Hello.
I've reduced the test case to just 136 bytes (see attach).
Apparently, formail is confused by lines containing this:
<[email protected]"
where the email is enclosed between '<' at the left and '"' at the right.
I've built a debugging procmail this way:
apt-get source procmail
cd procmail-3.22
export DEB_BUILD_OPTIONS="noopt nostrip"
dpkg-buildpackage -uc -us
The crash may be reproduced by doing this:
formail < minimal-test-case
and here is a backtrace using gdb:
(gdb) bt
#0 0x00007f40b7a29475 in *__GI_raise (sig=<optimized out>) at
../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007f40b7a2c6f0 in *__GI_abort () at abort.c:92
#2 0x00007f40b7a6452b in __libc_message (do_abort=<optimized out>,
fmt=<optimized out>)
at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3 0x00007f40b7a6dd76 in malloc_printerr (action=3,
str=0x7f40b7b47ae8 "malloc(): memory corruption (fast)", ptr=<optimized
out>) at malloc.c:6312
#4 0x00007f40b7a71658 in _int_malloc (av=0x7f40b7d7de60, bytes=<optimized
out>) at malloc.c:4337
#5 0x00007f40b7a72c00 in *__GI___libc_malloc (bytes=20) at malloc.c:3660
#6 0x000000000040603c in tmalloc (len=20) at ecommon.c:21
#7 0x0000000000401fa4 in getsender (namep=0x1e42350 "a@a", fldp=0x1e42270,
headreply=0) at formail.c:295
#8 0x000000000040358f in main (lastm=1, argv=0x7fff07121aa0) at formail.c:628
Another thing I did is to run this executable using valgrind:
valgrind formail < minimal-test-case
and this is the result:
==19822== Memcheck, a memory error detector
==19822== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==19822== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==19822== Command: formail
==19822==
==19822== Invalid read of size 1
==19822== at 0x405649: skipwords (formisc.c:92)
==19822== by 0x401E80: getsender (formail.c:275)
==19822== by 0x40358E: main (formail.c:628)
==19822== Address 0x543c768 is 0 bytes after a block of size 40 alloc'd
==19822== at 0x4C28BED: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==19822== by 0x40603B: tmalloc (ecommon.c:21)
==19822== by 0x401B39: getsender (formail.c:222)
==19822== by 0x40358E: main (formail.c:628)
==19822==
==19822== Invalid read of size 1
==19822== at 0x40546F: skipwords (formisc.c:37)
==19822== by 0x401E80: getsender (formail.c:275)
==19822== by 0x40358E: main (formail.c:628)
==19822== Address 0x543c768 is 0 bytes after a block of size 40 alloc'd
==19822== at 0x4C28BED: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==19822== by 0x40603B: tmalloc (ecommon.c:21)
==19822== by 0x401B39: getsender (formail.c:222)
==19822== by 0x40358E: main (formail.c:628)
==19822==
==19822==
==19822== HEAP SUMMARY:
==19822== in use at exit: 278 bytes in 9 blocks
==19822== total heap usage: 20 allocs, 11 frees, 607 bytes allocated
==19822==
==19822== LEAK SUMMARY:
==19822== definitely lost: 129 bytes in 4 blocks
==19822== indirectly lost: 0 bytes in 0 blocks
==19822== possibly lost: 0 bytes in 0 blocks
==19822== still reachable: 149 bytes in 5 blocks
==19822== suppressed: 0 bytes in 0 blocks
==19822== Rerun with --leak-check=full to see details of leaked memory
==19822==
==19822== For counts of detected and suppressed errors, rerun with: -v
==19822== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 4 from 4)
Unfortunately, I don't know the code well enough to guess what's
happening here.
Stephen, would you try this in one of your Debian machines?
Thanks.From a@a Tue Mar 19 12:12:12 2013
Message-ID: <[email protected]"
From: aaaaaaaaaaaaaaaaa <[email protected]"
To: <[email protected]"
a
