mail/imapproxy segfault (unusable)

This is from 4.1-stable/amd64, all -stable patches applied.

imapproxy-1.2.3p0 and the posted update from MAINTAINER
(Cc'd) to 1.2.5
both do the same thing:  I connect to the proxy's listening
port, type
"a01 login foo bar" (literally) and it segfaults
with the following.

(The IMAP server it's connecting to is in production and
working fine.)

Any help is greatly appreciated... this machine was supposed
to be back
in production yesterday... thanks!


(gdb) r
Starting program: /usr/local/sbin/imapproxyd -f
/etc/imapproxy-foreground.conf

Program received signal SIGSEGV, Segmentation fault.
[Switching to process 23499, thread 0x43847800]
0x0000000048fd09f1 in tzload (name=0x490efae0
"GMT", sp=0x49424d60, doextend=Cannot access
memory at address 0x489f9bfc
)
    at /usr/src/lib/libc/time/localtime.c:337
337     {
(gdb) bt
#0  0x0000000048fd09f1 in tzload (name=0x490efae0
"GMT", sp=0x49424d60, doextend=Cannot access
memory at address 0x489f9bfc
)
    at /usr/src/lib/libc/time/localtime.c:337
#1  0x0000000048fd1d48 in gmtload (sp=0x49424d60) at
/usr/src/lib/libc/time/localtime.c:1111
#2  0x0000000048fd2296 in gmtsub (timep=0x48a051fc,
offset=0, tmp=0x43b13400)
    at /usr/src/lib/libc/time/localtime.c:1352
#3  0x0000000048fd22ae in gmtime_r (timep=0x490efae0,
p_tm=0x43b13400) at /usr/src/lib/libc/time/localtime.c:1387
#4  0x0000000048fd22f0 in gmtime (timep=0x48a051fc) at
/usr/src/lib/libc/time/localtime.c:1400
#5  0x0000000041afa309 in OPENSSL_gmtime (timer=0x490efae0,
result=0x48a05200)
    at /usr/src/lib/libssl/src/crypto/o_time.c:82
#6  0x0000000041afa0c7 in ASN1_UTCTIME_set (s=0x48a05280,
t=1181741245)
    at /usr/src/lib/libssl/src/crypto/asn1/a_utctm.c:199
#7  0x0000000041ac4f28 in X509_time_adj (s=0x48a05280,
adj=0, in_tm=0x1)
    at /usr/src/lib/libssl/src/crypto/x509/x509_vfy.c:996
#8  0x0000000041ac4dd8 in X509_cmp_time (ctm=0x4cc861c0,
cmp_time=0x0)
    at /usr/src/lib/libssl/src/crypto/x509/x509_vfy.c:958
#9  0x0000000041ac4ab4 in internal_verify (ctx=0x48a053c0)
at /usr/src/lib/libssl/src/crypto/x509/x509_vfy.c:842
#10 0x0000000041ac3eb7 in X509_verify_cert (ctx=0x48a053c0)
at /usr/src/lib/libssl/src/crypto/x509/x509_vfy.c:306
#11 0x000000004a81d6a6 in ssl_verify_cert_chain
(s=0x4adaea00, sk=0x2) at
/usr/src/lib/libssl/src/ssl/ssl_cert.c:496
#12 0x000000004a80d4f4 in ssl3_get_server_certificate
(s=0x4adaea00) at /usr/src/lib/libssl/src/ssl/s3_clnt.c:835
#13 0x000000004a80c924 in ssl3_connect (s=0x4adaea00) at
/usr/src/lib/libssl/src/ssl/s3_clnt.c:276
#14 0x000000004a815095 in SSL_connect (s=0x4adaea00) at
/usr/src/lib/libssl/src/ssl/ssl_lib.c:825
#15 0x000000000040495a in Get_Server_conn ()
#16 0x000000000040643e in cmd_login ()
#17 0x00000000004075ea in HandleRequest ()
#18 0x0000000044d4e34d in _thread_start () at
/usr/src/lib/libpthread/uthread/uthread_create.c:244
#19 0x000000000000001f in ?? ()
Cannot access memory at address 0x48a0d000
(gdb) 

If I replace 4.1-stable's /usr/src/lib/libc/time/localtime.c
with the
same file from 4.0-stable, and rebuild libc, the segfault
disappears.



