View Issue Details

IDProjectCategoryView StatusLast Update
0002745SOGoWeb Mailpublic2014-07-10 11:50
Reporterjucas Assigned Tofrancis  
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionno change required 
Platform[Server] LinuxOSDebianOS Version6 (Squeeze)
Product Version2.2.3 
Target Version2.2.4Fixed in Version2.2.4 
Summary0002745: Crash if generated sieve script is larger than 8192B
Description

Sieve server is Dovecot-pingeonhole, but I think it does not matter.

Maybe it is:

SOGoSieveManager.m, line 587
sieveScript = [NSMutableString stringWithCapacity: 8192];

and buffer overflow somewhere.

8192B buffer is IMHO too small for Sieve script.

Steps To Reproduce

1 Create mail filters so that the size of generated sieve script exceeded 8192 Bytes.
2 click "Save and close" preferences and Sogod will crash.

Additional Information

log:

glibc detected /usr/sbin/sogod: munmap_chunk(): invalid pointer: 0x00007fff6dd402a0 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x76d76)[0x7fef15fbfd76]
/usr/lib/libgnustep-base.so.1.20(GSFromUnicode+0xe7)[0x7fef16eb0767]
/usr/lib/libgnustep-base.so.1.20(+0x1692ed)[0x7fef16d0d2ed]
/usr/lib/libNGMime.so.4.9(+0xcf16a)[0x7fef1810c16a]
/usr/lib/libSOGo.so.2(+0x792b9)[0x7fef195902b9]
/usr/lib/GNUstep/SOGo/Mailer.SOGo/./Mailer(+0x331ab)[0x7fef1060a1ab]
/usr/lib/GNUstep/SOGo/Mailer.SOGo/./Mailer(+0x330ef)[0x7fef1060a0ef]
/usr/lib/GNUstep/SOGo/PreferencesUI.SOGo/./PreferencesUI(+0xe0d0)[0x7fef0f2d70d0]
/usr/lib/libNGObjWeb.so.4.9(+0x1c3a75)[0x7fef18559a75]
/usr/lib/libNGObjWeb.so.4.9(+0x1bee10)[0x7fef18554e10]
/usr/lib/libNGObjWeb.so.4.9(+0x1c1328)[0x7fef18557328]
/usr/lib/libNGObjWeb.so.4.9(+0x15449b)[0x7fef184ea49b]
/usr/lib/libNGObjWeb.so.4.9(+0x11bc3c)[0x7fef184b1c3c]
/usr/sbin/sogod(+0x7a89)[0x7fef19a47a89]
/usr/lib/libNGObjWeb.so.4.9(+0x1b09f5)[0x7fef185469f5]
/usr/lib/libNGObjWeb.so.4.9(+0x1b0be8)[0x7fef18546be8]
/usr/lib/libNGObjWeb.so.4.9(+0x1acee9)[0x7fef18542ee9]
/usr/lib/libNGObjWeb.so.4.9(+0x1ad0f6)[0x7fef185430f6]
/usr/lib/libNGObjWeb.so.4.9(+0x1ad572)[0x7fef18543572]
/usr/lib/libNGObjWeb.so.4.9(+0x1ad7a8)[0x7fef185437a8]
/usr/lib/libgnustep-base.so.1.20(+0x223c32)[0x7fef16dc7c32]
/usr/lib/libgnustep-base.so.1.20(+0x3106a1)[0x7fef16eb46a1]
/usr/lib/libgnustep-base.so.1.20(+0x263c01)[0x7fef16e07c01]
/usr/lib/libgnustep-base.so.1.20(+0x262ba0)[0x7fef16e06ba0]
/usr/lib/libNGObjWeb.so.4.9(+0x11b57e)[0x7fef184b157e]
/usr/sbin/sogod(+0x70fd)[0x7fef19a470fd]
/usr/lib/libNGObjWeb.so.4.9(+0x15d9c3)[0x7fef184f39c3]
/usr/lib/libNGObjWeb.so.4.9(+0x15cdd6)[0x7fef184f2dd6]
/usr/lib/libNGObjWeb.so.4.9(+0x15e102)[0x7fef184f4102]
/usr/lib/libNGObjWeb.so.4.9(WOWatchDogApplicationMain+0x37c)[0x7fef184f466c]
/usr/sbin/sogod(main+0x111)[0x7fef19a462cd]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd)[0x7fef15f67ead]
/usr/sbin/sogod(+0x60e9)[0x7fef19a460e9]

......

