Malloc bugs exhibited in ports/mail/dovecot

[Jason Evans]

On Jan 18, 2006, at 3:07 PM, SANETO Takanori wrote:
> I experienced this using malloc.c 1.95.
> assert("arenas != NULL") failed in malloc.c:4519.
>
> To reproduce, build mail/dovecot (under either version of malloc.c)  
> and
> run it under libc of malloc.c rev 1.95. imap-login and pop3-login  
> dump core.
>
> My environment is:
> FreeBSD 7-CURRENT as of 2006/01/15 (+latest libc including malloc.c  
> 1.95)
> in VMware 4.5.3
> sysctl hw.ncpu = 1
>
> % ldd /usr/local/libexec/dovecot/imap-login
> /usr/local/libexec/dovecot/imap-login:
>         libssl.so.4 => /usr/lib/libssl.so.4 (0x2809b000)
>         libcrypto.so.4 => /lib/libcrypto.so.4 (0x280cc000)
>         libc.so.6 => /lib/libc.so.6 (0x281d2000)

This is due to:

1) A bug in malloc.  If malloc() fails the first time it is called,  
this causes a fatal error rather than returning NULL.  This is fixed  
in revision 1.96 of malloc.c.

2) Low resource limits set by dovecot.  malloc extends the heap in  
increments of 16 MB, and dovecot's resource limits are set low enough  
that malloc immediately fails.  The attached patch to the dovecot  
port works around this.  Another reasonable workaround would be to  
define _malloc_options to be "k" (or "kk", or ...) in the dovecot  
source code.  A short term (but not generally recommended, since it  
affects all programs) workaround would be to set /etc/malloc.conf to  
'k'.

Thanks,
Jason
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dovecot.diff
Type: application/octet-stream
Size: 677 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20060118/2c160def/dovecot.obj
-------------- next part --------------