sync_server crashing..

[Andy Fiddaman]

Hi,

I'm hoping that someone who is familiar with the replication code can
help me with a problem I'm seeing with Cyrus 2.3.12.

I have a two server replicated setup and sync_server is occasionally
crashing. Once it's crashed once it keeps on crashing until I completely
reset replication by snapshotting the master, removing the sync logs
and rsyncing the snapshot to the replica.

The crash is happening in sync_cacheitem_size()

Core was generated by `sync_server'.
Program terminated with signal 11, Segmentation fault.
[New process 71345    ]
#0  0x0000000100020204 in sync_cacheitem_size (
    cacheitem=0xffffffff97db9528 <Address 0xffffffff97db9528 out of bounds>)
    at sync_commit.c:330
330             cacheitem = CACHE_ITEM_NEXT(cacheitem);
(gdb) print cacheitem
$1 = 0xffffffff97db9528 <Address 0xffffffff97db9528 out of bounds>
(gdb) print cacheitembegin
$3 = 0xffffffff778b22bc " Prestige\" ((\"del philippe\" NIL \"rangely\"
\"domain.net\")) ((\"del philippe\" NIL \"rangely\" \"domain.net\")) ((\"del
philippe\" NIL \"rangely\" \"domain.net\")) ((NIL NIL \"jagood\"
\"domain.co.uk\")) NIL NIL NIL \"<000901c8a8b9$03fade7f$848e5f90 at dnmqfv>\")"

I've added some debug lines to the function to print out the item length
and item text for each cache item traversed. When it crashes I get something
like the following:

itemlen=407
item=[("Thu, 19 May 2016 15:20:46 +0800" "=?GB2312?B?c2FsZXPXqs/6ytuyvw==?=" (("=?GB2312?B?06rP+teovNIttPLU7MTjtcTNu8bGwaY=?=" NIL "osjdhk" "gokceada.com")) (("=?GB2312?B?06rP+teovNIttPLU7MTjtcTNu8bGwaY=?=" NIL "osjdhk" "gokceada.com")) (("=?GB2312?B?06rP+teovNIttPLU7MTjtcTNu8bGwaY=?=" NIL "osjdhk" "gokceada.com")) ((NIL NIL "sales" "somedomai.co.uk")) NIL NIL NIL "<200705190728.l4J7Sk8X005881 at myserver1.net>")]
itemlen=77
item=[("TEXT" "PLAIN" ("CHARSET" "GB2312") NIL NIL "7BIT" 5267 179 NIL NIL NIL NIL)]
itemlen=61
item=[("TEXT" "PLAIN" ("CHARSET" "GB2312") NIL NIL "7BIT" 5267 179)]
itemlen=48
item=[]
itemlen=166
item=[Message-Id: <200705190728.l4J7Sk8X005881 at myserver1.net>^M
itemlen=56
item=[\350\220\245\351\224\200\344\270\223\345\256\266-\346\211\223\351\200\240\344\275\240\347\232\204\347\252\201\347\240\264\345\212\233 <osjdhk at gokceada.com>]
itemlen=23
item=[<sales at somedomai.co.uk>]
itemlen=0
item=[]
itemlen=0
item=[]
itemlen=23
item=[{17}^M
itemlen=468
item=[("Thu, 19 May 2016 17:28:11 +0800" ...

over 8000 more lines, then:

itemlen=1313426464
item=[NIL "7BIT" 475 16 NIL NIL NIL NIL)("TEXT" "HTML" ("CHARSET" "Windows-1252") NIL NIL "QUOTED-PRINTABLE" 1760 55 NIL NIL NIL NIL) "ALTERNATIVE" ("BOUNDARY" "----=_NextPart_000_0006_01C8A94A.CC9C2B80") NIL NIL NIL)]

This last itemlen pushes the pointer out of the allocated memory and
causes the crash.

Any ideas on whether these entries look right and where I should look next
to debug it?

Thanks,

Andy