Apr 30 15:40:09 sogod [1704]: <0x0x7fef1b528430[WOWatchDogChild]> child 1737 exited
Apr 30 15:40:09 sogod [1704]: <0x0x7fef1b528430[WOWatchDogChild]> (terminated due to signal 6)
Apr 30 15:40:09 sogod [1704]: <0x0x7fef1b2da9f0[WOWatchDog]> child spawned with pid 3023

TagsNo tags attached.

Activities

francis

francis

2014-04-30 16:40

administrator   ~0006981

Fixed.

See https://github.com/inverse-inc/sogo/commit/4e42a6a689f3386710eb4917092b84d2873f2b2a

jucas

jucas

2014-06-09 10:35

reporter   ~0007159

Testing Sogo 2.2.5, and unfortunately still crash with script larger than 8kB. This time I tried gdb.


    (gdb) run
    Starting program: /usr/sbin/sogod -WOUseWatchDog NO -WONoDetach YES -WOPort 20000 -WOWorkersCount 1 -WOLogFile - -WOPidFile /tmp/sogo.pid
    [Thread debugging using libthread_db enabled]
    Using host libthread_db library &quot;/lib/x86_64-linux-gnu/libthread_db.so.1&quot;.
    Jun 09 10:55:02 sogod [28830]: version 2.2.5 (build @shiva.inverse 201406051427) -- starting
    Jun 09 10:55:02 sogod [28830]: vmem size check enabled: shutting down app when vmem > 384 MB
    Jun 09 10:55:02 sogod [28830]: &lt;0x0x7ffff858f940[SOGoProductLoader]> SOGo products loaded from '/usr/lib/GNUstep/SOGo':
    Jun 09 10:55:02 sogod [28830]: &lt;0x0x7ffff858f940[SOGoProductLoader]>   Mailer.SOGo, Contacts.SOGo, MainUI.SOGo, MailerUI.SOGo, Appointments.SOGo, AdministrationUI.SOGo, MailPartViewers.SOGo, PreferencesUI.SOGo, ContactsUI.SOGo, CommonUI.SOGo, SchedulerUI.SOGo
    Jun 09 10:55:02 sogod [28830]: |SOGo| WOHttpAdaptor listening on address *:20000
    2014-06-09 10:55:14.561 sogod[28830] Note: Using UTF-8 as URL encoding in NGExtensions.
    Jun 09 10:55:14 sogod [28830]: &lt;0x0x7ffff85b93b0[SOGoCache]> Cache cleanup interval set every 300.000000 seconds
    Jun 09 10:55:14 sogod [28830]: &lt;0x0x7ffff85b93b0[SOGoCache]> Using host(s) 'localhost' as server(s)
    2014-06-09 10:55:14.619 sogod[28830] Note(SoObject): SoDebugKeyLookup is enabled!
    2014-06-09 10:55:14.619 sogod[28830] Note(SoObject): SoDebugBaseURL is enabled!
    2014-06-09 10:55:14.619 sogod[28830] Note(SoObject): relative base URLs are enabled.
    2014-06-09 10:55:14.712 sogod[28830] WOCompoundElement: pool embedding is on.
    2014-06-09 10:55:14.712 sogod[28830] WOCompoundElement: id logging is on.
    192.168.0.5 - - [09/Jun/2014:10:55:14 GMT] &quot;GET /SOGo/so/best/editFilter?filter=20 HTTP/1.1&quot; 200 7028/0 0.198 18663 62% 2M
    2014-06-09 10:55:22.996 sogod[28830] WARNING: Could not delete Sieve script - continuing...: {RawResponse = &quot;{ok = 0; }&quot;; result = 0; }
    * glibc detected * /usr/sbin/sogod: munmap_chunk(): invalid pointer: 0x00007fffffff9a70 ***
    ======= Backtrace: =========
