bugGNU Mailutils - Bugs: bug #39920, pop3d segfaults after sending...

 
 

bug #39920: pop3d segfaults after sending password

Submitter:  Steven Robbins <smr99>
Submitted:  Mon 02 Sep 2013 02:41:25 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  gray
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 04 Feb 2014 11:21:29 AM UTC, comment #1: 

Thanks.

Sergey Poznyakoff <gray>
Group administrator
Mon 02 Sep 2013 02:41:25 AM UTC, original submission:  

Bug found in version 2.99.98

The pop3d daemon segfaults after receiving the USER and PASS commands. Below is a backtrace (password masked).

Program received signal SIGSEGV, Segmentation fault.
__strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:213
213     ../sysdeps/x86_64/multiarch/../strcmp.S: No such file or directory.
(gdb) bt
#0  __strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:213
#1  0x00007ffff65d38a8 in mu_authenticate_generic (return_data=0x0, key=0x5555557dd4d0, func_data=0x0, call_data=0x7fffffffe325) at system.c:108
#2  0x00007ffff65d2950 in mu_auth_runlist (flist=0x55555578bcd0, return_data=0x0, key=0x5555557dd4d0, data=0x7fffffffe325) at mu_auth.c:196
#3  0x00007ffff65d3056 in mu_authenticate (auth_data=0x5555557dd4d0, pass=0x7fffffffe325 "xxxxx") at mu_auth.c:297
#4  0x0000555555560be1 in pop3d_user (arg=0x7fffffffe5a5 "tanu", sess=0x7fffffffe590) at user.c:118
#5  0x000055555555f0c3 in pop3d_mainloop (ifd=0, ofd=1, tls=tls_no) at pop3d.c:426
#6  0x000055555555f9e3 in main (argc=1, argv=0x7fffffffe908) at pop3d.c:662

(gdb) up
#1  0x00007ffff65d38a8 in mu_authenticate_generic (return_data=0x0, key=0x5555557ded90, func_data=0x0, call_data=0x7fffffffe325) at system.c:108
108              && strcmp (auth_data->passwd, crypt (pass, auth_data->passwd)) == 0 ?
(gdb) p auth_data->passwd
$4 = 0x5555557dede5 "x"


Note that my system uses shadow passwords, hence the 'x'.  The problem is that the crypt() call in system.c line 108 returns NULL, so the strcmp() naturally segfaults.

See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=720060 for a patch.

Steven Robbins <smr99>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gray (Posted a comment)
  • -email is unavailable- added by smr99 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-02-04 gray StatusNone Fixed
        Assigned toNone gray
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code