bugGNU Mailutils - Bugs: bug #39920, pop3d segfaults after sending...

 
 

bug #39920: pop3d segfaults after sending password

Submitter:  Steven Robbins <smr99>
Submitted:  Mon 02 Sep 2013 02:41:25 AM UTC
   
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  Fixed Privacy:  Public
Assigned to:  gray Open/Closed:  Closed
* Mandatory Fields

Post a Comment

Add a New Comment Rich Markup
   

Discussion

Tue 04 Feb 2014 11:21:29 AM UTC, comment #1: 

Thanks.

Sergey Poznyakoff <gray>
Group administrator
Mon 02 Sep 2013 02:41:25 AM UTC, original submission:  

Bug found in version 2.99.98

The pop3d daemon segfaults after receiving the USER and PASS commands. Below is a backtrace (password masked).

Program received signal SIGSEGV, Segmentation fault.
__strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:213
213     ../sysdeps/x86_64/multiarch/../strcmp.S: No such file or directory.
(gdb) bt
#0  __strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:213
#1  0x00007ffff65d38a8 in mu_authenticate_generic (return_data=0x0, key=0x5555557dd4d0, func_data=0x0, call_data=0x7fffffffe325) at system.c:108
#2  0x00007ffff65d2950 in mu_auth_runlist (flist=0x55555578bcd0, return_data=0x0, key=0x5555557dd4d0, data=0x7fffffffe325) at mu_auth.c:196
#3  0x00007ffff65d3056 in mu_authenticate (auth_data=0x5555557dd4d0, pass=0x7fffffffe325 "xxxxx") at mu_auth.c:297
#4  0x0000555555560be1 in pop3d_user (arg=0x7fffffffe5a5 "tanu", sess=0x7fffffffe590) at user.c:118
#5  0x000055555555f0c3 in pop3d_mainloop (ifd=0, ofd=1, tls=tls_no) at pop3d.c:426
#6  0x000055555555f9e3 in main (argc=1, argv=0x7fffffffe908) at pop3d.c:662

(gdb) up
#1  0x00007ffff65d38a8 in mu_authenticate_generic (return_data=0x0, key=0x5555557ded90, func_data=0x0, call_data=0x7fffffffe325) at system.c:108
108              && strcmp (auth_data->passwd, crypt (pass, auth_data->passwd)) == 0 ?
(gdb) p auth_data->passwd
$4 = 0x5555557dede5 "x"


Note that my system uses shadow passwords, hence the 'x'.  The problem is that the crypt() call in system.c line 108 returns NULL, so the strcmp() naturally segfaults.

See http://bugs.debia ... rt.cgi?bug=720060 for a patch.

Steven Robbins <smr99>

 

Attached Files

This item currently has no attached files.

(Note: upload size limit is set to 4.0MiB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

Carbon-Copy List
  • -email is unavailable- added by gray (Posted a comment)
  • -email is unavailable- added by smr99 (Submitted the item)
  •  

    Votes

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

    History

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-02-04 gray StatusNone Fixed
        Assigned toNone gray
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.16-a7ba.
    Corresponding source code