Debian Bug report logs - #392927
Spfmilter dies unexpectedly with SIGABRT

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Herbert Straub <herbert@linuxhacker.at>

To: submit@bugs.debian.org

Subject: Spfmilter dies unexpectedly with SIGABRT

Date: Sat, 14 Oct 2006 11:47:02 +0200

Package: spfmilter
Version: 1.99+0.95

The spfmilter process dies and the sendmail gateway hangs in a wait. A
attached GDB shows the following:

Program received signal SIGABRT, Aborted.
[Switching to Thread 1098918240 (LWP 9663)]
0x00002aaaaaf2611d in raise () from /lib/libc.so.6
(gdb) bt
#0  0x00002aaaaaf2611d in raise () from /lib/libc.so.6
#1  0x00002aaaaaf2784e in abort () from /lib/libc.so.6
#2  0x00002aaaaaf5ae41 in __fsetlocking () from /lib/libc.so.6
#3  0x00002aaaaaf6090e in malloc_usable_size () from /lib/libc.so.6
#4  0x00002aaaaaf60c56 in free () from /lib/libc.so.6
#5  0x00002aaaaade8261 in SPF_smtp_from () from /usr/lib/libspf-1.0.so.0
#6  0x0000000000402b7e in ?? ()
#7  0x00002aaaaabc773d in st_sender (g=0x41802140) at engine.c:853
#8  0x00002aaaaabc6bbe in mi_engine (ctx=0x511070) at engine.c:355
#9  0x00002aaaaabc8b1f in mi_handle_session (ctx=0x511070) at handler.c:45
#10 0x00002aaaaabc78d9 in mi_thread_handle_wrapper (arg=0x2358) at
listener.c:566
#11 0x00002aaaaacd60fa in start_thread () from /lib/libpthread.so.0
#12 0x00002aaaaafbece2 in clone () from /lib/libc.so.6
#13 0x0000000000000000 in ?? ()

The error is reproducible. A quick look into src/libspf/main.c and here
in function SPF_smtp_from

  /*
  * Comment by: James Couzens <jcouzens@codeshare.ca>
  * Date:       04/17/05
  *
  *  xfree can be called to attempt to free memory even if its already freed
  *  but thats no excuse to be abusing it, its there to catch mistakes, not
  *  to ack as a lazy coder facilitation device
  *
  *  The reason freeing is being attempted is because it appears that people
  *  have been attempting to call this function multiple times within a
single
  *  SPF parse, which logically would result in memory leakage because
SPF_close
  *  isn't being called.
  *
  *  I honestly don't think its safe to be calling this function more than
  *  once but some users have reported success, I'll have to look into
this...
 */

Maybe this could be the reason, why SIGABORT happens? Maybe the same
error as in Debian Bug #315196 ... <mailto:315196@bugs.debian.org>

Regards
Herbert Straub

Message #14 received at 392927@bugs.debian.org (full text, mbox, reply):

From: paddy@panici.net

To: 392927@bugs.debian.org

Subject: Spfmilter dies unexpectedly with SIGABRT

Date: Fri, 13 Jul 2007 16:03:11 +0000

yes, looks like this is happening in SPF_smtp_from()

and it is the double free that aaron reports in #315196.
it is hard to be sure about the earlier report in that bug,
if that is a different author.

I have a version of this built some time back against
a libspf version slightly before the comment that Herbert quotes,
which doesn't suffer from this problem, I'll look at the diff.

probably this bug should be filed against the libspf0 library.

as far as I understand it neither of this or the libspf2 libs
are supported upstream, and they probably have more subtle bugs
in their implementation of SPF.  I suggest interested users
look at the archives of, or ask on the spf mailing lists.

nevertheless, I've had some good use out of my build of this
with sarge, and would like to see this bug fixed since this 
package is in etch.

Message #19 received at 392927@bugs.debian.org (full text, mbox, reply):

From: paddy@panici.net

To: 392927@bugs.debian.org

Subject: Spfmilter dies unexpectedly with SIGABRT

Date: Fri, 13 Jul 2007 16:26:08 +0000

commenting out the three xfree()s after the referenced comment stops
the crash.  I couldn't say whether spfmilter will then leak in the
way that the comment warns ofi (I suspect not), but that would be a 
less severe bug in my book.  I will feedback when I know more about 
that question.

scary though it may sound, please consider applying this to libspf0, 
and putting the resulting package(s) forward for the next point release 
of etch.

