[exim-dev] [Bug 1708] Segfault on lsearch lookup

https://bugs.exim.org/show_bug.cgi?id=1708

--- Comment #7 from Sylvain LÉVÊQUE <sylvain.leveque+bugreport@???> ---
More info for you with gdb. This is on search.c as patched by Debian. I don't
know where I can find 4d3b8805796ffa39889060d9f216bfaf7391c542 so I figured
this out by getting the source of the Debian package. The latest Exim git
version seems to include this (I didn't check in detail).

   495  if (  (t = tree_search(c->item_cache, keystring))
   496     && (!(e = t->data.ptr)->expiry || e->expiry > time(NULL))
   497     )
   498    { /* Data was in the cache already; set the pointer from the tree
node */
   499    data = e->ptr;
   500    DEBUG(D_lookup) debug_printf("cached data used for lookup of
%s%s%s\n",
   501      keystring,
   502      filename ? US"\n  in " : US"", filename ? filename : US"");
   503    }

   541      else
   542        {
   543        t = store_get(sizeof(tree_node) + len + sizeof(expiring_data));
   544        e = (expiring_data *)((char *)t + sizeof(tree_node) + len);
   545        e->expiry = do_cache == UINT_MAX ? 0 : time(NULL)+do_cache;
   546        e->ptr = data;
   547        memcpy(t->name, keystring, len);
   548        t->data.ptr = e;
   549        tree_insertnode(&c->item_cache, t);
   550        }

I removed some output for clarity.

On armel:
# gdb exim
(gdb) break search.c:500
Breakpoint 1 at 0x6cff0: file search.c, line 500.
(gdb) break search.c:547
Breakpoint 2 at 0x6d30c: file search.c, line 547.
(gdb) run -C /tmp/exim.conf -d+rewrite+expand -brw root@???
Breakpoint 2, internal_search_find (handle=<optimized out>, filename=<optimized
out>, keystring=0xb8860bd0 "root") at search.c:548
(gdb) p data
$1 = (uschar *) 0xb8862ae0 "hans@???"
(gdb) c
Breakpoint 1, internal_search_find (handle=<optimized out>, filename=0xb8860c60
"/tmp/email-addresses", keystring=0xb8860c58 "root") at search.c:500
(gdb) n [a few times, until I see]
cached data used for lookup of root
  in /tmp/email-addresses
563     in search.c
(gdb) p data
$3 = (uschar *) 0xe0b8862a <error: Cannot access memory at address 0xe0b8862a>

On amd64:
# gdb exim
(gdb) break search.c:500
Breakpoint 1 at 0x6aed4: file search.c, line 500.
(gdb) break search.c:547
Breakpoint 2 at 0x6b213: file search.c, line 547.
(gdb) run -C /tmp/exim.conf -d+rewrite+expand -brw root@???
Breakpoint 2, internal_search_find (handle=<optimized out>, filename=<optimized
out>, keystring=0x7f05ec416060 "root") at search.c:548
(gdb) p data
$1 = (uschar *) 0x7f05ec417fd0 "hans@???"
(gdb) c
Breakpoint 1, internal_search_find (handle=<optimized out>,
filename=0x7f05ec4160f0 "/tmp/email-addresses", keystring=0x7f05ec4160e8
"root") at search.c:500
(gdb) n [a few times, until I see]
cached data used for lookup of root
  in /tmp/email-addresses
563     in search.c
(gdb) p data
$2 = (uschar *) 0x7f05ec417fd0 "hans@???"

So on armel, it's not reading back the proper value.
--
Sylvain

--
You are receiving this mail because:
You are on the CC list for the bug.