Package: nmh
Version: 1.2-1
Severity: normal
This invocation of 'show' dumps core:
$ MH=/tmp/nmh/simple_profile show -showproc /usr/lib/mh/mhl +testfolder last
(Message test:1)
Segmentation fault (core dumped)
This happens with the Ubuntu nmh-1.2 i386 .deb as well as the
Debian/unstable .deb. To debug it, I rebuilt the i386 package from
the *Debian* nmh-1.2-1 source package, using
DEB_BUILD_OPTIONS="debug nostrip" dpkg-buildpackage -us -uc -rfakeroot
in order to get a backtrace from gdb.
To simplify reproducing the bug elsewhere, /tmp/nmh/simple_profile
contains one line:
Path: /tmp/nmh/Mail
/tmp/nmh/Mail/ contains the 'testfolder' folder with one message. It
doesn't seem to matter what the message is, but I'll upload a .tgz
of /tmp/nmh (to be extraced in /tmp) that includes nmh/Mail and
nmh/simple_folder, once I get back a BTS number.
Here is the gdb backtrace:
$ gdb show
(gdb) set environment MH /tmp/nmh/simple_profile
(gdb) run -showproc /usr/lib/mh/mhl +testfolder last
Starting program: /usr/bin/mh/show -showproc /usr/lib/mh/mhl +testfolder last
[Thread debugging using libthread_db enabled]
[New Thread -1212041536 (LWP 15781)]
(Message testfolder:1)
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1212041536 (LWP 15781)]
strcasecmp (s1=0x0, s2=0xbfd14b38 "Return-Path") at strcasecmp.c:33
33 while (tolower(*us1) == tolower(*us2++))
(gdb) bt
#0 strcasecmp (s1=0x0, s2=0xbfd14b38 "Return-Path") at strcasecmp.c:33
#1 0x0804d660 in process (folder=0x80928c1 "testfolder",
fname=0x8092370 "1", ofilen=1, ofilec=1) at mhlsbr.c:915
#2 0x0804e110 in mhl (argc=2, argv=0xbfd19d00) at mhlsbr.c:459
#3 0x0804b222 in main (argc=0, argv=0x1) at show.c:339
(gdb) list
28 if (!us1)
29 us1 = "";
30 if (!us2)
31 us2 = "";
32
33 while (tolower(*us1) == tolower(*us2++))
34 if (*us1++ == '\0')
35 return (0);
36 return (tolower(*us1) - tolower(*--us2));
37 }
(gdb) p us1
$1 = (const unsigned char *) 0x0
(gdb) p us2
$2 = (const unsigned char *) 0xbfd14b38 "Return-Path"
I can't figure out why 'us1' isn't set to "" but instead remains NULL,
despite the test at line 28 and assignment at line 29. But when I
single-step through that segfaulting call of strcasecmp() (using a
conditional breakpoint to stop before the segfault), it skips over
lines 28-31.
The compilation flags from the dpkg rebuild are -g -O2. When I
recompile with just '-g' (by taking out all mentions of -O or -O2 in
the source), then the segfault does not happen.
Not sure if that means it's a problem in gcc, or merely that the bug
is exposed by -O2 but not caused by -O2. In case it's a gcc problem:
$ gcc -v
gcc version 4.1.2 (Ubuntu 4.1.2-0ubuntu4)
[System is really Ubuntu 7.04 but with this pkg from Debian unstable.]
-- System Information:
Debian Release: 4.0
APT prefers feisty-updates
APT policy: (500, 'feisty-updates'), (500, 'feisty-security'), (500, 'feisty')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/dash
Kernel: Linux 2.6.20-15-generic
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Versions of packages nmh depends on:
ii base-files 4ubuntu2 Debian base system miscellaneous f
ii libc6 2.5-0ubuntu14 GNU C Library: Shared libraries
ii libdb4.5 4.5.20-1ubuntu1 Berkeley v4.5 Database Libraries [
ii liblockfile1 1.06.1ubuntu1 NFS-safe locking library, includes
ii libncurses5 5.5-5ubuntu2 Shared libraries for terminal hand
ii libsasl2-2 2.1.22.dfsg1-8ubuntu2 Authentication abstraction library
ii netbase 4.27ubuntu2 Basic TCP/IP networking system
Versions of packages nmh recommends:
ii exim4-daemon-light [mail-t 4.63-11build1 lightweight exim MTA (v4) daemon
ii metamail 2.7-52 implementation of MIME
-- no debconf information
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