Regards,
Paddy

Message #32 received at 392927@bugs.debian.org (full text, mbox, reply):

From: Mike Markley <mike@markley.org>

To: paddy@panici.net, 392927@bugs.debian.org

Subject: Re: Bug#392927: Spfmilter dies unexpectedly with SIGABRT

Date: Thu, 19 Jul 2007 15:36:27 -0700

On Fri, Jul 13, 2007 at 04:26:08PM +0000, paddy@panici.net <paddy@panici.net> wrote:
> commenting out the three xfree()s after the referenced comment stops
> the crash.  I couldn't say whether spfmilter will then leak in the
> way that the comment warns ofi (I suspect not), but that would be a 
> less severe bug in my book.  I will feedback when I know more about 
> that question.
> 
> scary though it may sound, please consider applying this to libspf0, 
> and putting the resulting package(s) forward for the next point release 
> of etch.

I've applied this patch on one of my etch boxes that often experiences
this crash. It's quite memory-contrained, so any memory leaks should
also be reasonably obvious. I'll report results as I get them.

-- 
Mike Markley <mike@markley.org>

Message #37 received at 392927@bugs.debian.org (full text, mbox, reply):

From: Mike Markley <mike@markley.org>

To: paddy@panici.net, 392927@bugs.debian.org

Subject: Re: Bug#392927: Spfmilter dies unexpectedly with SIGABRT

Date: Tue, 24 Jul 2007 15:03:13 -0700

On Thu, Jul 19, 2007 at 03:36:27PM -0700, Mike Markley <mike@markley.org> wrote:
> On Fri, Jul 13, 2007 at 04:26:08PM +0000, paddy@panici.net <paddy@panici.net> wrote:
> > commenting out the three xfree()s after the referenced comment stops
> > the crash.  I couldn't say whether spfmilter will then leak in the
> > way that the comment warns ofi (I suspect not), but that would be a 
> > less severe bug in my book.  I will feedback when I know more about 
> > that question.
> > 
> > scary though it may sound, please consider applying this to libspf0, 
> > and putting the resulting package(s) forward for the next point release 
> > of etch.
> 
> I've applied this patch on one of my etch boxes that often experiences
> this crash. It's quite memory-contrained, so any memory leaks should
> also be reasonably obvious. I'll report results as I get them.

I've been running this for nearly a week on my medium-volume backup MX,
and if there's a memory leak, it's a very slow one. My baseline
(off-peak) vsize for spfmilter started out as 10340 on 7/20 and then
increased to 10396 on 7/21 and to 10460 on 7/23. Nonetheless, it does
appear to be leaking. I can't actually prove that it's libspf0 leaking,
though, since I'm not stable enough without the patch to take any real
measurements.

According to my etch system, whitelister is the only other package using
libspf0. It's probably worth getting in touch with its maintainer to get
his take.

-- 
Mike Markley <mike@markley.org>

Message #42 received at 392927@bugs.debian.org (full text, mbox, reply):

From: paddy@panici.net

To: Mike Markley <mike@markley.org>

Cc: 392927@bugs.debian.org, whitelister@debian.org

Subject: Re: Bug#392927: Spfmilter dies unexpectedly with SIGABRT

Date: Wed, 25 Jul 2007 10:47:36 +0000

On Tue, Jul 24, 2007 at 03:03:13PM -0700, Mike Markley wrote:
> On Thu, Jul 19, 2007 at 03:36:27PM -0700, Mike Markley <mike@markley.org> wrote:
> > On Fri, Jul 13, 2007 at 04:26:08PM +0000, paddy@panici.net <paddy@panici.net> wrote:
> > > commenting out the three xfree()s after the referenced comment stops
> > > the crash.  I couldn't say whether spfmilter will then leak in the
> > > way that the comment warns ofi (I suspect not), but that would be a 
> > > less severe bug in my book.  I will feedback when I know more about 
> > > that question.
> > > 
> > > scary though it may sound, please consider applying this to libspf0, 
> > > and putting the resulting package(s) forward for the next point release 
> > > of etch.
> > 
> > I've applied this patch on one of my etch boxes that often experiences
> > this crash. It's quite memory-contrained, so any memory leaks should
> > also be reasonably obvious. I'll report results as I get them.
> 
> I've been running this for nearly a week on my medium-volume backup MX,
> and if there's a memory leak, it's a very slow one. My baseline
> (off-peak) vsize for spfmilter started out as 10340 on 7/20 and then
> increased to 10396 on 7/21 and to 10460 on 7/23. Nonetheless, it does
> appear to be leaking. I can't actually prove that it's libspf0 leaking,
> though, since I'm not stable enough without the patch to take any real
> measurements.
> 
> According to my etch system, whitelister is the only other package using
> libspf0. It's probably worth getting in touch with its maintainer to get
> his take.

yes, and wnpp recently said ...

