)
  1418 pop3d    GIO   fd 9 read 151 bytes
       "\M-!\^B\M^K\rCyrus mailbox header
        "The best thing about this system was that it had lots of goals."
                --Jim Morris on Andrew
                7bced5f6407fb7a8

        jukka   lrswipcda
       "
  1418 pop3d    RET   read 151/0x97
  1418 pop3d    PSIG  SIGSEGV SIG_DFL
  1418 pop3d    NAMI  "pop3d.core"


Compiling Cyrus IMAPd using the unix auth mod (--with-auth=unix) seems
to solve the problems, no segfaults any more, everything works fine.

Is this a known bug?


Help is appreciated!

TIA, Jukka

-- 
bashian roulette:
$ ((RANDOM%6)) || rm -rf ~
---
Cyrus Home Page: http://asg.web.cmu.edu/cyrus
Cyrus Wiki/FAQ: http://cyruswiki.andrew.cmu.edu
List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html