[Dovecot] imap-login: memory corruption

[Ralf Hildebrandt]

* Timo Sirainen <tss at iki.fi>:

> valgrind --log-file=/tmp/imap.%p could be helpful there then.
Yes, done that now.
Better
> But does it keep logging something? With me it logs one error when the
> process
> starts:
> 
> ==6036== Syscall param socketcall.sendmsg(msg.msg_iov[i]) points to uninitialised byte(s)
> ==6036==    at 0x40007D2: (within /lib/ld-2.8.90.so)
> ==6036==    by 0x804F94E: master_request_login (master.c:87)
> ==6036==    by 0x8054D86: auth_client_input_ok (auth-server-request.c:194)
> 
> After that there's nothing. Probably all output after that are bugs
> (maybe this one too, but I haven't managed to figure out how it could be
> fixed).
> 
> Oh, and valgrind -q also makes it more quiet if you want to keep logging
> to Dovecot logs.

I get:

==9769== Memcheck, a memory error detector.
==9769== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==9769== Using LibVEX rev 1854, a library for dynamic binary translation.
==9769== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==9769== Using valgrind-3.3.1-Debian, a dynamic binary instrumentation framework.
==9769== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==9769== For more details, rerun with: -v
==9769== 
==9769== My PID = 9769, parent PID = 9306.  Prog and args are:
==9769==    /usr/local/libexec/dovecot/imap-login
==9769== 
==9769== Conditional jump or move depends on uninitialised value(s)
==9769==    at 0x40F09F7: BN_mod_inverse (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F48E0: BN_MONT_CTX_set (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40E93C1: BN_mod_exp_mont (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40E9BBF: BN_mod_exp (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40EFA3F: BN_BLINDING_create_param (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410BD55: RSA_setup_blinding (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109A0C: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109F94: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410B91D: RSA_private_decrypt (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40447F3: ssl3_get_client_key_exchange (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x4047244: ssl3_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x405FCB9: SSL_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769== 
==9769== Conditional jump or move depends on uninitialised value(s)
==9769==    at 0x40E7451: BN_div (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40ED531: BN_nnmod (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F130A: BN_mod_inverse (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F48E0: BN_MONT_CTX_set (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40E93C1: BN_mod_exp_mont (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40E9BBF: BN_mod_exp (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40EFA3F: BN_BLINDING_create_param (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410BD55: RSA_setup_blinding (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109A0C: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109F94: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410B91D: RSA_private_decrypt (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40447F3: ssl3_get_client_key_exchange (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769== 
==9769== Conditional jump or move depends on uninitialised value(s)
==9769==    at 0x40E7451: BN_div (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4942: BN_MONT_CTX_set (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40E93C1: BN_mod_exp_mont (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40E9BBF: BN_mod_exp (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40EFA3F: BN_BLINDING_create_param (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410BD55: RSA_setup_blinding (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109A0C: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109F94: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410B91D: RSA_private_decrypt (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40447F3: ssl3_get_client_key_exchange (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x4047244: ssl3_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x405FCB9: SSL_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769== 
==9769== Conditional jump or move depends on uninitialised value(s)
==9769==    at 0x40F09F7: BN_mod_inverse (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F48E0: BN_MONT_CTX_set (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4C27: BN_MONT_CTX_set_locked (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x41097DD: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109DD2: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410B91D: RSA_private_decrypt (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40447F3: ssl3_get_client_key_exchange (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x4047244: ssl3_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x405FCB9: SSL_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x8050F4A: ssl_step (ssl-proxy-openssl.c:399)
==9769==    by 0x80599CF: io_loop_handler_run (ioloop-epoll.c:203)
==9769==    by 0x8058E3F: io_loop_run (ioloop.c:326)
==9769== 
==9769== Conditional jump or move depends on uninitialised value(s)
==9769==    at 0x40E7451: BN_div (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4942: BN_MONT_CTX_set (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4C27: BN_MONT_CTX_set_locked (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x41097DD: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109DD2: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410B91D: RSA_private_decrypt (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40447F3: ssl3_get_client_key_exchange (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x4047244: ssl3_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x405FCB9: SSL_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x8050F4A: ssl_step (ssl-proxy-openssl.c:399)
==9769==    by 0x80599CF: io_loop_handler_run (ioloop-epoll.c:203)
==9769==    by 0x8058E3F: io_loop_run (ioloop.c:326)
==9769== 
==9769== Conditional jump or move depends on uninitialised value(s)
