*** glibc detected *** lmtpd: double free or corruption (out): 0x00002aaaacdeaa10 *** : 2 Time(s) problem

[Gabor Gombas]

On Wed, Sep 12, 2007 at 08:10:29PM +0200, Alain Spineux wrote:

> When postfix try to deliver an email, it open a LMTP connection with cyrus
> and cyrus, instead of speaking correct LMTP reply with garbage.
> BUT 2aaaac388000-2aaaac479000 r-xp 00000000 fd:00 12452057 /lib64/libdb-4.3.so
> is not realy garbage this look like to be the memory areas of a process.

No, it's not garbage, it's part of the error message that glibc produces
when it encounters the error in the subject.

- Build Cyrus with full debugging info and no optimization (-g3 -O0)
- export CYRUS_VERBOSE=50
- Start Cyrus
- Send a message through postfix that is known to trigger the bug
- You've now 15 seconds to attach to the newly created lmtpd process with
  gdb
- Let lmtpd continue until it crashes; post a full backtrace

Now, the bactrace will contain the location where the memory corruption
was _detected_, not where it had really occured, but that may still be
useful.

An other method would be to modify the "cmd=..." entry in cyrus.conf and
launch lmtpd inside valgrind. You still need to rebuild Cyrus with full
debugging info to get meaningful backtraces (use --num-callers=10 or
more), and it will be slow, but it has higher chance to catch the real
bug.

Gabor

-- 
     ---------------------------------------------------------
     MTA SZTAKI Computer and Automation Research Institute
                Hungarian Academy of Sciences
     ---------------------------------------------------------