FS#31536 - [mutt] segfaults at connection to mailbox

Attached to Project: Arch Linux
Opened by Rémy Oudompheng (remyoudompheng) - Friday, 14 September 2012, 11:45 GMT
Last edited by Gaetan Bisson (vesath) - Monday, 24 September 2012, 06:33 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Gaetan Bisson (vesath)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:
mutt segfaults at some stage when logging into a particular mailbox of mine.
The mailbox is a POP server.

The backtrace sems to indicate the problem is in a cache.

My workaround is to replace "rc == 0 ? p : src" at muttlib.c:1963 by "rc == 0 && p ? p : src".

% gdb =mutt core-mutt-12313
GNU gdb (GDB) 7.5
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-unknown-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/mutt...done.

warning: exec file is newer than core file.
[New LWP 12313]

warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
Core was generated by `mutt -F /home/remy/.config/mutt/muttrc.blah'.
Program terminated with signal 11, Segmentation fault.
#0 0x00007fcd05287d1c in __strncpy_ssse3 () from /usr/lib/libc.so.6
(gdb) bt
#0 0x00007fcd05287d1c in __strncpy_ssse3 () from /usr/lib/libc.so.6
#1 0x0000000000473507 in strncpy (__len=256, __src=0x0, __dest=0x7fff6846be70 "") at /usr/include/bits/string3.h:120
#2 mutt_encode_path (dest=0x7fff6846be70 "", dlen=256, src=<optimized out>) at muttlib.c:1963
#3 0x000000000048d401 in bcache_path (account=<optimized out>, mailbox=<optimized out>, dst=0x1225930 "", dstlen=256) at bcache.c:66
#4 0x000000000048d50c in mutt_bcache_open (account=0x7fff6846c010, mailbox=0x0) at bcache.c:90
#5 0x000000000048971e in pop_open_mailbox (ctx=0x1204d10) at pop.c:426
#6 0x0000000000443b92 in mx_open_mailbox (path=path@entry=0x7fff6846c6e0 "pops://pop.softeam.fr/INBOX", flags=0, pctx=pctx@entry=0x0)
at mx.c:667
#7 0x0000000000408de0 in main (argc=1, argv=<optimized out>) at main.c:1017
(gdb) up
#1 0x0000000000473507 in strncpy (__len=256, __src=0x0, __dest=0x7fff6846be70 "") at /usr/include/bits/string3.h:120
120 return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
(gdb) up
#2 mutt_encode_path (dest=0x7fff6846be70 "", dlen=256, src=<optimized out>) at muttlib.c:1963
1963 strfcpy (dest, rc == 0 ? p : src, dlen);
(gdb) up
#3 0x000000000048d401 in bcache_path (account=<optimized out>, mailbox=<optimized out>, dst=0x1225930 "", dstlen=256) at bcache.c:66
66 mutt_encode_path (path, sizeof (path), NONULL (mailbox));
(gdb) down
#2 mutt_encode_path (dest=0x7fff6846be70 "", dlen=256, src=<optimized out>) at muttlib.c:1963
1963 strfcpy (dest, rc == 0 ? p : src, dlen);
(gdb) info locals
p = 0x0
rc = <optimized out>

Additional info:
* mutt 1.5.21-6

Steps to reproduce:
This task depends upon

Closed by  Gaetan Bisson (vesath)
Monday, 24 September 2012, 06:33 GMT
Reason for closing:  Fixed
Additional comments about closing:  mutt-1.5.21-7 in [extra]
Comment by Gaetan Bisson (vesath) - Friday, 14 September 2012, 20:27 GMT
What troubles me is that p should never be NULL; below is the function where it happens. Are you running out of RAM?

void mutt_encode_path (char *dest, size_t dlen, const char *src)
{
char *p = safe_strdup (src);
int rc = mutt_convert_string (&p, Charset, "utf-8", 0);
strfcpy (dest, rc == 0 ? p : src, dlen);
FREE (&p);
}
Comment by Gaetan Bisson (vesath) - Saturday, 15 September 2012, 09:47 GMT
Could you also report it there? http://dev.mutt.org/trac/

If it doesn't go away (say, when your mailbox gets a new mail or something), I'll happily patch our Mutt as you suggested, but I'd like an upstream report that we can track.
Comment by Rémy Oudompheng (remyoudompheng) - Monday, 24 September 2012, 06:14 GMT
The bug seems to be known (opening a POP mailbox with message cache enabled)

Debian bug report: http://bugs.debian.org/620854
Mutt bug report: http://dev.mutt.org/trac/ticket/3457
Patch upstream: http://dev.mutt.org/trac/changeset/1a4c43138685

Comment by Gaetan Bisson (vesath) - Monday, 24 September 2012, 06:32 GMT
Perfect; I'll incorporate that patch with mutt-1.5.21-7.

Loading...