[LBBS-118] SEGV in IMAP session when mailbox selected

Possibly related to [LBBS-16], but I've seen this a couple times now, where if COMPRESS is enabled, the IMAP session experiences memory corruption and causes a segfault. Workaround is disable io_compress and prevent it from loading.

From memory, this only seems to happen in this particular way with this particular client... suggesting it's something about this particular client and the way it connects that is exposing the bug, perhaps.

[2025-09-21 11:28:18.258]   DEBUG[16907]: net_imap.c:3859 finish_auth: 0x7f690c7f5840 <= 1 OK [CAPABILITY IMAP4rev1 AUTH=PLAIN UNSELECT UNAUTHENTICATE SPECIAL-USE LIST-EXTENDED LIST-STATUS XLIST CHILDREN IDLE NOTIFY NAMESPACE QUOTA QUOTA=RES-STORAGE ID SASL-IR ACL SORT THREAD=ORDEREDSUBJECT THREAD=REFERENCES URLAUTH ESEARCH ESORT SEARCHRES UIDPLUS LITERAL+ MULTIAPPEND APPENDLIMIT MOVE WITHIN ENABLE CONDSTORE QRESYNC STATUS=SIZE IDLE COMPRESS=DEFLATE] Success
[2025-09-21 11:28:18.276]   DEBUG[16907]: net_imap.c:5031 handle_client: 0x7f690c7f5840 => 2 COMPRESS DEFLATE
[2025-09-21 11:28:18.278]   DEBUG[16907]: io.c:267 io_transform_store: Set up I/O transformer at index 1
[2025-09-21 11:28:18.278]   DEBUG[16907]: net_imap.c:4953 imap_process: 0x7f690c7f5840 <= 2 OK DEFLATE active
[2025-09-21 11:28:18.287]   DEBUG[16909]: thread.c:106 thread_register: Thread 16909 spawned from io_thread             started by thread 16907 at io.c:434 bbs_io_transform_setup()
[2025-09-21 11:28:18.300]   DEBUG[16907]: net_imap.c:5031 handle_client: 0x7f690c7f5840 => 3 ID ("name" "MailNews" "version" "52.9.9224a1")
[2025-09-21 11:28:18.300]   DEBUG[16907]: net_imap.c:4584 imap_process: 0x7f690c7f5840 <= * ID ("name" "LBBS.Imap4Server" "version" "0.7.3")
[2025-09-21 11:28:18.300]   DEBUG[16907]: net_imap.c:4585 imap_process: 0x7f690c7f5840 <= 3 OK ID completed
[2025-09-21 11:28:18.318]   DEBUG[16907]: net_imap.c:5031 handle_client: 0x7f690c7f5840 => 4 select "INBOX"
Segmentation fault (core dumped)

Thread 1 (Thread 0x7f690c7f86c0 (LWP 16907)):
#0  0x000055e7f0baed4c in bbs_username (user=0x7f690c7f) at user.c:33
        __func__ = "bbs_username"
#1  0x00007f6916b30d07 in load_acl (imap=0x7f690c7f5840, directory=0x7f690c7f4e40 "C", ns=NAMESPACE_PRIVATE, acl=0x7f690c7f4e3c) at imap_server_acl.c:177
#2  0x00007f6916b41eb7 in __imap_translate_dir (imap=0x7f690c7f5840, directory=0x7f690c7f5dca "INBOX", buf=0x7f690c7f4e40 "C", len=256, acl=0x7f690c7f4e3c, mboxptr=0x7f690c7f4df0) at imap_server_maildir.c:173
        ns = NAMESPACE_PRIVATE
        remainder = 0xd68 <error: Cannot access memory at address 0xd68>
        mbox = 0x7f69300025a0
        res = 0
        __func__ = "__imap_translate_dir"
#3  0x00007f6916b41f0a in imap_translate_dir (imap=0x7f690c7f5840, directory=0x7f690c7f5dca "INBOX", buf=0x7f690c7f4e40 "C", len=256, acl=0x7f690c7f4e3c) at imap_server_maildir.c:180
        mbox = 0x7f69300025a0
        res = 32617
#4  0x00007f6916b42116 in set_maildir (imap=0x7f690c7f5840, mailbox=0x7f690c7f5dca "INBOX") at imap_server_maildir.c:204
#5  0x00007f6916b57152 in handle_select (imap=imap@entry=0x7f690c7f5840, s=<optimized out>, readonly=readonly@entry=CMD_SELECT) at net_imap.c:1437
        mailbox = 0x7f690c7f5dca "INBOX"
        was_selected = 0
        maxmodseq = <optimized out>
        traversal = ...
        traversalptr = 0x7f690c7f52c0
        oldmbox = 0x7f6924009e20
        __func__ = "handle_select"
#6  0x00007f6916b673cb in imap_process (imap=imap@entry=0x7f690c7f5840, s=s@entry=0x7f690c7f5dc0 "4") at net_imap.c:4591
        replacecount = <optimized out>
        command = 0x7f690c7f5dc2 "select"
        res = <optimized out>
        __func__ = "imap_process"
#7  0x00007f6916b6cd3e in handle_client (imap=0x7f690c7f5840) at net_imap.c:5033
#8  imap_handler (node=node@entry=0x7f69300025a0, secure=<optimized out>) at net_imap.c:5066

