lmtpd segfaults after update to 2.4.19, seems it wants to act as proxy

[Michael Menge]

Quoting Simon Matter <simon.matter at invoca.ch>:

> Hi,
>
> I'm resending this with new subject and one again attached the straces of
> a delivery with 2.4.18 and 2.4.19.
>
>>>> I've just updated our cyrus-imapd rpms from 2.4.18 -> 2.4.19. All
> seems well with just some small changes to the build.
>>>>
>>>> However, I just can't get it to work: lmtpd segfaults on mail delivery.
>>>>
>>>> The logs show something like this:
>>>> May 17 14:21:42 mh1 kernel: lmtpd[7433]: segfault at 5ebc24d7 ip
> 00007f216292973b sp 00007ffe5ebc1f58 error 4 in
>>>> lmtpd[7f21628c1000+169000]
>>>> May 17 14:21:42 mh1 master[7423]: process 7433 exited, signaled to death
>>>> by 11
>>>>
>>>> First I've rebuilt without some of the custom patches in the package like
>>>> the autocreate patches. But without a change.
>>>>
>>>> I've then straced an lmtpd during mail delivery, once with 2.4.18 and
> once
>>>> with 2.4.19 in the hope to find something. The traces are attached.
>>>>
>>>> I see that there were quite some change concerning lmtp, does anyone
> of the developers have an idea where the problem in lmtpd changes
> could be?
>>>
>>> It turns out that lmtpd wants to act as proxy, because only then it
> creates the spoolfile in /tmp/. But why?
>>> Regards,
>>> Simon
>>>
>>
>> Are you running a murder setup? Can you produce a coredump and brovide a
> backtrace with symbols loaded?
>
> Hi,
>
> I did two things meanwhile:
>
> 1) Built a completely vanilla cyrus-imapd-2.4.19 without any patches to
> make sure it's not anything wrong with additional patches. The crash was
> the same.
>
> 2) Ran the normal build with an unstripped "lmtpd" binary and produced
> core and backtrace. So below:
>
> Core was generated by `lmtpd'.
> Program terminated with signal 11, Segmentation fault.
> #0  strlcpy (dst=0x7ffaa64e00d0 "", src=0x5d73c6c7 <Address 0x5d73c6c7 out
> of bounds>, len=1024) at xstrlcpy.c:65
> 65		if ((dst[n] = src[n]) == '\0') break;
> Missing separate debuginfos, use: debuginfo-install
> cyrus-sasl-gssapi-2.1.23-15.el6_6.2.x86_64
> cyrus-sasl-lib-2.1.23-15.el6_6.2.x86_64
> cyrus-sasl-md5-2.1.23-15.el6_6.2.x86_64
> cyrus-sasl-plain-2.1.23-15.el6_6.2.x86_64 db4-4.7.25-22.el6.x86_64
> glibc-2.12-1.209.el6_9.1.x86_64 keyutils-libs-1.4-5.el6.x86_64
> krb5-libs-1.10.3-65.el6.x86_64 libcom_err-1.41.12-23.el6.x86_64
> libselinux-2.0.94-7.el6.x86_64 nss-softokn-freebl-3.14.3-23.3.el6_8.x86_64
> openssl-1.0.1e-57.el6.x86_64 pcre-7.8-7.el6.x86_64
> tcp_wrappers-libs-7.6-58.el6.x86_64 zlib-1.2.3-29.el6.x86_64
> (gdb) bt
> #0  strlcpy (dst=0x7ffaa64e00d0 "", src=0x5d73c6c7 <Address 0x5d73c6c7 out
> of bounds>, len=1024) at xstrlcpy.c:65
> #1  0x00007ffaa5150c2e in proxy_adddest (dlist=0x7ffc5d73c288,
> rcpt=0x7ffaa64d26d0 "simix at imap.bi.corp.invoca.ch", rcpt_num=0,
> server=0x5d73c6c7 <Address 0x5d73c6c7 out of bounds>, authas=0x0) at
> proxy.c:81

here the bt is already in the wrong path and server has not been set
wich leads to the SIGSEV

> #2  0x00007ffaa514fbae in deliver (msgdata=0x7ffaa64d0950, authuser=0x0,
> authstate=0x7ffc5d73c280) at lmtpd.c:749

This is the point where the wrong path is taken.


r = mlookup(namebuf, &server, NULL, NULL);
if (!r && server) {
     /* remote mailbox */
     proxy_adddest(&dlist, rcpt, n, server, authuser);
     status[n] = nosieve;
}

mlookup did return something that is not 0, and server has not been set
in mlookup. In 2.4.17 there has was "if (server) *server = NULL;"

proxy_adddest sould only be called if the mailbox is a remote mailbox,
possible other cases are IMAP_IOERROR, IMAP_MAILBOX_RESERVED,  
IMAP_MAILBOX_MOVED
IMAP_MAILBOX_NONEXISTENT


> Any help would be much appreaciated!
>



--------------------------------------------------------------------------------
M.Menge                                Tel.: (49) 7071/29-70316
Universität Tübingen                   Fax.: (49) 7071/29-5912
Zentrum für Datenverarbeitung          mail:  
michael.menge at zdv.uni-tuebingen.de
Wächterstraße 76
72074 Tübingen