bugGNU Mailutils - Bugs: bug #39920, pop3d segfaults after sending...

 
 

bug #39920: pop3d segfaults after sending password

Submitted by:  Steven Robbins <smr99>
Submitted on:  Mon 02 Sep 2013 02:41:25 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Sergey Poznyakoff <gray>
Open/Closed: Closed

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 04 Feb 2014 11:21:29 AM UTC, comment #1:

Thanks.

Sergey Poznyakoff <gray>
Project AdministratorIn charge of this item.
Mon 02 Sep 2013 02:41:25 AM UTC, original submission:

Bug found in version 2.99.98

The pop3d daemon segfaults after receiving the USER and PASS commands. Below is a backtrace (password masked).

Program received signal SIGSEGV, Segmentation fault.
__strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:213
213 ../sysdeps/x86_64/multiarch/../strcmp.S: No such file or directory.
(gdb) bt
#0 __strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:213
#1 0x00007ffff65d38a8 in mu_authenticate_generic (return_data=0x0, key=0x5555557dd4d0, func_data=0x0, call_data=0x7fffffffe325) at system.c:108
#2 0x00007ffff65d2950 in mu_auth_runlist (flist=0x55555578bcd0, return_data=0x0, key=0x5555557dd4d0, data=0x7fffffffe325) at mu_auth.c:196
#3 0x00007ffff65d3056 in mu_authenticate (auth_data=0x5555557dd4d0, pass=0x7fffffffe325 "xxxxx") at mu_auth.c:297
#4 0x0000555555560be1 in pop3d_user (arg=0x7fffffffe5a5 "tanu", sess=0x7fffffffe590) at user.c:118
#5 0x000055555555f0c3 in pop3d_mainloop (ifd=0, ofd=1, tls=tls_no) at pop3d.c:426
#6 0x000055555555f9e3 in main (argc=1, argv=0x7fffffffe908) at pop3d.c:662

(gdb) up
#1 0x00007ffff65d38a8 in mu_authenticate_generic (return_data=0x0, key=0x5555557ded90, func_data=0x0, call_data=0x7fffffffe325) at system.c:108
108 && strcmp (auth_data->passwd, crypt (pass, auth_data->passwd)) == 0 ?
(gdb) p auth_data->passwd
$4 = 0x5555557dede5 "x"

Note that my system uses shadow passwords, hence the 'x'. The problem is that the crypt() call in system.c line 108 returns NULL, so the strcmp() naturally segfaults.

See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=720060 for a patch.

Steven Robbins <smr99>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gray (Posted a comment)
  • -unavailable- added by smr99 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 04 Feb 2014 11:21:29 AM UTCgrayStatusNone=>Fixed
      Assigned toNone=>gray
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup