Re: smtp core dump

[Klemens Nanni]

Your bug report which ought to go to bugs@ is incomplete, please see
https://www.openbsd.org/report.html.

On Sat, Sep 08, 2018 at 11:35:47PM -0700, Jungle Boogie wrote:
> The backtrace is pretty uneventful, there's no debugging:
/usr/bin/smtp lacks debug symbols. Rebuild from source:

$ cd /usr/src/usr.bin/smtp
$ make obj
$ make DEBUG=-g3

Then either use the existing binary and core dump with your new symbols

$ egdb -e /usr/bin/smtp -s /usr/obj/usr.bin/smtp/smtp \
-c ./smtp.core -batch -ex bt

or reproduce the issue using the new binary (and possibly turning off
optimizations)

$ make clean
$ make DEBUG='-O0 -g3'
$ ./obj/smtp ...
$ egdb -se ./obj/smtp -c ./smtp.core -batch -ex bt

smtp core dump

[Jungle Boogie]

Hi All,

I'm only playing around with smtp(1), so my use case may be wrong. I'm
getting a coredump with it on OpenBSD snapshot from today (8 Sept).

My string to cause the core dump:

smtp -C -vv -F jungleboog...@gmail.com -s
smtp://user:p...@imap.gmail.com:587 jungleboog...@gmail.com

hello
trying host 74.125.195.108 port 587...
0x12f009456800: INIT -> BANNER
0x12f009456800: <<< 220 smtp.gmail.com ESMTP r23-v6sm25386962pfj.5 - gsmtp
0x12f009456800: BANNER -> EHLO
mta: 0x12f009456800: >>> EHLO puffer.in.mydomain.net
0x12f009456800: <<< 250-smtp.gmail.com at your service, [70.173.220.152]
0x12f009456800: <<< 250-SIZE 35882577
0x12f009456800: <<< 250-8BITMIME
0x12f009456800: <<< 250-STARTTLS
0x12f009456800: <<< 250-ENHANCEDSTATUSCODES
0x12f009456800: <<< 250-PIPELINING
0x12f009456800: <<< 250-CHUNKING
0x12f009456800: <<< 250 SMTPUTF8
0x12f009456800: EHLO -> STARTTLS
mta: 0x12f009456800: >>> STARTTLS
0x12f009456800: <<< 220 2.0.0 Ready to start TLS
validating server certificate...
0x12f009456800: STARTTLS -> EHLO
mta: 0x12f009456800: >>> EHLO puffer.in.mydomain.net
0x12f009456800: <<< 250-smtp.gmail.com at your service, [70.173.220.152]
0x12f009456800: <<< 250-SIZE 35882577
0x12f009456800: <<< 250-8BITMIME
0x12f009456800: <<< 250-AUTH LOGIN PLAIN XOAUTH2 PLAIN-CLIENTTOKEN OAUTHBEARER
XOAUTH
0x12f009456800: <<< 250-ENHANCEDSTATUSCODES
0x12f009456800: <<< 250-PIPELINING
0x12f009456800: <<< 250-CHUNKING
0x12f009456800: <<< 250 SMTPUTF8
0x12f009456800: EHLO -> STARTTLS
0x12f009456800: STARTTLS -> AUTH
0x12f009456800: AUTH -> AUTH_PLAIN
mta: 0x12f009456800: >>> AUTH PLAIN user:pass
0x12f009456800: <<< 501 5.5.2 Cannot Decode response r23-v6sm25386962pfj.5 -
gsmtp
rejected by server: 501 5.5.2 Cannot Decode response r23-v6sm25386962pfj.5 -
gsmtp
0x12f009456800: AUTH_PLAIN -> QUIT
mta: 0x12f009456800: >>> QUIT
0x12f009456800: <<< 221 2.0.0 closing connection r23-v6sm25386962pfj.5 - gsmtp
connection closed...
trying host 74.125.195.109 port 587...
0x12f009456c00: INIT -> BANNER
0x12f009456c00: <<< 220 smtp.gmail.com ESMTP z63-v6sm14785681pgd.69 - gsmtp
0x12f009456c00: BANNER -> EHLO
mta: 0x12f009456c00: >>> EHLO puffer.in.mydomain.net
0x12f009456c00: <<< 250-smtp.gmail.com at your service, [70.173.220.152]
0x12f009456c00: <<< 250-SIZE 35882577
0x12f009456c00: <<< 250-8BITMIME
0x12f009456c00: <<< 250-STARTTLS
0x12f009456c00: <<< 250-ENHANCEDSTATUSCODES
0x12f009456c00: <<< 250-PIPELINING
0x12f009456c00: <<< 250-CHUNKING
0x12f009456c00: <<< 250 SMTPUTF8
0x12f009456c00: EHLO -> STARTTLS
mta: 0x12f009456c00: >>> STARTTLS
0x12f009456c00: <<< 220 2.0.0 Ready to start TLS
Bus error (core dumped)


The backtrace is pretty uneventful, there's no debugging:

gdb) bt
#0  SSL_set_fd (s=0x12f06818ff00, fd=5) at /usr/src/lib/libssl/ssl_lib.c:580
#1  0x12edb7d035b6 in ?? () from /usr/bin/smtp
#2  0x12edb7d04e18 in ?? () from /usr/bin/smtp
#3  0x12edb7d0318d in ?? () from /usr/bin/smtp
#4  0x12effd9aeb6d in event_base_loop (base=0x12f068189800, flags=0) at 
/usr/src/lib/libevent/event.c:350
#5  0x12edb7d063ef in ?? () from /usr/bin/smtp
#6  0x12edb7d061f7 in ?? () from /usr/bin/smtp
#7  0x12edb7d00c56 in ?? () from /usr/bin/smtp
#8  0x in ?? ()

So what's going on with this?