    /lib/x86_64-linux-gnu/libc.so.6(+0x76d76)[0x7ffff4559d76]
    /usr/lib/libgnustep-base.so.1.20(GSFromUnicode+0xe7)[0x7ffff544a767]
    /usr/lib/libgnustep-base.so.1.20(+0x1692ed)[0x7ffff52a72ed]
    /usr/lib/libNGMime.so.4.9(+0xd049a)[0x7ffff66a749a]
    /usr/lib/libSOGo.so.2(+0x886a1)[0x7ffff7b3a6a1]
    /usr/lib/GNUstep/SOGo/Mailer.SOGo/./Mailer(+0x3458f)[0x7fffee97258f]
    /usr/lib/GNUstep/SOGo/Mailer.SOGo/./Mailer(+0x344d3)[0x7fffee9724d3]
    /usr/lib/GNUstep/SOGo/PreferencesUI.SOGo/./PreferencesUI(+0xf2b8)[0x7fffed63b2b8]
    /usr/lib/libNGObjWeb.so.4.9(+0x1c40f5)[0x7ffff6af50f5]
    /usr/lib/libNGObjWeb.so.4.9(+0x1bf490)[0x7ffff6af0490]
    /usr/lib/libNGObjWeb.so.4.9(+0x1c19a8)[0x7ffff6af29a8]
    /usr/lib/libNGObjWeb.so.4.9(+0x15449b)[0x7ffff6a8549b]
    /usr/lib/libNGObjWeb.so.4.9(+0x11bc3c)[0x7ffff6a4cc3c]
    /usr/sbin/sogod(+0x7a89)[0x7ffff7ff9a89]
    /usr/lib/libNGObjWeb.so.4.9(+0x1b1075)[0x7ffff6ae2075]
    /usr/lib/libNGObjWeb.so.4.9(+0x1b1268)[0x7ffff6ae2268]
    /usr/lib/libNGObjWeb.so.4.9(+0x1ad569)[0x7ffff6ade569]
    /usr/lib/libNGObjWeb.so.4.9(+0x1ad776)[0x7ffff6ade776]
    /usr/lib/libNGObjWeb.so.4.9(+0x1adbf2)[0x7ffff6adebf2]
    /usr/lib/libNGObjWeb.so.4.9(+0x1aea1d)[0x7ffff6adfa1d]
    /usr/lib/libgnustep-base.so.1.20(+0x223c32)[0x7ffff5361c32]
    /usr/lib/libgnustep-base.so.1.20(+0x3106a1)[0x7ffff544e6a1]
    /usr/lib/libgnustep-base.so.1.20(+0x263c01)[0x7ffff53a1c01]
    /usr/lib/libgnustep-base.so.1.20(+0x262ba0)[0x7ffff53a0ba0]
    /usr/lib/libNGObjWeb.so.4.9(+0x11b57e)[0x7ffff6a4c57e]
    /usr/sbin/sogod(+0x70fd)[0x7ffff7ff90fd]
    /usr/lib/libNGObjWeb.so.4.9(WOApplicationMain+0xa7)[0x7ffff6a72df7]
    /usr/lib/libNGObjWeb.so.4.9(WOWatchDogApplicationMain+0x497)[0x7ffff6a8f787]
    /usr/sbin/sogod(main+0x111)[0x7ffff7ff82cd]
    /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd)[0x7ffff4501ead]
    /usr/sbin/sogod(+0x60e9)[0x7ffff7ff80e9]
    ======= Memory map: ========
    7fffec2d1000-7fffec2d3000 r-xp 00000000 08:21 57684                      /usr/lib/GNUstep/WOxElemBuilders-4.9/SOGoElements.wox/SOGoElements
    7fffec2d3000-7fffec4d3000 ---p 00002000 08:21 57684                      /usr/lib/GNUstep/WOxElemBuilders-4.9/SOGoElements.wox/SOGoElements

    ..................
    ..................

    7fffedcdc000-7fffededc000 ---p 00023000 08:21 58004                      /usr/lib/GNUstep/SOGo/Contacts.SOGo/Contacts
    7fffededc000-7fffedee9000 rw-p 00023000 08:21 58004                      /usr/lib/GNUstep/SOGo/Contacts.SOGo/Contacts
    7fffedee9000-7fffedeea000 r-xp 00000000 08:21 56408                      /usr/lib/GNUstep/
    Program received signal SIGABRT, Aborted.
    0x00007ffff4515475 in raise () from /lib/x86_64-linux-gnu/libc.so.6

