Mon 02 Sep 2013 02:41:25 AM UTC, original submission:
Bug found in version 2.99.98
The pop3d daemon segfaults after receiving the USER and PASS commands. Below is a backtrace (password masked).
Program received signal SIGSEGV, Segmentation fault.
__strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:213
213 ../sysdeps/x86_64/multiarch/../strcmp.S: No such file or directory.
(gdb) bt
#0 __strcmp_ssse3 () at ../sysdeps/x86_64/multiarch/../strcmp.S:213
#1 0x00007ffff65d38a8 in mu_authenticate_generic (return_data=0x0, key=0x5555557dd4d0, func_data=0x0, call_data=0x7fffffffe325) at system.c:108
#2 0x00007ffff65d2950 in mu_auth_runlist (flist=0x55555578bcd0, return_data=0x0, key=0x5555557dd4d0, data=0x7fffffffe325) at mu_auth.c:196
#3 0x00007ffff65d3056 in mu_authenticate (auth_data=0x5555557dd4d0, pass=0x7fffffffe325 "xxxxx") at mu_auth.c:297
#4 0x0000555555560be1 in pop3d_user (arg=0x7fffffffe5a5 "tanu", sess=0x7fffffffe590) at user.c:118
#5 0x000055555555f0c3 in pop3d_mainloop (ifd=0, ofd=1, tls=tls_no) at pop3d.c:426
#6 0x000055555555f9e3 in main (argc=1, argv=0x7fffffffe908) at pop3d.c:662
(gdb) up
#1 0x00007ffff65d38a8 in mu_authenticate_generic (return_data=0x0, key=0x5555557ded90, func_data=0x0, call_data=0x7fffffffe325) at system.c:108
108 && strcmp (auth_data->passwd, crypt (pass, auth_data->passwd)) == 0 ?
(gdb) p auth_data->passwd
$4 = 0x5555557dede5 "x"
Note that my system uses shadow passwords, hence the 'x'. The problem is that the crypt() call in system.c line 108 returns NULL, so the strcmp() naturally segfaults.
See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=720060 for a patch.
|