marlam / mpop

POP3 client
https://marlam.de/mpop
GNU General Public License v3.0
13 stars 1 forks source link

Segfault after retrieving all messages #7

Closed skiironmask closed 2 years ago

skiironmask commented 2 years ago

It's possible that this is a configuration issue, so I am including my configuration here.

Mpop seems to segfault after downloading all messages from the target, but before the DELE's take place. This results in messages being downloaded repeatedly. I have tried this on versions 1.4.13 and 1.2.6(latest from distro repository). Let me know what other information I need to provide.

Config:

account aol
        host pop.aol.com
        port 995
        timeout 5
        auth on
        user ***********
        password **********
        tls on
        tls_starttls off
        tls_certcheck off
        delivery maildir /home/mail/local/
account default : aol

Last few lines from an strace

write(5, "Received: from pop.aol.com (jpop"..., 3908) = 3908
write(1, "100\n", 4100
)                    = 4
fsync(5)                                = 0
close(5)                                = 0
link("tmp/1631233776.M510392P23924Q5.onyx", "new/1631233776.M510392P23924Q5.onyx") = 0
unlink("tmp/1631233776.M510392P23924Q5.onyx") = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
+++ killed by SIGSEGV (core dumped) +++
Segmentation fault (core dumped)
marlam commented 2 years ago

I cannot reproduce the problem on my system, and the strace looks normal to me. What system are you running on, and what's the output of mpop --version (to see which libraries are in use)?

skiironmask commented 2 years ago

Here is the output of mpop --version

Platform: x86_64-pc-linux-gnu
TLS/SSL library: GnuTLS
Authentication library: built-in
Supported authentication methods:
user plain external apop cram-md5 login oauthbearer xoauth2
IDN support: disabled
NLS: enabled, LOCALEDIR is /usr/local/share/locale
Keyring support: none
Configuration file name: /root/.mpoprc

Copyright (C) 2021 Martin Lambers and others.
This is free software.  You may redistribute copies of it under the terms of
the GNU General Public License <http://www.gnu.org/licenses/gpl.html>.
There is NO WARRANTY, to the extent permitted by law.

Additionally, here is the output when using 1.2.6

mpop version 1.2.6
Platform: x86_64-pc-linux-gnu
TLS/SSL library: GnuTLS
Authentication library: GNU SASL; user and apop: built-in
Supported authentication methods:
user plain scram-sha-1 external gssapi apop cram-md5 digest-md5 login ntlm
IDN support: enabled
NLS: enabled, LOCALEDIR is /usr/share/locale
Keyring support: none
Configuration file name: /root/.mpoprc

Copyright (C) 2016 Martin Lambers and others.
This is free software.  You may redistribute copies of it under the terms of
the GNU General Public License <http://www.gnu.org/licenses/gpl.html>.
There is NO WARRANTY, to the extent permitted by law.

GDB

(gdb) bt
#0  0x0000555555560b6f in mpop_retrmail (canonical_hostname=<optimized out>, local_user=<optimized out>,
    acc=0x555555795f60, debug=<optimized out>, print_status=<optimized out>, print_progress=<optimized out>,
    auth_only=0, status_only=0, errmsg=0x7fffffffdc18, errstr=0x7fffffffdc10) at mpop.c:1089
#1  0x000055555555a3af in main (argc=<optimized out>, argv=<optimized out>) at mpop.c:2738

Getting a bit out of my depth here but


(gdb) disass 0x0000555555560b6f
----------snip------------
   0x0000555555560b4d <+3261>:  mov    0x10(%rsp),%rdi
   0x0000555555560b52 <+3266>:  lea    0x1(%rdx),%rax
   0x0000555555560b56 <+3270>:  mov    %rax,0x8(%rsp)
   0x0000555555560b5b <+3275>:  mov    0x18(%rdi),%rax
   0x0000555555560b5f <+3279>:  lea    (%rax,%rdx,8),%rdx
   0x0000555555560b63 <+3283>:  mov    0x14f8(%rbx),%rax
   0x0000555555560b6a <+3290>:  mov    %rdx,0x18(%rsp)
=> 0x0000555555560b6f <+3295>:  mov    (%rax,%r15,8),%rdi
   0x0000555555560b73 <+3299>:  callq  0x555555569070 <xstrdup>
   0x0000555555560b78 <+3304>:  mov    0x18(%rsp),%rdx
   0x0000555555560b7d <+3309>:  mov    %rax,(%rdx)
   0x0000555555560b80 <+3312>:  mov    0x8(%rsp),%rdx
   0x0000555555560b85 <+3317>:  add    $0x1,%r15
   0x0000555555560b89 <+3321>:  cmp    %r15,0x14c0(%rbx)
-------------snip----------
skiironmask commented 2 years ago