>The following packages have been orphaned:
>
>  libspf (#433108), orphaned 5 days ago
>     Description: the ANSI C SPF reference library
>     Reverse Depends: libspf-dev spfmilter spfqtool whitelister
>     Installations reported by Popcon: 203

If I have understood the relative state of maintenance of libspf0 and
libspf2 then the right thing to do long-term is to get packages still
depending on libspf0 across onto libspf2, but in the short term an
upload of libspf0 to straighten this out sounds like a good idea.

the bug in libspf appears to be the freeing of p->current_domain and
p->original_domain when they point to the same place (I am triggering
this repeatably using an @gmail.com MAIL FROM for testing, but I
haven't look deep enough to say what is required).

the following patch, which mimics the other place where these are freed,
would seem to be what the author intended.

--- main.c.orig 2007-07-25 10:26:40.000000000 +0000
+++ main.c      2007-07-25 10:20:01.000000000 +0000
@@ -1683,7 +1683,8 @@
     xfree(p->from);
   }

-  if (p->spf_rlevel > 0)
+  if ((p->spf_rlevel > 0) &&
+      (p->current_domain != p->original_domain))
   {
     xfree(p->current_domain);
   }

I recall now that I looked at using this version of libspf0, and
specifically this bug, when I built myself an spfmilter for sarge,
and at the time I decided I'd rather stick with the version that 
was in sarge :-(

I would guess that spfqtool would not suffer from this, but that 
whitelister, being a similar sort of thing may. On postfix I mostly
see recommendations for other implementations, so it may be that it,
like spfmilter, is little used in debian ?

Regards,
Paddy

Message #47 received at 392927@bugs.debian.org (full text, mbox, reply):

From: Mike Markley <mike@markley.org>

To: paddy@panici.net, 392927@bugs.debian.org

Subject: Re: Bug#392927: Spfmilter dies unexpectedly with SIGABRT

Date: Thu, 15 Nov 2007 23:31:26 -0800

I've been running the patches suggested in here since July on my backup
MX without any evidence of problems. In fact, spfmilter's memory
footprint has not budged since I began doing so.

On the other hand, I'm replacing that server with a new one that just
got a fresh etch install. spfmilter crashes pretty much daily.

If the libspf maintainer is listening in, is there any chance we can get
this bundled up for proposed-updates?

-- 
Mike Markley <mike@markley.org>

Support your country all the time and your government when it deserves it.
- Mark Twain

Message #52 received at 392927@bugs.debian.org (full text, mbox, reply):

From: Mattias Nordstrom <mnordstr@debian.org>

To: Mike Markley <mike@markley.org>, 392927@bugs.debian.org

Cc: paddy@panici.net

Subject: Re: Bug#392927: Spfmilter dies unexpectedly with SIGABRT

Date: Sat, 17 Nov 2007 16:23:26 +0200

Ok, so just to be on the clear, an update that would include the three
line patch on main.c fixes the problem in question?

Regards,
 Mattias

Mike Markley wrote:
> I've been running the patches suggested in here since July on my backup
> MX without any evidence of problems. In fact, spfmilter's memory
> footprint has not budged since I began doing so.
> 
> On the other hand, I'm replacing that server with a new one that just
> got a fresh etch install. spfmilter crashes pretty much daily.
> 
> If the libspf maintainer is listening in, is there any chance we can get
> this bundled up for proposed-updates?
> 

Message #57 received at 392927@bugs.debian.org (full text, mbox, reply):

From: Mike Markley <mike@markley.org>

To: Mattias Nordstrom <mnordstr@debian.org>, 392927@bugs.debian.org

Subject: Re: Bug#392927: Spfmilter dies unexpectedly with SIGABRT

Date: Sun, 18 Nov 2007 19:10:30 -0800

On Sat, Nov 17, 2007 at 04:23:26PM +0200, Mattias Nordstrom <mnordstr@debian.org> wrote:
> Ok, so just to be on the clear, an update that would include the three
> line patch on main.c fixes the problem in question?

It appears so; that's the only difference between 0.999-1.0.0-p3-3 and
what I'm running on my backup MX.