Never mind, it happens without COMPRESS as well:

[2025-09-21 11:34:02.303]   DEBUG[17060]: io.c:240 bbs_io_transformer_available: No such transformer of type 1
[2025-09-21 11:34:02.303]   DEBUG[17060]: net_imap.c:3859 finish_auth: 0x7f68edc83840 <= 1 OK [CAPABILITY IMAP4rev1 AUTH=PLAIN UNSELECT UNAUTHENTICATE SPECIAL-USE LIST-EXTENDED LIST-STATUS XLIST CHILDREN IDLE NOTIFY NAMESPACE QUOTA QUOTA=RES-STORAGE ID SASL-IR ACL SORT THREAD=ORDEREDSUBJECT THREAD=REFERENCES URLAUTH ESEARCH ESORT SEARCHRES UIDPLUS LITERAL+ MULTIAPPEND APPENDLIMIT MOVE WITHIN ENABLE CONDSTORE QRESYNC STATUS=SIZE IDLE] Success
[2025-09-21 11:34:02.303]   DEBUG[17060]: io.c:240 bbs_io_transformer_available: No such transformer of type 1
[2025-09-21 11:34:02.322]   DEBUG[17060]: net_imap.c:5031 handle_client: 0x7f68edc83840 => 2 ID ("name" "MailNews" "version" "52.9.9224a1")
[2025-09-21 11:34:02.322]   DEBUG[17060]: net_imap.c:4584 imap_process: 0x7f68edc83840 <= * ID ("name" "LBBS.Imap4Server" "version" "0.7.3")
[2025-09-21 11:34:02.322]   DEBUG[17060]: net_imap.c:4585 imap_process: 0x7f68edc83840 <= 2 OK ID completed
[2025-09-21 11:34:02.564]   DEBUG[17060]: net_imap.c:5031 handle_client: 0x7f68edc83840 => 3 select "INBOX"
Segmentation fault (core dumped)

Thread 1 (Thread 0x7f68edc866c0 (LWP 17060)):
#0  0x00005557f3e20d4c in bbs_username (user=0x7f68edc8) at user.c:33
        __func__ = "bbs_username"
#1  0x00007f68f24c0d07 in load_acl (imap=0x7f68edc83840, directory=0x7f68edc82e40 "<", ns=NAMESPACE_PRIVATE, acl=0x7f68edc82e3c) at imap_server_acl.c:177
#2  0x00007f68f24d1eb7 in __imap_translate_dir (imap=0x7f68edc83840, directory=0x7f68edc83dca "INBOX", buf=0x7f68edc82e40 "<", len=256, acl=0x7f68edc82e3c, mboxptr=0x7f68edc82df0) at imap_server_maildir.c:173
        ns = NAMESPACE_PRIVATE
        remainder = 0xd68 <error: Cannot access memory at address 0xd68>
        mbox = 0x7f69100025a0
        res = 0
        __func__ = "__imap_translate_dir"
#3  0x00007f68f24d1f0a in imap_translate_dir (imap=0x7f68edc83840, directory=0x7f68edc83dca "INBOX", buf=0x7f68edc82e40 "<", len=256, acl=0x7f68edc82e3c) at imap_server_maildir.c:180
        mbox = 0x7f69100025a0
        res = 32617
#4  0x00007f68f24d2116 in set_maildir (imap=0x7f68edc83840, mailbox=0x7f68edc83dca "INBOX") at imap_server_maildir.c:204
#5  0x00007f68f24e7152 in handle_select (imap=imap@entry=0x7f68edc83840, s=<optimized out>, readonly=readonly@entry=CMD_SELECT) at net_imap.c:1437

Comments

9/21/2025 7:42 AM — InterLinked

Likely false positive that has occurred a couple times by chance, fixed by running make clean && make && make install, so there was probably some bad pointer hanky panky going on

You must be logged in to leave a comment.