[Dovecot] segfault in mail_user_get_home()

[Timo Sirainen]

I couldn't reproduce it with your config, but I figured out the cause of it anyway. Fixed:
http://hg.dovecot.org/dovecot-2.1/rev/6b9db780b47d

On 21.8.2012, at 15.45, Lazy wrote:

> it was shared namespace with empty location that produced the error
> so :
> namespace test {
>  list = children
>  location =
>  prefix = test.
>  subscriptions = yes
>  type = shared
> }
> 
> segfaults
> 
> with location is fine
> 
> 
> 
> 2012/8/21, Lazy <lazy404 at gmail.com>:
>> gdb ./src/imap/.libs/imap
>> 
>> Reading symbols from /usr/src/dovecot-2.1.9/src/imap/.libs/imap...done.
>> (gdb) run
>> Starting program: /usr/src/dovecot-2.1.9/src/imap/.libs/imap
>> warning: no loadable sections found in added symbol-file
>> system-supplied DSO at 0x7ffff7ffa000
>> [Thread debugging using libthread_db enabled]
>> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
>> process 1104 is executing new program: /usr/local/dovecot/bin/doveconf
>> [Thread debugging using libthread_db enabled]
>> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
>> process 1104 is executing new program:
>> /usr/src/dovecot-2.1.9/src/imap/.libs/imap
>> [Thread debugging using libthread_db enabled]
>> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
>> 
>> Program received signal SIGSEGV, Segmentation fault.
>> 0x00007ffff7b2a0ff in mail_user_get_home (user=0x0,
>> home_r=0x7fffffffe308) at mail-user.c:310
>> 310             if (user->home_looked_up) {
>> (gdb) bt
>> #0  0x00007ffff7b2a0ff in mail_user_get_home (user=0x0,
>> home_r=0x7fffffffe308) at mail-user.c:310
>> #1  0x00007ffff7ad172e in mdbox_storage_find_root_dir (ns=0x648610) at
>> mdbox-storage.c:90
>> #2  0x00007ffff7ad180c in mdbox_storage_autodetect (ns=0x648610,
>> set=0x7fffffffe4d0) at mdbox-storage.c:113
>> #3  0x00007ffff7b2345d in mail_storage_autodetect (ns=0x648610,
>> set=0x7fffffffe4d0) at mail-storage.c:105
>> #4  0x00007ffff7b2369d in mail_storage_get_class (ns=0x648610,
>> driver=0x0, list_set=0x7fffffffe4d0, flags=0, error_r=0x7fffffffe5b8)
>> at mail-storage.c:180
>> #5  0x00007ffff7b23c90 in mail_storage_create (ns=0x648610,
>> driver=0x0, flags=0, error_r=0x7fffffffe5b8) at mail-storage.c:342
>> #6  0x00007ffff7b1c62a in namespace_add (user=0x649be0,
>> ns_set=0x64a8c8, unexpanded_ns_set=0x64a1c0, mail_set=0x64a440,
>> ns_p=0x645380,
>>    error_r=0x7fffffffe6e8) at mail-namespace.c:126
>> #7  0x00007ffff7b1ccbb in mail_namespaces_init (user=0x649be0,
>> error_r=0x7fffffffe6e8) at mail-namespace.c:289
>> #8  0x00007ffff7b34a64 in mail_storage_service_init_post
>> (ctx=0x633460, user=0x633e08, priv=0x7fffffffe6f0,
>> mail_user_r=0x7fffffffe7b8,
>>    error_r=0x7fffffffe6e8) at mail-storage-service.c:641
>> #9  0x00007ffff7b35dd6 in mail_storage_service_next (ctx=0x633460,
>> user=0x633e08, mail_user_r=0x7fffffffe7b8) at
>> mail-storage-service.c:1114
>> #10 0x00007ffff7b35efa in mail_storage_service_lookup_next
>> (ctx=0x633460, input=0x7fffffffe810, user_r=0x7fffffffe7c0,
>> mail_user_r=0x7fffffffe7b8,
>>    error_r=0x7fffffffe808) at mail-storage-service.c:1149
>> #11 0x000000000041f61c in client_create_from_input
>> (input=0x7fffffffe810, login_client=0x7fffffffe880, fd_in=0, fd_out=1,
>> input_buf=0x0,
>>    error_r=0x7fffffffe808) at main.c:202
>> #12 0x000000000041f859 in main_stdio_run (username=0x0) at main.c:247
>> #13 0x000000000041fd0a in main (argc=1, argv=0x631370) at main.c:381
>> 
>> /usr/local/dovecot/bin/doveconf -n
>> # 2.1.9: /usr/local/dovecot/etc/dovecot/dovecot.conf
>> # OS: Linux 2.6.32 x86_64 Debian wheezy/sid
>> namespace test {
>>  list = children
>>  location = maildir:/root/test
>>  prefix = test.
>>  subscriptions = yes
>>  type = shared
>> }
>> namespace inbox {
>>  inbox = yes
>>  list = yes
>>  location =
>>  mailbox Drafts {
>>    special_use = \Drafts
>>  }
>>  mailbox Junk {
>>    special_use = \Junk
>>  }
>>  mailbox Sent {
>>    special_use = \Sent
>>  }
>>  mailbox "Sent Messages" {
>>    special_use = \Sent
>>  }
>>  mailbox Trash {
>>    special_use = \Trash
>>  }
>>  prefix =
>>  subscriptions = yes
>> }
>> passdb {
>>  driver = pam
>> }
>> ssl = no
>> userdb {
>>  driver = passwd
>> }
>> 
>> without type = shared there is no segfault,
>> 
>> I understand this config might not work (invoking imap directly) but
>> it should't segfault.
>> 
>> Regards,
>> 
>> Michal Grzedzicki
>> 
>