    (gdb) bt
    #0  0x00007ffff4515475 in raise () from /lib/x86_64-linux-gnu/libc.so.6
    0000001  0x00007ffff45186f0 in abort () from /lib/x86_64-linux-gnu/libc.so.6
    0000002  0x00007ffff455052b in ?? () from /lib/x86_64-linux-gnu/libc.so.6
    0000003  0x00007ffff4559d76 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
    0000004  0x00007ffff544a767 in GSFromUnicode () from /usr/lib/libgnustep-base.so.1.20
    0000005  0x00007ffff52a72ed in ?? () from /usr/lib/libgnustep-base.so.1.20
    0000006  0x00007ffff66a749a in ?? () from /usr/lib/libNGMime.so.4.9
    0000007  0x00007ffff7b3a6a1 in -[SOGoSieveManager updateFiltersForAccount:withUsername:andPassword:] (self=0x7ffff93abb00, _cmd=0x7fffeeba2150, theAccount=0x7ffff93aba20, theUsername=0x0,
        thePassword=0x0) at SOGoSieveManager.m:923
    0000008  0x00007fffee97258f in -[SOGoMailAccount updateFiltersWithUsername:andPassword:] (self=0x7ffff93aba20, _cmd=0x7fffeeba2130, theUsername=0x0, thePassword=0x0) at SOGoMailAccount.m:322
    0000009  0x00007fffee9724d3 in -[SOGoMailAccount updateFilters] (self=0x7ffff93aba20, _cmd=0x7fffed846d50) at SOGoMailAccount.m:312
    0000010 0x00007fffed63b2b8 in -[UIxPreferences defaultAction] (self=0x7ffff8ccaaa0, _cmd=0x7ffff6e17e50) at UIxPreferences.m:1266
    0000011 0x00007ffff6af50f5 in ?? () from /usr/lib/libNGObjWeb.so.4.9
    0000012 0x00007ffff6af0490 in ?? () from /usr/lib/libNGObjWeb.so.4.9
    0000013 0x00007ffff6af29a8 in ?? () from /usr/lib/libNGObjWeb.so.4.9
    0000014 0x00007ffff6a8549b in ?? () from /usr/lib/libNGObjWeb.so.4.9
    0000015 0x00007ffff6a4cc3c in ?? () from /usr/lib/libNGObjWeb.so.4.9
    0000016 0x00007ffff7ff9a89 in -[SOGo dispatchRequest:] (self=0x7ffff85ec980, _cmd=0x7ffff6dfe030, _request=0x7ffff8b0b3f0) at SOGo.m:453
    0000017 0x00007ffff6ae2075 in ?? () from /usr/lib/libNGObjWeb.so.4.9
    0000018 0x00007ffff6ae2268 in ?? () from /usr/lib/libNGObjWeb.so.4.9
    0000019 0x00007ffff6ade569 in ?? () from /usr/lib/libNGObjWeb.so.4.9
    0000020 0x00007ffff6ade776 in ?? () from /usr/lib/libNGObjWeb.so.4.9
    0000021 0x00007ffff6adebf2 in ?? () from /usr/lib/libNGObjWeb.so.4.9
    0000022 0x00007ffff6adfa1d in ?? () from /usr/lib/libNGObjWeb.so.4.9
    0000023 0x00007ffff5361c32 in ?? () from /usr/lib/libgnustep-base.so.1.20
    0000024 0x00007ffff544e6a1 in ?? () from /usr/lib/libgnustep-base.so.1.20
    0000025 0x00007ffff53a1c01 in ?? () from /usr/lib/libgnustep-base.so.1.20
    0000026 0x00007ffff53a0ba0 in ?? () from /usr/lib/libgnustep-base.so.1.20
    0000027 0x00007ffff6a4c57e in ?? () from /usr/lib/libNGObjWeb.so.4.9
    0000028 0x00007ffff7ff90fd in -[SOGo run] (self=0x7ffff85ec980, _cmd=0x7ffff6d899c0) at SOGo.m:277
    0000029 0x00007ffff6a72df7 in WOApplicationMain () from /usr/lib/libNGObjWeb.so.4.9
    0000030 0x00007ffff6a8f787 in WOWatchDogApplicationMain () from /usr/lib/libNGObjWeb.so.4.9
    0000031 0x00007ffff7ff82cd in main (argc=13, argv=0x7fffffffe748, env=0x7fffffffe7b8) at sogod.m:53

Note:

"script" object from frame 0000007 (SOGoSieveManager updateFiltersForAccount:withUsername:andPassword) contain generated sieve script (tested by gdb po), but respective sieve file on server is not generated.

ludovic

ludovic

2014-06-11 17:42

administrator   ~0007189

I cannot reproduce this, even with a sieve scrit that is over 32 000 bytes.

