[LBBS-151] net_imap: NULL dereference in mailbox_quota in generate_status

← All Issues || New Issue →

Sort Normal || Priority

Details

Crash in mailbox with NOTIFY enabled when a message is received for a local mailbox while we are idling on a remote mailbox (and therefore imap->mbox is NULL).

Thread 1 (Thread 0x7fa060fd96c0 (LWP 64926)):
#0  0x00007fa09d0435f5 in mailbox_quota (mbox=0x0) at mod_mail.c:824
#1  0x00007fa08c2342da in construct_status (imap=0x7fa068fe8810, traversal=0x7fa060fd6500, s=0x7fa08c260cf8 "UIDNEXT MESSAGES UNSEEN HIGHESTMODSEQ", buf=0x7fa060fd6ec0 "MESSAGES 11 UIDNEXT 240 UNSEEN 6", len=256, maxmodseq=674) at net_imap.c:1630
#2  0x00007fa08c23496d in generate_status (imap=0x7fa068fe8810, folder=0x7fa060fd68b0 "REDACTED", buf=0x7fa060fd6ec0 "MESSAGES 11 UIDNEXT 240 UNSEEN 6", len=256, items=0x7fa08c260cf8 "UIDNEXT MESSAGES UNSEEN HIGHESTMODSEQ") at net_imap.c:1653
#3  0x00007fa08c22efd6 in send_untagged_exists (node=0x7fa0982d6f00, mbox=0x7fa08800ae60, maildir=0x7fa060fd7370 "/home/bbs/maildir/1/.REDACTED") at net_imap.c:686
#4  0x00007fa08c22f7cd in imap_mbox_watcher (event=0x7fa060fd7270) at net_imap.c:823
#5  0x00007fa09d04137c in mailbox_dispatch_event (event=0x7fa060fd7270) at mod_mail.c:262
#6  0x00007fa09d0415b3 in mailbox_notify_new_or_appended_message (node=0x7fa0982d6f00, mbox=0x7fa08800ae60, maildir=0x7fa060fd7370 "/home/bbs/maildir/1/.REDACTED", newfile=0x7fa060fd7570 "REDACTED", size=4767, event_type=EVENT_MESSAGE_NEW) at mod_mail.c:315
#7  0x00007fa09d0415f7 in mailbox_notify_new_message (node=0x7fa0982d6f00, mbox=0x7fa08800ae60, maildir=0x7fa060fd7370 "/home/bbs/maildir/1/.REDACTED", newfile=0x7fa060fd7570 "/home/bbs/maildir/1/.REDACTED/new/1774464168353784_202", size=4767) at mod_mail.c:320
#8  0x00007fa09c396dd4 in appendmsg (smtp=0x7fa060fd8c20, resp=0x7fa060fd7b40, mbox=0x7fa08800ae60, mproc=0x7fa060fd7820, recipient=0x7fa07c0dd700 "<REDACTED-RECIPIENT>", srcfd=212, datalen=4767, newfilebuf=0x0, len=0) at mod_smtp_delivery_local.c:213

#1  0x00007fa08c2342da in construct_status (imap=0x7fa068fe8810, traversal=0x7fa060fd6500, s=0x7fa08c260cf8 "UIDNEXT MESSAGES UNSEEN HIGHESTMODSEQ", buf=0x7fa060fd6ec0 "MESSAGES 11 UIDNEXT 240 UNSEEN 6",
    len=256, maxmodseq=674) at net_imap.c:1630
1630            appendlimit = MIN((unsigned int) mailbox_quota(imap->mbox), max_append_size);
(gdb) print *imap
$1 = {tag = 0x7fa068fe6660 "42", command = 0x7fa068fe67c3 "SELECT", subcommand = 0x7fa068fe67ca "\"Other Users.REDACTED.Inbox", node = 0x7fa0984d3350, mbox = 0x0,

Comments

You must be logged in to leave a comment.