Now way out of what I know, if I change this in mpop.c:

           for (i = 0; i < session->total_number; i++)
            {
                if (session->is_old[i])
                {
                        uidl->uidv[j++] = xstrdup(session->msg_uid[i]);
                }
            }
        }
    }

to

           for (i = 0; i < session->total_number; i++)
            {
                if (session->is_old[i])
                {
                        /* uidl->uidv[j++] = xstrdup(session->msg_uid[i]); */
                }
            }
        }
    }

I get a different error when it downloads mail but it appears to work anyway.

root@onyx:~/mpop-1.4.13# mpop
************** at pop.aol.com:
new: 1 message, total: 1 message
retrieving message 1 of 1 (2.77 KiB): 100%
free(): double free detected in tcache 2
Aborted (core dumped)

root@onyx:~/mpop-1.4.13# mpop
************** at pop.aol.com:
no messages
marlam commented 2 years ago

This is starting to look like the issue I fixed on August 26.

Can you test the latest version from git and see if that fixes the problem?

If that is the case, then this means there is a problem with the UIDLs on pop.aol.com. Can you post the output of --debug (without the AUTH lines so that your password cannot be reconstructed, and without mail contents)? That would allow to analyze the problem further.

Thank you for your help!

skiironmask commented 2 years ago

I installed the 1.4.13 because the version from the git with the instructions on your website wouldn't compile for me. This is what I get when trying to compile that version

rm -f de.gmo && /usr/bin/msgmerge @MSGMERGE_FOR_MSGFMT_OPTION@ -o de.1po de.po mpop.pot && /usr/bin/msgfmt -c --statistics --verbose -o de.gmo de.1po && rm -f de.1po
/usr/bin/msgmerge: exactly 2 input files required
using account default from /root/.mpoprc
host = pop.aol.com
port = 995
source ip = (not set)
proxy host = (not set)
proxy port = 0
socket = (not set)
timeout = 5 seconds
pipelining = auto
received_header = on
auth = choose
user = @aol.com
password = *
passwordeval = (not set)
ntlmdomain = (not set)
tls = on
tls_starttls = off
tls_trust_file = system
tls_crl_file = (not set)
tls_fingerprint = (not set)
tls_key_file = (not set)
tls_cert_file = (not set)
tls_certcheck = off
tls_min_dh_prime_bits = (not set)
tls_priorities = (not set)
tls_host_override = (not set)
delivery = maildir /home/mail/local/
uidls file = /root/.mpop_uidls/@aol.com_at_pop.aol.com
only_new = on
keep = off
killsize = off
skipsize = off
filter = (not set)
TLS session parameters:
    (TLS1.2)-(ECDHE-RSA-SECP256R1)-(AES-256-GCM)
TLS certificate information:
    Subject:
        C=US,ST=California,L=Sunnyvale,O=Oath Inc,CN=pop.aol.com
    Issuer:
        C=US,O=DigiCert Inc,OU=www.digicert.com,CN=DigiCert SHA2 High Assurance Server CA
    Validity:
        Activation time: Mon Aug  2 18:00:00 2021
        Expiration time: Wed Jan 26 16:59:59 2022
    Fingerprints:
        SHA256: 61:F4:8E:AE:E6:F5:F3:90:D7:78:F7:0C:4D:91:F6:09:00:3E:67:51:00:1B:A7:D6:FD:D8:65:21:9F:B2:D3:35
        SHA1 (deprecated): 10:FD:8D:78:8C:4E:49:11:B6:B8:E6:E2:05:EC:99:70:C3:CB:A7:EB
<-- +OK Hello from jpop-0.1
--> CAPA
<-- +OK CAPA list follows
<-- IMPLEMENTATION jpop-0.1
<-- TOP
<-- USER
<-- SASL LOGIN PLAIN
<-- .
--> AUTH PLAIN
<-- +
--> ==
<-- +OK Maildrop ready, (JPOP server ready).
--> CAPA
<-- +OK CAPA list follows
<-- IMPLEMENTATION jpop-0.1
<-- TOP
<-- USER
<-- SASL LOGIN PLAIN
<-- .
--> STAT
<-- +OK 0 0
********** at pop.aol.com:
no messages
--> QUIT
<-- +OK Server signing off.

Update: I applied the diff that you linked and it works without error now.

marlam commented 2 years ago

OK, the compile problem is probably caused by a gettext version incompatibility (this keeps biting us but there's not much I can do about it); you may be able to work around this with gettextize -f but that may require some manual tweaks.

About the UIDL issue: The server does not advertise "UIDL" in the response to the CAPA command, indicating that it does not support UID lists - which means you cannot know which messages were already downloaded and which are new. However, mpop tries the UIDL command anyway (if there are any mails; in your example there are none) because some servers don't advertise UIDL but support it anyway. Only when UIDL is truly not available is the error triggered.

This "jpop-0.1" server implementation apparently really does not support UIDL even though virtually all POP3 servers support it for ages, see e.g. this neomutt issue. And this is used by AOL and Yahoo?! I wonder what's going on there...

skiironmask commented 2 years ago

Thanks for the help and explanation Marlam!