On 13 June 2007 at 9:27, bsdopenbsd.rutgers.edu wrote:

> This is from 4.1-stable/amd64, all -stable patches
applied.
> 
> imapproxy-1.2.3p0 and the posted update from MAINTAINER
(Cc'd) to 1.2.5
> both do the same thing:  I connect to the proxy's
listening port, type
> "a01 login foo bar" (literally) and it
segfaults with the following.
> 
> (The IMAP server it's connecting to is in production
and working fine.)
> 
> Any help is greatly appreciated... this machine was
supposed to be back
> in production yesterday... thanks!
> 
> 
> (gdb) r
> Starting program: /usr/local/sbin/imapproxyd -f
/etc/imapproxy-foreground.conf
> 
> Program received signal SIGSEGV, Segmentation fault.
> [Switching to process 23499, thread 0x43847800]
> 0x0000000048fd09f1 in tzload (name=0x490efae0
"GMT", sp=0x49424d60, doextend=Cannot access
memory at address 0x489f9b
fc
> )
>     at /usr/src/lib/libc/time/localtime.c:337
> 337     {
> (gdb) bt
> #0  0x0000000048fd09f1 in tzload (name=0x490efae0
"GMT", sp=0x49424d60, doextend=Cannot access
memory at address 0x48
9f9bfc
> )
>     at /usr/src/lib/libc/time/localtime.c:337
> #1  0x0000000048fd1d48 in gmtload (sp=0x49424d60) at
/usr/src/lib/libc/time/localtime.c:1111
> #2  0x0000000048fd2296 in gmtsub (timep=0x48a051fc,
offset=0, tmp=0x43b13400)
>     at /usr/src/lib/libc/time/localtime.c:1352
> #3  0x0000000048fd22ae in gmtime_r (timep=0x490efae0,
p_tm=0x43b13400) at /usr/src/lib/libc/time/localtime.c:1387
> #4  0x0000000048fd22f0 in gmtime (timep=0x48a051fc) at
/usr/src/lib/libc/time/localtime.c:1400
> #5  0x0000000041afa309 in OPENSSL_gmtime
(timer=0x490efae0, result=0x48a05200)
>     at /usr/src/lib/libssl/src/crypto/o_time.c:82
> #6  0x0000000041afa0c7 in ASN1_UTCTIME_set
(s=0x48a05280, t=1181741245)
>     at
/usr/src/lib/libssl/src/crypto/asn1/a_utctm.c:199
> #7  0x0000000041ac4f28 in X509_time_adj (s=0x48a05280,
adj=0, in_tm=0x1)
>     at
/usr/src/lib/libssl/src/crypto/x509/x509_vfy.c:996
> #8  0x0000000041ac4dd8 in X509_cmp_time
(ctm=0x4cc861c0, cmp_time=0x0)
>     at
/usr/src/lib/libssl/src/crypto/x509/x509_vfy.c:958
> #9  0x0000000041ac4ab4 in internal_verify
(ctx=0x48a053c0) at
/usr/src/lib/libssl/src/crypto/x509/x509_vfy.c:842
> #10 0x0000000041ac3eb7 in X509_verify_cert
(ctx=0x48a053c0) at
/usr/src/lib/libssl/src/crypto/x509/x509_vfy.c:306
> #11 0x000000004a81d6a6 in ssl_verify_cert_chain
(s=0x4adaea00, sk=0x2) at
/usr/src/lib/libssl/src/ssl/ssl_cert.c:496
> #12 0x000000004a80d4f4 in ssl3_get_server_certificate
(s=0x4adaea00) at /usr/src/lib/libssl/src/ssl/s3_clnt.c:835
> #13 0x000000004a80c924 in ssl3_connect (s=0x4adaea00)
at /usr/src/lib/libssl/src/ssl/s3_clnt.c:276
> #14 0x000000004a815095 in SSL_connect (s=0x4adaea00) at
/usr/src/lib/libssl/src/ssl/ssl_lib.c:825
> #15 0x000000000040495a in Get_Server_conn ()
> #16 0x000000000040643e in cmd_login ()
> #17 0x00000000004075ea in HandleRequest ()
> #18 0x0000000044d4e34d in _thread_start () at
/usr/src/lib/libpthread/uthread/uthread_create.c:244
> #19 0x000000000000001f in ?? ()
> Cannot access memory at address 0x48a0d000
> (gdb)