lmtpd dumping core

[Rob McMahon]

Cyrus imapd 2.2.12 / Squirrelmail on Solaris 10 SPARC.  I'm using the 
autocreate patch.

Our cyrus-imap implementation began dying every time sendmail ran the 
mail queue.  It turned out to be caused by mail addressed to recipients 
like <&aelig>, the stack trace looking like this:

 > mdb core.narcissus.lmtpd.14625
Loading modules: [ libc.so.1 libuutil.so.1 ld.so.1 ]
 > ::stack
libc.so.1`strlen+0x50(ffbfbad3, ffbfc690, ffbfb2c1, 0, 0, 0)
libc.so.1`vsnprintf+0x6c(ffbfbf13, 4bd, ffbfbaac, ffbfc68c, 7ffffc00, 0)
libc.so.1`vsyslog+0x454(3acb008, a, ffbfc68c, 63135, ffbfbaac, 73)
libc.so.1`syslog+0x1c(3, e75c4, 0, 82, ffbfc240, 0)
mboxlist_autocreateinbox+0xb8(107028, 0, 0, ffbfcafc, 186a0, 0)
autocreate_inbox+0xd8(107000, 13b2f0, 186a0, 107000, 107000, 8e76e800)
verify_user+0x238(8e76ea0b, 0, 61f, 61f, 0, 13b2f0)
process_recipient+0x3a0(1141e7, 107028, 0, 1b24c, 1147a0, 0)
lmtpmode+0x1254(100484, 13cc40, 129060, 0, 1119b9, ffbff04c)
service_main+0xc0(1, 111e48, ffffffff, e2400, e2400, 1070c0)
main+0x8d0(ffbff600, 4, 1, 9, 574c, 1204c8)
_start+0x108(0, 0, 0, 0, 0, 0)
 >  e75c4?s
0xe75c4:        Could not get cannon userid for user %s
 > ::status
debugging core file of lmtpd (32-bit) from narcissus
file: /usr/local/cyrus/bin/lmtpd
initial argv: lmtpd
threading model: multi-threaded
status: process terminated by SIGSEGV (Segmentation Fault)
 >

In imap/mboxlist.c, we find the code:

     if (auth_userid == NULL) {
          /*
           * Couldn't get cannon userid
           */
           syslog(LOG_ERR,
                 "Could not get cannon userid for user %s", auth_userid);

Oops.  If auth_userid is NULL, try to log it.  One suspects that was 
supposed to be `userid' being logged.

Comments ?

Cheers,

Rob

-- 
E-Mail:	Rob.McMahon at warwick.ac.uk		PHONE:  +44 24 7652 3037
Rob McMahon, IT Services, Warwick University, Coventry, CV4 7AL, England