-- 
Mike Markley <mike@markley.org>

As far as the laws of mathematics refer to reality, they are not
certain, and as far as they are certain, they do not refer to reality.
- Albert Einstein

Message #62 received at 392927@bugs.debian.org (full text, mbox, reply):

From: Lucas Nussbaum <lucas@lucas-nussbaum.net>

To: 392927@bugs.debian.org, 459082@bugs.debian.org

Cc: control@bugs.debian.org

Subject: libspf: diff for NMU version 0.999-1.0.0-p3-4

Date: Sun, 20 Jan 2008 20:25:16 +0100

[Message part 1 (text/plain, inline)]

tags 459082 + patch pending
tags 392927 + patch pending
thanks

Hi,

I've just sponsored a QA upload by Scott Kitterman which fixes #392927
and #459082. For #392927, he used the patch described as working by Mike
Markley. It's not 100% clear whether this is a fix or just a workaround,
but it's probably better than having spfmilter crashing regularly.
-- 
| Lucas Nussbaum
| lucas@lucas-nussbaum.net   http://www.lucas-nussbaum.net/ |
| jabber: lucas@nussbaum.fr             GPG: 1024D/023B3F4F |

[libspf-0.999-1.0.0-p3-4-nmu.diff (text/x-diff, attachment)]

Message #69 received at 392927-close@bugs.debian.org (full text, mbox, reply):

From: Scott Kitterman <scott@kitterman.com>

To: 392927-close@bugs.debian.org

Subject: Bug#392927: fixed in libspf 0.999-1.0.0-p3-4

Date: Sun, 20 Jan 2008 19:32:03 +0000

Source: libspf
Source-Version: 0.999-1.0.0-p3-4

We believe that the bug you reported is fixed in the latest version of
libspf, which is due to be installed in the Debian FTP archive:

libspf-dev_0.999-1.0.0-p3-4_i386.deb
  to pool/main/libs/libspf/libspf-dev_0.999-1.0.0-p3-4_i386.deb
libspf-doc_0.999-1.0.0-p3-4_all.deb
  to pool/main/libs/libspf/libspf-doc_0.999-1.0.0-p3-4_all.deb
libspf0_0.999-1.0.0-p3-4_i386.deb
  to pool/main/libs/libspf/libspf0_0.999-1.0.0-p3-4_i386.deb
libspf_0.999-1.0.0-p3-4.diff.gz
  to pool/main/libs/libspf/libspf_0.999-1.0.0-p3-4.diff.gz
libspf_0.999-1.0.0-p3-4.dsc
  to pool/main/libs/libspf/libspf_0.999-1.0.0-p3-4.dsc
spfqtool_0.999-1.0.0-p3-4_i386.deb
  to pool/main/libs/libspf/spfqtool_0.999-1.0.0-p3-4_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 392927@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Scott Kitterman <scott@kitterman.com> (supplier of updated libspf package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sun, 20 Jan 2008 13:30:06 -0500
Source: libspf
Binary: spfqtool libspf-doc libspf0 libspf-dev
Architecture: source all i386
Version: 0.999-1.0.0-p3-4
Distribution: unstable
Urgency: low
Maintainer: Debian QA Group <packages@qa.debian.org>
Changed-By: Scott Kitterman <scott@kitterman.com>
Description: 
 libspf-dev - the ANSI C SPF reference library (development files)
 libspf-doc - the ANSI C SPF reference library (documentation)
 libspf0    - the ANSI C SPF reference library (runtime library)
 spfqtool   - command-line SPF query tool
Closes: 392927 459082
Changes: 
 libspf (0.999-1.0.0-p3-4) unstable; urgency=low
 .
   * QA upload.
   * Change src/libspf/main.c to fix memory leak that causes crashes with
     spf-milter (closes: #392927)
   * Fix bashism in debian rules (closes: #459082)
Files: 
 05d1a8ee3c431b81de82cb654b40719c 645 mail extra libspf_0.999-1.0.0-p3-4.dsc
 e636c5ec9bdbaa84afba3e276def9a02 7882 mail extra libspf_0.999-1.0.0-p3-4.diff.gz
 da2cd8505959980159f9924bd79b9939 829800 doc extra libspf-doc_0.999-1.0.0-p3-4_all.deb
 eac9b30d273843b7162d1bb6965cfe35 32968 libdevel extra libspf-dev_0.999-1.0.0-p3-4_i386.deb
 b51ab1a9319f1770760f6d149dcac672 33330 libs extra libspf0_0.999-1.0.0-p3-4_i386.deb
 ca40daff23c2cfee48f87cf323e2ed28 5866 mail extra spfqtool_0.999-1.0.0-p3-4_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHk6A72hliNwI7P08RAhAWAKDNiDmHaxZnTHg25uQTqapYv+7PYgCgvG0B
RopAYTVAE3rwXVqaO1F03Ag=
=UHsg
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.