lmtpd segfaults after update to 2.4.19, seems it wants to act as proxy

[Simon Matter]

Hi,

I'm resending this with new subject and one again attached the straces of
a delivery with 2.4.18 and 2.4.19.

>>> I've just updated our cyrus-imapd rpms from 2.4.18 -> 2.4.19. All
seems well with just some small changes to the build.
>>>
>>> However, I just can't get it to work: lmtpd segfaults on mail delivery.
>>>
>>> The logs show something like this:
>>> May 17 14:21:42 mh1 kernel: lmtpd[7433]: segfault at 5ebc24d7 ip
00007f216292973b sp 00007ffe5ebc1f58 error 4 in
>>> lmtpd[7f21628c1000+169000]
>>> May 17 14:21:42 mh1 master[7423]: process 7433 exited, signaled to death
>>> by 11
>>>
>>> First I've rebuilt without some of the custom patches in the package like
>>> the autocreate patches. But without a change.
>>>
>>> I've then straced an lmtpd during mail delivery, once with 2.4.18 and
once
>>> with 2.4.19 in the hope to find something. The traces are attached.
>>>
>>> I see that there were quite some change concerning lmtp, does anyone
of the developers have an idea where the problem in lmtpd changes
could be?
>>
>> It turns out that lmtpd wants to act as proxy, because only then it
creates the spoolfile in /tmp/. But why?
>> Regards,
>> Simon
>>
>
> Are you running a murder setup? Can you produce a coredump and brovide a
backtrace with symbols loaded?

Hi,

I did two things meanwhile:

1) Built a completely vanilla cyrus-imapd-2.4.19 without any patches to
make sure it's not anything wrong with additional patches. The crash was
the same.

2) Ran the normal build with an unstripped "lmtpd" binary and produced
core and backtrace. So below:

Core was generated by `lmtpd'.
Program terminated with signal 11, Segmentation fault.
#0  strlcpy (dst=0x7ffaa64e00d0 "", src=0x5d73c6c7 <Address 0x5d73c6c7 out
of bounds>, len=1024) at xstrlcpy.c:65
65		if ((dst[n] = src[n]) == '\0') break;
Missing separate debuginfos, use: debuginfo-install
cyrus-sasl-gssapi-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-lib-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-md5-2.1.23-15.el6_6.2.x86_64
cyrus-sasl-plain-2.1.23-15.el6_6.2.x86_64 db4-4.7.25-22.el6.x86_64
glibc-2.12-1.209.el6_9.1.x86_64 keyutils-libs-1.4-5.el6.x86_64
krb5-libs-1.10.3-65.el6.x86_64 libcom_err-1.41.12-23.el6.x86_64
libselinux-2.0.94-7.el6.x86_64 nss-softokn-freebl-3.14.3-23.3.el6_8.x86_64
openssl-1.0.1e-57.el6.x86_64 pcre-7.8-7.el6.x86_64
tcp_wrappers-libs-7.6-58.el6.x86_64 zlib-1.2.3-29.el6.x86_64
(gdb) bt
#0  strlcpy (dst=0x7ffaa64e00d0 "", src=0x5d73c6c7 <Address 0x5d73c6c7 out
of bounds>, len=1024) at xstrlcpy.c:65
#1  0x00007ffaa5150c2e in proxy_adddest (dlist=0x7ffc5d73c288,
rcpt=0x7ffaa64d26d0 "simix at imap.bi.corp.invoca.ch", rcpt_num=0,
server=0x5d73c6c7 <Address 0x5d73c6c7 out of bounds>, authas=0x0) at
proxy.c:81
#2  0x00007ffaa514fbae in deliver (msgdata=0x7ffaa64d0950, authuser=0x0,
authstate=0x7ffc5d73c280) at lmtpd.c:749
#3  0x00007ffaa5152f41 in lmtpmode (func=0x7ffaa54b0020, pin=<value
optimized out>, pout=0x7ffaa64cf850, fd=<value optimized out>) at
lmtpengine.c:1325
#4  0x00007ffaa514f4ec in service_main (argc=1, argv=0x7ffaa64c9010,
envp=<value optimized out>) at lmtpd.c:282
#5  0x00007ffaa514dd95 in main (argc=<value optimized out>, argv=<value
optimized out>, envp=0x7ffc5d740718) at service.c:585


The imapd.conf used for the test was:
configdirectory: /var/lib/imap
partition-default: /var/spool/imap
admins: cyrus
sievedir: /var/lib/imap/sieve
sendmail: /usr/sbin/sendmail
hashimapspool: true
sasl_pwcheck_method: saslauthd
sasl_mech_list: PLAIN
tls_cert_file: /etc/pki/cyrus-imapd/cyrus-imapd.pem
tls_key_file: /etc/pki/cyrus-imapd/cyrus-imapd.pem
tls_ca_file: /etc/pki/tls/certs/ca-bundle.crt
sieve_maxscriptsize: 128
allowplaintext: 1
delete_mode: delayed
expunge_mode: delayed
flushseenstate: 1
lmtp_strict_rfc2821: 0
mboxname_lockpath: {configdirectory}/volatile/lock
proc_path: {configdirectory}/volatile/proc
statuscache_db_path: {configdirectory}/volatile/statuscache.db
tlscache_db_path: {configdirectory}/volatile/tls_sessions.db

Any help would be much appreaciated!

Regards,
Simon
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: strace-2.4.18.txt
URL: <http://lists.andrew.cmu.edu/pipermail/info-cyrus/attachments/20170519/2ee37e8d/attachment-0002.txt>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: strace-2.4.19.txt
URL: <http://lists.andrew.cmu.edu/pipermail/info-cyrus/attachments/20170519/2ee37e8d/attachment-0003.txt>