mainSpamAssassin Milter Plugin - Support: sr #106348, spamass-milter crashes...

 
 

sr #106348: spamass-milter crashes intermittently

Submitter:  None
Submitted:  Mon 21 Apr 2008 03:31:21 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  4 - Important Status:  None
Privacy:  Public Assigned to:  None
Originator Email:  -email is unavailable- Open/Closed:  Open
Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 23 Apr 2008 08:53:44 PM UTC, comment #4: 

I don't see "smfi_setpriv failed" in my log files.

Thanks for the patch...

Tom Lynch <twlynch>
Wed 23 Apr 2008 04:22:34 PM UTC, comment #3: 

Bah. So the impossible happened.  https://www.milter.org/developers/overview#ControlFlow is pretty clear that xxfi_connect is called before xxfi_helo.  If mlfi_connect's call to smfi_setpriv fails, it returns an error code that should drop the connection, so there shouldn't ever be a way for mlfi_helo to be called with a null sctx variable.  If you check your sendmail log, do you see any errors saying "smfi_setpriv failed"?

The following patch should at least work around the problem:

Index: spamass-milter.cpp
===================================================================
RCS file: /cvsroot/spamass-milt/spamass-milt/spamass-milter.cpp,v
retrieving revision 1.91
diff -u -p -r1.91 spamass-milter.cpp
--- spamass-milter.cpp  24 Jul 2006 19:59:17 -0000      1.91
+++ spamass-milter.cpp  23 Apr 2008 16:14:22 -0000
@@ -756,6 +756,11 @@ mlfi_connect(SMFICTX * ctx, char *hostna
 sfsistat mlfi_helo(SMFICTX ctx, char helohost)
 {
        struct context sctx = (struct context)smfi_getpriv(ctx);
+       if (!sctx)
+       {
+               debug(D_ALWAYS, "mlfi_helo: sctx is NULL - cannot happen");
+               return SMFIS_TEMPFAIL;
+       }
        if (sctx->helo)
                free(sctx->helo);
        sctx->helo = strdup(helohost);

Dan Nelson <dnelson>
Group administrator
Tue 22 Apr 2008 05:58:55 PM UTC, comment #2: 

I rebuilt spamass-milter, here is the new back trace...

# /opt/csw/bin/gdb /usr/local/sbin/spamass-milter /core.spamass-milter.15124
GNU gdb 6.6
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "sparc-sun-solaris2.8"...
Reading symbols from /usr/lib/libmilter.so.1...done.
Loaded symbols for /usr/lib/libmilter.so.1
Reading symbols from /usr/lib/libresolv.so.2...done.
Loaded symbols for /usr/lib/libresolv.so.2
Reading symbols from /usr/lib/libsocket.so.1...done.
Loaded symbols for /usr/lib/libsocket.so.1
Reading symbols from /usr/lib/libnsl.so.1...done.
Loaded symbols for /usr/lib/libnsl.so.1
Reading symbols from /usr/local/lib/libstdc++.so.6...done.
Loaded symbols for /usr/local/lib/libstdc++.so.6
Reading symbols from /usr/lib/libm.so.2...done.
Loaded symbols for /usr/lib/libm.so.2
Reading symbols from /usr/local/lib/libgcc_s.so.1...done.
Loaded symbols for /usr/local/lib/libgcc_s.so.1
Reading symbols from /usr/lib/libc.so.1...done.
Loaded symbols for /usr/lib/libc.so.1
Reading symbols from /platform/SUNW,Sun-Fire-V240/lib/libc_psr.so.1...done.
Loaded symbols for /platform/SUNW,Sun-Fire-V240/lib/libc_psr.so.1
Reading symbols from /lib/ld.so.1...done.
Loaded symbols for /lib/ld.so.1
Core was generated by `/usr/local/sbin/spamass-milter -p /var/run/spamass.sock -f'.
Program terminated with signal 11, Segmentation fault.
#0  0x00016b90 in mlfi_helo (ctx=0x4b1d8, helohost=0x46538 "otiperezmaxpl") at spamass-milter.cpp:759
759             if (sctx->helo)
(gdb) print * sctx
Cannot access memory at address 0x0
(gdb)


Tom Lynch <twlynch>
Mon 21 Apr 2008 05:12:36 PM UTC, comment #1: 

$ echo _1cJmlfi_helo6FpnIsmfi_str_pc_i | c++filt
int mlfi_helo(smfi_str*,char*)

Unfortunately, mlfi_helo is just about the simplest function in the whole program:

sfsistat mlfi_helo(SMFICTX ctx, char helohost)
{
    struct context sctx = (struct context)smfi_getpriv(ctx);
    if (sctx->helo)
        free(sctx->helo);
    sctx->helo = strdup(helohost);

    return SMFIS_CONTINUE;
}

The only thing that could cause a segfault is if sctx was NULL, but that should be impossible.  mlfi_connect sets sctx, and should always be called before mlfi_helo.

Could you build spamass-milter with debugging symbols and get another backtrace with line number information?  Also run "print * sctx" within gdb so I can see the values inside it if it isn't NULL.

Dan Nelson <dnelson>
Group administrator
Mon 21 Apr 2008 03:31:21 PM UTC, original submission:  

I'm running spamass-milter 0.3.1 on Solaris 10 and sendmail 8.14.2. 
spamass-milter segfaults at least once per day.  Here is the bt...

Core was generated by `/opt/csw/sbin/spamass-milter -p /var/run/spamass.sock -f'.
Program terminated with signal 11, Segmentation fault.
#0  0x00018330 in _1cJmlfi_helo6FpnIsmfi_str_pc_i ()
(gdb) bt
#0  0x00018330 in _1cJmlfi_helo6FpnIsmfi_str_pc_i ()
#1  0x00023fb0 in mi_engine ()
#2  0x00021b4c in mi_handle_session ()
#3  0x00020ecc in ?? ()
#4  0x00020ecc in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb)

Any ideas on what is causing this?

Thanks,

Tom


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by twlynch (Posted a comment)
  • -email is unavailable- added by dnelson (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code