bugThe nmh Mail Handling System - Bugs: bug #21903, comp,forw crash on OpenBSD...

 
 

bug #21903: comp,forw crash on OpenBSD 4.2-current

Submitted by:  None
Submitted on:  Fri 28 Dec 2007 08:42:17 PM UTC  
 
Category: BugSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Assigned to: NoneOpen/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 16 Apr 2012 03:23:00 PM UTC, comment #2:

I fixed this in c915e11a95bdfb6157eecc81c5df82de65c86796. The original diagnosis was correct, but it only got triggered when you used a draft folder. AFAICT it's always been a problem and comp/forw always trigger it if your draft folder is empty. Strangely enough the addition of readline support was what did it; the malloc pool was getting corrupted but nothing else used malloc so we never noticed ... until we started using readline.

(Peter, you had 350 draft messages? Wow :-) ).

Ken Hornstein <kenh>
Project Administrator
Sat 05 Apr 2008 10:14:21 PM UTC, comment #1:

I can't reproduce this (I tried using valgrind on Linux, which should also catch this kind of bug).

I don't think that your fix is in the right place -- clear_sequence() etc shouldn't be being used with an out of range message number at all.

I think the actual problem is that somehow seq_addmsg() is being called with msgnum equal to zero. 0 isn't a valid message number.

I can't reproduce this (I tried using valgrind, which should also catch this kind of bug, and anyway for me seq_addmsg() is called with 350 (which happens to be the next spare slot in my drafts folder).) Can you give more details? For instance, does it happen if you set up a completely fresh nmh setup for a new user? (ie is there something odd in your .mh_profile or in one of your mail folders which is triggering this?)

Peter Maydell <pm215>
Project Administrator
Fri 28 Dec 2007 08:42:17 PM UTC, original submission:

The comp and forw commands (possibly others) crash with a segfault on OpenBSD 4.2-current. gdb led me to seq_add.c where it had died in the clear_sequence() call.

The problem appears to me that msgnum is zero but mp->lowoff is one, hence the attempt to access mp->msgstats[-1]. OpenBSD's malloc traps this sort of thing by adding guard-pages.

My fix is to add msg_ok() macro in mh.h, then have every macro that references mp->msgstats[] to make sure the index will be in the allocated space. Admittedly, this is a workaround to a more fundamental design problem, but it gets things running again which is no bad thing.

My modified mh.h file is attached.

-- Parag Patel <parag@codegen.com>

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #14719:  mh.h added by None (11KiB - text/plain - Modified mh.h to check for out-of-range on mp->msgstats[] accesses)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by kenh (Posted a comment)
  • -unavailable- added by pm215 (Posted a comment)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 16 Apr 2012 03:23:00 PM UTCkenhStatusNone=>Fixed
      Open/ClosedOpen=>Closed
    Mon 29 Dec 2008 10:40:06 PM UTCpm215CategoryNone=>Bug
    Fri 28 Dec 2007 08:42:18 PM UTCNoneAttached File-=>Added mh.h, #14719

    Back to the top


    Powered by Savane 3.1-cleanup1