helpSpamAssassin Milter Plugin - Support: sr #106348, spamass-milter crashes...

 
 

sr #106348: spamass-milter crashes intermittently

Submitted by:  None
Submitted on:  Mon 21 Apr 2008 03:31:21 PM UTC  
 
Category: NonePriority: 5 - Normal
Severity: 4 - ImportantStatus: None
Privacy: PublicAssigned to: None
Originator Email: -unavailable-Open/Closed: Open
Operating System: None

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 23 Apr 2008 08:53:44 PM UTC, comment #4:

I don't see "smfi_setpriv failed" in my log files.

Thanks for the patch...

Tom Lynch <twlynch>
Wed 23 Apr 2008 04:22:34 PM UTC, comment #3:

Bah. So the impossible happened. https://www.milter.org/developers/overview#ControlFlow is pretty clear that xxfi_connect is called before xxfi_helo. If mlfi_connect's call to smfi_setpriv fails, it returns an error code that should drop the connection, so there shouldn't ever be a way for mlfi_helo to be called with a null sctx variable. If you check your sendmail log, do you see any errors saying "smfi_setpriv failed"?

The following patch should at least work around the problem:

Index: spamass-milter.cpp
===================================================================
RCS file: /cvsroot/spamass-milt/spamass-milt/spamass-milter.cpp,v
retrieving revision 1.91
diff -u -p -r1.91 spamass-milter.cpp
--- spamass-milter.cpp 24 Jul 2006 19:59:17 -0000 1.91
+++ spamass-milter.cpp 23 Apr 2008 16:14:22 -0000
@@ -756,6 +756,11 @@ mlfi_connect(SMFICTX * ctx, char *hostna
sfsistat mlfi_helo(SMFICTX * ctx, char * helohost)
{
struct context sctx = (struct context)smfi_getpriv(ctx);
+ if (!sctx)
+ {
+ debug(D_ALWAYS, "mlfi_helo: sctx is NULL - cannot happen");
+ return SMFIS_TEMPFAIL;
+ }
if (sctx->helo)
free(sctx->helo);
sctx->helo = strdup(helohost);

Dan Nelson <dnelson>
Project Administrator
Tue 22 Apr 2008 05:58:55 PM UTC, comment #2:

I rebuilt spamass-milter, here is the new back trace...

# /opt/csw/bin/gdb /usr/local/sbin/spamass-milter /core.spamass-milter.15124
GNU gdb 6.6
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "sparc-sun-solaris2.8"...
Reading symbols from /usr/lib/libmilter.so.1...done.
Loaded symbols for /usr/lib/libmilter.so.1
Reading symbols from /usr/lib/libresolv.so.2...done.
Loaded symbols for /usr/lib/libresolv.so.2
Reading symbols from /usr/lib/libsocket.so.1...done.
Loaded symbols for /usr/lib/libsocket.so.1
Reading symbols from /usr/lib/libnsl.so.1...done.
Loaded symbols for /usr/lib/libnsl.so.1
Reading symbols from /usr/local/lib/libstdc++.so.6...done.
Loaded symbols for /usr/local/lib/libstdc++.so.6
Reading symbols from /usr/lib/libm.so.2...done.
Loaded symbols for /usr/lib/libm.so.2
Reading symbols from /usr/local/lib/libgcc_s.so.1...done.
Loaded symbols for /usr/local/lib/libgcc_s.so.1
Reading symbols from /usr/lib/libc.so.1...done.
Loaded symbols for /usr/lib/libc.so.1
Reading symbols from /platform/SUNW,Sun-Fire-V240/lib/libc_psr.so.1...done.
Loaded symbols for /platform/SUNW,Sun-Fire-V240/lib/libc_psr.so.1
Reading symbols from /lib/ld.so.1...done.
Loaded symbols for /lib/ld.so.1
Core was generated by `/usr/local/sbin/spamass-milter -p /var/run/spamass.sock -f'.
Program terminated with signal 11, Segmentation fault.
#0 0x00016b90 in mlfi_helo (ctx=0x4b1d8, helohost=0x46538 "otiperezmaxpl") at spamass-milter.cpp:759
759 if (sctx->helo)
(gdb) print * sctx
Cannot access memory at address 0x0
(gdb)

Tom Lynch <twlynch>
Mon 21 Apr 2008 05:12:36 PM UTC, comment #1:

$ echo _1cJmlfi_helo6FpnIsmfi_str_pc_i | c++filt
int mlfi_helo(smfi_str,char)

Unfortunately, mlfi_helo is just about the simplest function in the whole program:

sfsistat mlfi_helo(SMFICTX * ctx, char * helohost)
{
struct context sctx = (struct context)smfi_getpriv(ctx);
if (sctx->helo)
free(sctx->helo);
sctx->helo = strdup(helohost);

return SMFIS_CONTINUE;
}

The only thing that could cause a segfault is if sctx was NULL, but that should be impossible. mlfi_connect sets sctx, and should always be called before mlfi_helo.

Could you build spamass-milter with debugging symbols and get another backtrace with line number information? Also run "print * sctx" within gdb so I can see the values inside it if it isn't NULL.

Dan Nelson <dnelson>
Project Administrator
Mon 21 Apr 2008 03:31:21 PM UTC, original submission:

I'm running spamass-milter 0.3.1 on Solaris 10 and sendmail 8.14.2.
spamass-milter segfaults at least once per day. Here is the bt...

Core was generated by `/opt/csw/sbin/spamass-milter -p /var/run/spamass.sock -f'.
Program terminated with signal 11, Segmentation fault.
#0 0x00018330 in _1cJmlfi_helo6FpnIsmfi_str_pc_i ()
(gdb) bt
#0 0x00018330 in _1cJmlfi_helo6FpnIsmfi_str_pc_i ()
#1 0x00023fb0 in mi_engine ()
#2 0x00021b4c in mi_handle_session ()
#3 0x00020ecc in ?? ()
#4 0x00020ecc in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb)

Any ideas on what is causing this?

Thanks,

Tom

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by twlynch (Posted a comment)
  • -unavailable- added by dnelson (Posted a comment)
  • -unavailable- added by None (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    No Changes Have Been Made to This Item

    Back to the top


    Powered by Savane 3.1-cleanup