Crashing when run against OpenSSL 1.1.0c

[Michael Marley]

Hi,

I am running Dovecot 2.2.26.0 compiled against OpenSSL 1.1 and, since
upgrading to OpenSSL 1.1.0c, the "lmtp" process has been crashing with
SIGSEGV whenever it receives SIGINT.  This always happens a minute or so
after the lmtp process handles a message.  It can also be manually
reproduced by sending SIGINT to one of the running lmtp processes.

I am compiling and running on an Ubuntu 17.04 x86_64 system using GCC 6.2.

Here is the output of me reproducing it with gdb:

(gdb) signal SIGINT
Continuing with signal SIGINT.

Program received signal SIGSEGV, Segmentation fault.
0x00007f6748cc2fb0 in ?? ()
(gdb) bt
#0  0x00007f6748cc2fb0 in ?? ()
#1  0x00007f674872ac60 in ossl_init_thread_stop (locals=<optimized out>)
at crypto/init.c:336
#2  0x00007f674872aee4 in OPENSSL_cleanup () at crypto/init.c:391
#3  0x00007f67491052e0 in __run_exit_handlers (status=0,
listp=0x7f674948c5d8 <__exit_funcs>,
    run_list_atexit=run_list_atexit at entry=true,
run_dtors=run_dtors at entry=true) at exit.c:83
#4  0x00007f674910533a in __GI_exit (status=<optimized out>) at exit.c:105
#5  0x00007f67490eb3f8 in __libc_start_main (main=0x555b35fbfbc0 <main>,
argc=1, argv=0x7ffd4ede3588, init=<optimized out>,
    fini=<optimized out>, rtld_fini=<optimized out>,
stack_end=0x7ffd4ede3578) at ../csu/libc-start.c:325
#6  0x0000555b35fbfe3a in _start ()

Here is the output of "doveconf -n":

# 2.2.26.0 (23d1de6): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.devel (623ae77)
# OS: Linux 4.8.7-040807-generic x86_64 Ubuntu Zesty Zapus (development
branch)
auth_mechanisms = plain login
auth_username_format = %Ln
mail_location = mdbox:~/mdbox
mailbox_list_index = yes
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope
encoded-character vacation subaddress comparator-i;ascii-numeric
relational regex imap4flags copy include variables body enotify
environment mailbox date index ihave duplicate mime foreverypart extracttext
namespace inbox {
  inbox = yes
  location =
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix =
}
passdb {
  driver = pam
}
plugin {
  sieve = file:~/sieve;active=~/.dovecot.sieve
}
postmaster_address = michael at michaelmarley.com
protocols = imap sieve lmtp
service auth {
  client_limit = 1624
  unix_listener /var/spool/postfix/private/dovecot-auth {
    group = postfix
    mode = 0660
    user = postfix
  }
}
service imap-login {
  inet_listener imaps {
    port = 0
  }
}
service lmtp {
  process_min_avail = 5
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
}
ssl = required
ssl_ca = </etc/ssl/private/COMODORSADomainValidationSecureServerCA.crt
ssl_cert = </etc/ssl/private/michaelmarley.com.crt
ssl_cipher_list = HIGH !RC4 !aNULL !eNULL !3DES @STRENGTH
ssl_dh_parameters_length = 4096
ssl_key =  # hidden, use -P to show it
ssl_protocols = !SSLv3
userdb {
  driver = passwd
}
protocol lmtp {
  mail_plugins = " sieve"
}
protocol lda {
  mail_plugins = " sieve"
}
local_name matthewtmarley.com {
  ssl_ca = </etc/ssl/private/COMODORSADomainValidationSecureServerCA.crt
  ssl_cert = </etc/ssl/private/matthewtmarley.com.crt
  ssl_key =  # hidden, use -P to show it
}

I tried recompiling Dovecot to see if that might do any good, but I got
the same result.  Also, I noticed that the "test-crypto" test in
src/lib-dcrypt also crashes on exit (despite the fact that all the tests
succeeded) with a very similar stacktrace:

(gdb) run
Starting program:
/home/michael/Source/dovecot/core/src/lib-dcrypt/test-crypto
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
test_cipher_test_vectors ............................................. : ok
test_cipher_aead_test_vectors ........................................ : ok
test_hmac_test_vectors ............................................... : ok
test_load_v1_keys .................................................... : ok
test_load_v1_key ..................................................... : ok
test_load_v1_public_key .............................................. : ok
test_load_v2_key ..................................................... : ok
test_load_v2_public_key .............................................. : ok
test_get_info_v2_key ................................................. : ok
test_gen_and_get_info_rsa_pem ........................................ : ok
test_get_info_rsa_private_key ........................................ : ok
test_get_info_invalid_keys ........................................... : ok
test_get_info_key_encrypted .......................................... : ok
test_get_info_pw_encrypted ........................................... : ok
test_password_change ................................................. : ok
test_load_invalid_keys ............................................... : ok
0 / 16 tests failed

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff75a5480 in ?? ()
(gdb) bt
#0  0x00007ffff75a5480 in ?? ()
#1  0x00007ffff6ff7c60 in ossl_init_thread_stop (locals=<optimized out>)
at crypto/init.c:336
#2  0x00007ffff6ff7ee4 in OPENSSL_cleanup () at crypto/init.c:391
#3  0x00007ffff78472e0 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#4  0x00007ffff784733a in exit () from /lib/x86_64-linux-gnu/libc.so.6
#5  0x00007ffff782d3f8 in __libc_start_main () from
/lib/x86_64-linux-gnu/libc.so.6
#6  0x000055555555f68a in _start ()

If there is anything I have missed or if there is any other way I can
help, please let me know.

Thanks,

Michael Marley