bugGNU Mailutils - Bugs: bug #39920, pop3d segfaults after sending...


bug #39920: pop3d segfaults after sending password

Submitted by:  Steven Robbins <smr99>
Submitted on:  Mon 02 Sep 2013 02:41:25 AM UTC  
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  Sergey Poznyakoff <gray>
Open/Closed:  Closed

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Tue 04 Feb 2014 11:21:29 AM UTC, comment #1:


Sergey Poznyakoff <gray>
Project AdministratorIn charge of this item.
Mon 02 Sep 2013 02:41:25 AM UTC, original submission:

Bug found in version 2.99.98

The pop3d daemon segfaults after receiving the USER and PASS commands. Below is a backtrace (password masked).

Program received signal SIGSEGV, Segmentation fault.
__strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:213
213 ../sysdeps/x86_64/multiarch/../strcmp.S: No such file or directory.
(gdb) bt
#0 __strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:213
#1 0x00007ffff65d38a8 in mu_authenticate_generic (return_data=0x0, key=0x5555557dd4d0, func_data=0x0, call_data=0x7fffffffe325) at system.c:108
#2 0x00007ffff65d2950 in mu_auth_runlist (flist=0x55555578bcd0, return_data=0x0, key=0x5555557dd4d0, data=0x7fffffffe325) at mu_auth.c:196
#3 0x00007ffff65d3056 in mu_authenticate (auth_data=0x5555557dd4d0, pass=0x7fffffffe325 "xxxxx") at mu_auth.c:297
#4 0x0000555555560be1 in pop3d_user (arg=0x7fffffffe5a5 "tanu", sess=0x7fffffffe590) at user.c:118
#5 0x000055555555f0c3 in pop3d_mainloop (ifd=0, ofd=1, tls=tls_no) at pop3d.c:426
#6 0x000055555555f9e3 in main (argc=1, argv=0x7fffffffe908) at pop3d.c:662

(gdb) up
#1 0x00007ffff65d38a8 in mu_authenticate_generic (return_data=0x0, key=0x5555557ded90, func_data=0x0, call_data=0x7fffffffe325) at system.c:108
108 && strcmp (auth_data->passwd, crypt (pass, auth_data->passwd)) == 0 ?
(gdb) p auth_data->passwd
$4 = 0x5555557dede5 "x"

Note that my system uses shadow passwords, hence the 'x'. The problem is that the crypt() call in system.c line 108 returns NULL, so the strcmp() naturally segfaults.

See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=720060 for a patch.

Steven Robbins <smr99>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by gray (Posted a comment)
  • -email is unavailable- added by smr99 (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-02-04 gray StatusNone => Fixed
        Assigned toNone => gray
        Open/ClosedOpen => Closed

    Back to the top

    Powered by Savane 3.3