==9769==    at 0x40F09F7: BN_mod_inverse (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F48E0: BN_MONT_CTX_set (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4C27: BN_MONT_CTX_set_locked (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410980D: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109DD2: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410B91D: RSA_private_decrypt (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40447F3: ssl3_get_client_key_exchange (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x4047244: ssl3_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x405FCB9: SSL_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x8050F4A: ssl_step (ssl-proxy-openssl.c:399)
==9769==    by 0x80599CF: io_loop_handler_run (ioloop-epoll.c:203)
==9769==    by 0x8058E3F: io_loop_run (ioloop.c:326)
==9769== 
==9769== Conditional jump or move depends on uninitialised value(s)
==9769==    at 0x40E7451: BN_div (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4942: BN_MONT_CTX_set (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4C27: BN_MONT_CTX_set_locked (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410980D: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109DD2: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410B91D: RSA_private_decrypt (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40447F3: ssl3_get_client_key_exchange (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x4047244: ssl3_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x405FCB9: SSL_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x8050F4A: ssl_step (ssl-proxy-openssl.c:399)
==9769==    by 0x80599CF: io_loop_handler_run (ioloop-epoll.c:203)
==9769==    by 0x8058E3F: io_loop_run (ioloop.c:326)
==9769== 
==9769== Conditional jump or move depends on uninitialised value(s)
==9769==    at 0x40F09F7: BN_mod_inverse (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F48E0: BN_MONT_CTX_set (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4C27: BN_MONT_CTX_set_locked (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109840: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109DD2: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410B91D: RSA_private_decrypt (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40447F3: ssl3_get_client_key_exchange (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x4047244: ssl3_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x405FCB9: SSL_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x8050F4A: ssl_step (ssl-proxy-openssl.c:399)
==9769==    by 0x80599CF: io_loop_handler_run (ioloop-epoll.c:203)
==9769==    by 0x8058E3F: io_loop_run (ioloop.c:326)
==9769== 
==9769== Conditional jump or move depends on uninitialised value(s)
==9769==    at 0x40E7451: BN_div (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4942: BN_MONT_CTX_set (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4C27: BN_MONT_CTX_set_locked (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109840: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4109DD2: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x410B91D: RSA_private_decrypt (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40447F3: ssl3_get_client_key_exchange (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x4047244: ssl3_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x405FCB9: SSL_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x8050F4A: ssl_step (ssl-proxy-openssl.c:399)
==9769==    by 0x80599CF: io_loop_handler_run (ioloop-epoll.c:203)
==9769==    by 0x8058E3F: io_loop_run (ioloop.c:326)
==9769== 
==9769== Syscall param socketcall.sendmsg(msg.msg_iov[i]) points to uninitialised byte(s)
==9769==    at 0x4295D6C: sendmsg (in /usr/lib/debug/libc-2.7.so)
==9769==    by 0x804F3A6: master_request_login (master.c:87)
==9769==    by 0x8054406: auth_client_input_ok (auth-server-request.c:194)
==9769==    by 0x8053589: auth_client_input (auth-server-connection.c:136)
==9769==    by 0x80599CF: io_loop_handler_run (ioloop-epoll.c:203)
==9769==    by 0x8058E3F: io_loop_run (ioloop.c:326)
==9769==    by 0x804E839: main (main.c:482)
==9769==  Address 0xbefe68be is on thread 1's stack
==9769== 
==9769== Conditional jump or move depends on uninitialised value(s)
==9769==    at 0x40F09F7: BN_mod_inverse (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F48E0: BN_MONT_CTX_set (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4C27: BN_MONT_CTX_set_locked (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4113D10: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4113821: DH_generate_key (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4045A4C: ssl3_send_server_key_exchange (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x4047997: ssl3_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x405FCB9: SSL_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x4051DDF: ssl23_get_client_hello (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x40526D7: ssl23_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x405FCB9: SSL_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x8050F4A: ssl_step (ssl-proxy-openssl.c:399)
==9769== 
==9769== Conditional jump or move depends on uninitialised value(s)
==9769==    at 0x40E7451: BN_div (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4942: BN_MONT_CTX_set (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x40F4C27: BN_MONT_CTX_set_locked (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4113D10: (within /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4113821: DH_generate_key (in /usr/lib/i686/cmov/libcrypto.so.0.9.8)
==9769==    by 0x4045A4C: ssl3_send_server_key_exchange (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x4047997: ssl3_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x405FCB9: SSL_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x4051DDF: ssl23_get_client_hello (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x40526D7: ssl23_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x405FCB9: SSL_accept (in /usr/lib/i686/cmov/libssl.so.0.9.8)
==9769==    by 0x8050F4A: ssl_step (ssl-proxy-openssl.c:399)

-- 
Ralf Hildebrandt (Ralf.Hildebrandt at charite.de)          snickebo at charite.de
Postfix - Einrichtung, Betrieb und Wartung       Tel. +49 (0)30-450 570-155
http://www.arschkrebs.de
This signature was added just to have one. ;-)