[Dovecot] test65 killed by SIGSEV

[Thomas Hummel]

Hi,

I had successfully set up dovecot-1.0-test62 + ldap pass/user db, but
now I'm encoutering a SIGSEV problem with a similar set up of a brand
new dovecot-1.0-test65 installation.

The auth process is killed by a SIGSEV as reported in the error log file :

  dovecot: Mar 30 17:06:59 Error: child 28291 (auth) killed with signal 11

To be precise, the problem occurs in the 

  "ldap_lookup_pass" function (auth/passdb-ldap.c) 

just before loging the ldap request parameters
(auth_request_log_debug) and to actually perform the search
(db_ldap_search). The signal occurs on the call of
t_strarray_join(attr_names, ",")

What I'm observing is that the "attr_names" array of the
"passdb_ldap_conn" ldap connection doesn't seem to hold the right
attributes : while in the test62 version it holded 'uid' and
'userPassword', it holds now 'uid' and 'homeDirectory'. As a matter of
fact, the content of this array seem to change between the "preinit"
and "init" passdb function and I'm not quite sure this is legal.

So my client (actually just a test through telnet) gets a 'NO
Temporary authentication failure'.

Here's a gdb backtrace of the process :

-------
Program received signal SIGSEGV, Segmentation fault.
0x08065bf6 in t_strarray_join (arr=0x807aa20, separator=0x8067b1a ",")
    at strfuncs.c:571
571                     len = strlen(*arr);
(gdb) bt full
#0  0x08065bf6 in t_strarray_join (arr=0x807aa20, separator=0x8067b1a ",")
    at strfuncs.c:571
        alloc_len = 8
        sep_len = 1
        len = 9
        pos = 39
        needed_space = 0
        str = 0x806e488 "uid,homeDirectory,,,uidNumber,gidNumber"
#1  0x080578a1 in ldap_lookup_pass (auth_request=0x8077a10, 
    ldap_request=0x8077ab0) at passdb-ldap.c:181
        conn = (struct ldap_connection *) 0x807a810
        vars = (const struct var_expand_table *) 0x807a9a0
        attr_names = (const char **) 0x807aa08
        filter = 0x806e268 "(&(objectClass=posixAccount)(uid=dovetest))"
        base = 0x806e468 "ou=personnes, dc=pasteur, dc=fr"
        str = (string_t *) 0x806e268
#2  0x08050947 in auth_request_verify_plain (request=0x8077a10, 
    password=0x806e198 "pass", callback=0x8054790 <verify_callback>)
    at auth-request.c:261
        passdb = (struct passdb_module *) 0x806b9e0
        result = -1077941592
        cache_key = 0x646975 <Error reading address 0x646975: Bad address>
        __PRETTY_FUNCTION__ = "auth_request_verify_plain"
---Type <return> to continue, or q <return> to quit---
#3  0x0805486e in mech_plain_auth_continue (request=0x8077a10, 
    data=0xffffffff <Error reading address 0xffffffff: Bad address>, 
    data_size=6580597) at mech-plain.c:62
        authenid = 0x806e181 "dovetest"
        error = 0xbfbfeaf8 "(ë¿¿²ø\004\b\020@\b\b\034\020\b\b(ë¿¿dø\004\b\002"
        pass = 0x806e198 "pass"
        i = 0
        count = 2
#4  0x08051a80 in auth_request_handler_auth_begin (handler=0x8084010, 
    args=0x808101c "1\tPLAIN\tservice=IMAP\tsecured\tlip=127.0.0.1\trip=127.0.0.1\tresp=AGRvdmV0ZXN0AHBhc3M=") at auth-request-handler.c:327
        len = 20
        mech = (struct mech_module *) 0x0
        request = (struct auth_request *) 0x8077a10
        list = (const char * const *) 0x806e114
        name = 0x806e130 "resp"
        arg = 0x806e160 "\200á\006\b\016"
        initial_resp = 0x806e0de "AGRvdmV0ZXN0AHBhc3M="
        initial_resp_data = (const void *) 0x646975
        initial_resp_len = 0
        id = 1
        buf = (buffer_t *) 0x806e160
        valid_client_cert = 0
---Type <return> to continue, or q <return> to quit---
#5  0x0804f8b2 in auth_client_input (context=0x80785c0)
    at auth-client-connection.c:144
        conn = (struct auth_client_connection *) 0x80785c0
        line = 0x8081017 "AUTH\t1\tPLAIN\tservice=IMAP\tsecured\tlip=127.0.0.1\trip=127.0.0.1\tresp=AGRvdmV0ZXN0AHBhc3M="
#6  0x0805f8dc in io_loop_handler_run (ioloop=0x8078000) at ioloop-poll.c:184
        data = (struct ioloop_handler_data *) 0x806d080
        pollfd = (struct pollfd *) 0x2
        tv = {tv_sec = 1, tv_usec = 999555}
        io = (struct io *) 0x806d5c0
        t_id = 2
        msecs = 0
        ret = 0
        call = 1
#7  0x0805f319 in io_loop_run (ioloop=0x8078000) at ioloop.c:218
No locals.
#8  0x080541dd in main (argc=1, argv=0x1) at main.c:311
        foreground = 0
(gdb) 
-------


Thanks

-- 
Thomas Hummel 	    | Institut Pasteur
<hummel at pasteur.fr> | Pôle informatique - systèmes et réseau