View Issue Details

IDProjectCategoryView StatusLast Update
0005836SOGoBackend Mailpublic2023-09-11 14:11
Reportereugenesu Assigned Toqhivert  
PriorityhighSeveritycrashReproducibilityalways
Status closedResolutionwon't fix 
Product Version5.8.4 
Summary0005836: Crush realloc(): invalid next size on FETCH IMAP command
Description

Hi folks!

When fetching only one special email (cannot share it because it is full of private info) sogo crushes with message:

realloc(): invalid next size

It is reproducable 100% with this email on IMAP command FETCH.

Tagswebmail

Activities

sebastien

sebastien

2023-08-05 19:13

administrator   ~0017160

Hi @eugenesu !

You need to provide the backtrace according to https://www.sogo.nu/support/faq/how-do-i-debug-sogo.html

Sebastien

eugenesu

eugenesu

2023-08-07 07:16

reporter   ~0017162

Strace is as folow:

recvfrom(10<TCP:[127.0.0.1:46952->127.0.0.1:15993]>, "lt;mailto:<PRIVATE>.ru&g"..., 3398, 0, NULL, NULL) = 3398
write(13</tmp/sogod096264CD210F05.tmp>, "<mailto:<PRIVATE>&"..., 3333) = 3333
close(13</tmp/sogod096264CD210F05.tmp>) = 0
openat(AT_FDCWD, "/tmp/sogod096264CD210F05.tmp", O_RDONLY) = 13</tmp/sogod096264CD210F05.tmp>
lseek(13</tmp/sogod096264CD210F05.tmp>, 0, SEEK_END) = 329222
lseek(13</tmp/sogod096264CD210F05.tmp>, 0, SEEK_SET) = 0
mmap(NULL, 329222, PROT_READ, MAP_SHARED, 13</tmp/sogod096264CD210F05.tmp>, 0) = 0x73f989738000
close(13</tmp/sogod096264CD210F05.tmp>) = 0
lstat("/tmp/sogod096264CD210F05.tmp", {st_mode=S_IFREG|0644, st_size=329222, ...}) = 0
unlink("/tmp/sogod096264CD210F05.tmp") = 0
recvfrom(10<TCP:[127.0.0.1:46952-><PRIVATE>]>, "\r\n9 OK Fetch completed (0.005 + "..., 512, 0, NULL, NULL) = 54
stat("/usr/lib/GNUstep/SOGo/MailerUI.SOGo/Resources", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
stat("/usr/lib/GNUstep/SOGo/MailerUI.SOGo/Resources/Russian.lproj/Localizable.strings", {st_mode=S_IFREG|0644, st_size=26217, ...}) = 0
stat("/usr/lib/GNUstep/SOGo/MailerUI.SOGo/Resources", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/gconv/UTF-32.so", O_RDONLY|O_CLOEXEC) = 13</usr/lib/x86_64-linux-gnu/gconv/UTF-32.so>
read(13</usr/lib/x86_64-linux-gnu/gconv/UTF-32.so>, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\20\0\0\0\0\0\0"..., 832) = 832
fstat(13</usr/lib/x86_64-linux-gnu/gconv/UTF-32.so>, {st_mode=S_IFREG|0644, st_size=19152, ...}) = 0
mmap(NULL, 20576, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 13</usr/lib/x86_64-linux-gnu/gconv/UTF-32.so>, 0) = 0x73f98a52b000
mmap(0x73f98a52c000, 8192, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 13</usr/lib/x86_64-linux-gnu/gconv/UTF-32.so>, 0x1000) = 0x73f98a52c000
mmap(0x73f98a52e000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 13</usr/lib/x86_64-linux-gnu/gconv/UTF-32.so>, 0x3000) = 0x73f98a52e000
mmap(0x73f98a52f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 13</usr/lib/x86_64-linux-gnu/gconv/UTF-32.so>, 0x3000) = 0x73f98a52f000
close(13</usr/lib/x86_64-linux-gnu/gconv/UTF-32.so>) = 0
mprotect(0x73f98a52f000, 4096, PROT_READ) = 0
brk(0x61478b6eb000) = 0x61478b6eb000
mmap(NULL, 1732608, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x73f989591000
mmap(NULL, 1380352, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x73f989440000
mremap(0x73f989440000, 1380352, 348160, MREMAP_MAYMOVE) = 0x73f989440000
munmap(0x73f989591000, 1732608) = 0
munmap(0x73f989440000, 348160) = 0
brk(0x61478b762000) = 0x61478b762000
brk(0x61478b7a0000) = 0x61478b7a0000
brk(0x61478b7dd000) = 0x61478b7dd000
writev(2</var/log/sogo/sogo.log>, [{iov_base="realloc(): invalid next size", iov_len=28}, {iov_base="\n", iov_len=1}], 2) = 29
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x73f98ddc5000
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [], 8) = 0
getpid() = 2402
gettid() = 2402
tgkill(2402, 2402, SIGABRT) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
--- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=2402, si_uid=997} ---
+++ killed by SIGABRT +++

qhivert

qhivert

2023-08-07 09:05

administrator   ~0017166

Hello,
By saing "It is reproducable 100% with this email on IMAP command FETCH." you mean with a telnet connection to your imap server and fetching directly your email, you have an error?

eugenesu

eugenesu

2023-08-07 09:55

reporter   ~0017170

By saing "It is reproducable 100% with this email on IMAP command FETCH" I mean, that fetching the email crushes with message: "realloc(): invalid next size" only in SOGo. By telnet it's OK. Strace I posted earlier.

eugenesu

eugenesu

2023-08-07 13:15

reporter   ~0017173

When SOGo was started with Jemalloc2 using LD_PRELOAD method, the strange email succesfully opened in SOGo web interface without any error.

Issue History

Date Modified Username Field Change
2023-08-04 18:10 eugenesu New Issue
2023-08-04 18:10 eugenesu Tag Attached: webmail
2023-08-05 19:13 sebastien Note Added: 0017160
2023-08-05 19:13 sebastien Status new => feedback
2023-08-07 07:16 eugenesu Note Added: 0017162
2023-08-07 07:16 eugenesu Status feedback => new
2023-08-07 09:05 qhivert Note Added: 0017166
2023-08-07 09:05 qhivert Assigned To => qhivert
2023-08-07 09:05 qhivert Status new => feedback
2023-08-07 09:55 eugenesu Note Added: 0017170
2023-08-07 09:55 eugenesu Status feedback => assigned
2023-08-07 13:15 eugenesu Note Added: 0017173
2023-09-11 14:11 qhivert Status assigned => closed
2023-09-11 14:11 qhivert Resolution open => won't fix