#7 mairix 0.22 segfaults when scanning a mbox file
Running mairix on one specific mbox (out of hundreds) causes a segfault.
$ mairix -v
mairix 0.22, Copyright (C) 2002-2010 Richard P. Curnow
mairix comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it
under certain conditions; see the GNU General Public License for details.
Finding all currently existing messages...
Starting new database
Scanning mbox /cluster_cm/duty/mail/read-mail//read_20101105 : 100% done
0 newly dead messages, 0 messages now dead in total
Scanning /cluster_cm/duty/mail/read-mail//read_20101105[0] at [63,29828)
Scanning /cluster_cm/duty/mail/read-mail//read_20101105[1] at [29883,31500)
...
Scanning /cluster_cm/duty/mail/read-mail//read_20101105[313] at [1227510,1228156)
Segmentation Fault (core dumped)
I already tried to identify the message which might be causing the segfault (extracted the message around the byte range ([1227510,1228156))), but only this single message in a mbox doesn't cause a segfault. I have a non-stripped mairix binary at hand, so if you could let me know how we can identify the culprit, I will gladly do so. Platform: Solaris 10 SPARC.
$ pstack core
core 'core' of 11684: mairix -v
0001bda8 split_and_splice_header (49ce8, fef2bdad, ffbffb78, ffbffb84, ff1f2a00, 42) + b8
0001d52c data_to_rfc822 (49ce8, fef2bdad, 253, ffbffc28, ff3303a8, 52) + 94
0002e614 add_mbox_messages (4c268, 35aa4, 0, 90e00, 47188, 34) + 31c
0001978c update_database (4c268, 0, 0, 0, ff3303a8, 1b) + 5fc
00015580 main (2, ffbffe0c, ffbffe18, 47400, ff1f00c0, 0) + 10d0
000128e0 _start (0, 0, 0, 0, 0, 0) + 108
Addendum: I ran mairix in dbx (the gdb of Solaris) and noticed that the mail being processed when segfaulting is _not_ the one at the last displayed byte range, but the following one - happens to be the last one in the mbox.
I still can't reproduce the issue when i reduce the mailbox to this single message. What's noticable though is that the mbox and message are truncated. The last line is a subject line and ends halfway. Maybe that's enough information to locate the code which causes mairix to segfault. Otherwise, just let me know, I can then gather further data.
$ tail -1 /cluster_cm/duty/mail/read-mail//read_20101105
Subject: Friendly reminder (Suppressed Alert$
For the time being, I have a workaround in place. Delete this last (and truncated) message from the mbox. mairix then processes the whole mbox without any hickups.