Attach the complete text, ut8-encoded, zip encoded, to this ticket. I guess the large portion of text comes from a vacation message...

jucas

jucas

2014-06-12 15:14

reporter   ~0007202

I tried to reproduce crash with new test user. So I export filters using sogo-tool and import them to new user. And it seems sogo-tool crash by same conditions as sogo server. I will attach zip with 2 dummy json files for sogo-tool. The one named sogo_tool_crash.json shoot sogo tool down, other is processed well.

sogo-tool command:

sogo-tool user-preferences set defaults user -p sogocredfile SOGoSieveFilters -f jsonfile

jucas

jucas

2014-06-12 15:17

reporter  

ludovic

ludovic

2014-06-16 19:47

administrator   ~0007218

No crash here:

(gdb) r
Starting program: /usr/local/sbin/sogo-tool user-preferences set defaults sogo10 -p creds SOGoSieveFilters -f sogo_tool_crash.json
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
<0x0x8787f0[SOGoCache]> Cache cleanup interval set every 300.000000 seconds
<0x0x8787f0[SOGoCache]> Using host(s) 'localhost' as server(s)
[Inferior 1 (process 18085) exited normally]
(gdb) bt
No stack.
(gdb)

Are you sure you haven't mangled the information too much and striped all non-ASCII characters?

jucas

jucas

2014-06-18 12:31

reporter   ~0007222

Json file I sent was generated by my Python script and sogo-tool was tested on it without changes.
However I tried to test this with ZEG-2.1.1b in Virtualbox, and it pass without crash. Exactly same command form and json file. Also crash is occurred only when certain size of sieve script is exceded, even when 8192B limit was removed. BTW why was such limit here? Maybe because of bug in external library? Anyway problem must be elsewhere, I suspect GNUstep, namely libgnustep. Sogo version executables I use (Debian squeeze package from inverse.ca) is linked with libgnustep.1.20, while sogo in ZEG with 1.22 version. However, when I tried to run sogo-tool with preloaded libgnustep.1.22, it crashed everytime, even without arguments.

ludovic

ludovic

2014-06-18 13:02

administrator   ~0007223

There was never a limit. The initWithCapacity avoids reallocs, but not limits were ever present.

ludovic

ludovic

2014-07-02 13:59

administrator   ~0007272

Why were you preloading a different library than what we link against? This is wrong and GNUstep is poor at ABI compatibility.

jucas

jucas

2014-07-10 11:49

reporter   ~0007312

Preloading was just a temporary test if problem is library version. Normally I run unchanged distribution package.

ludovic

ludovic

2014-07-10 11:50

administrator   ~0007313

Don't play with fire or you'll get burnt.

Issue History

Date Modified Username Field Change
2014-04-30 14:29 jucas New Issue
2014-04-30 15:04 francis Target Version => 2.2.4
2014-04-30 16:40 francis Note Added: 0006981
2014-04-30 16:40 francis Status new => resolved
2014-04-30 16:40 francis Fixed in Version => 2.2.4
2014-04-30 16:40 francis Resolution open => fixed
2014-04-30 16:40 francis Assigned To => francis
2014-06-09 10:35 jucas Note Added: 0007159
2014-06-09 10:35 jucas Status resolved => feedback
2014-06-09 10:35 jucas Resolution fixed => reopened
2014-06-11 17:42 ludovic Note Added: 0007189
2014-06-12 15:14 jucas Note Added: 0007202
2014-06-12 15:14 jucas Status feedback => assigned
2014-06-12 15:17 jucas File Added: filters_json_for_sogo_tool.zip
2014-06-16 19:47 ludovic Note Added: 0007218
2014-06-18 12:31 jucas Note Added: 0007222
2014-06-18 13:02 ludovic Note Added: 0007223
2014-07-02 13:59 ludovic Note Added: 0007272
2014-07-10 11:49 jucas Note Added: 0007312
2014-07-10 11:50 ludovic Note Added: 0007313
2014-07-10 11:50 ludovic Status assigned => closed
2014-07-10 11:50 ludovic Resolution reopened => no change required