[Dovecot] Patch to fix leak in imap_refresh_proctitle in beta[5, 6]

Mike Abbott michael.abbott at apple.com
Wed Jun 16 05:04:16 EEST 2010


>> 6   imap                                0x0000000105867333 imap_refresh_proctitle + 218 ->
>> 7   imap                                0x00000001058666ce cmd_sync_continue + 199 ->
> 
> But how does this happen? Did it optimize away some functions

Yeah optimized out tail-calls, e.g. client_destroy -> imap_refresh_proctitle and client_command_free -> imap_refresh_proctitle.  I have been digging deeper and found that sometimes imap_clients->command_queue->name points to garbage, so imap_refresh_proctitle is appending 500MB strings of garbage.  Combined with a little command pipelining this leads to 4+GB data stack pools.  I'll resume digging tomorrow.  Let me know if you need any info; I can reproduce this in seconds.

> have you added more imap_refresh_proctitle() calls?

Nope.


More information about the dovecot mailing list