[stunnel-users] Re: Stunnel Crash: Gmail SMTP over TLS

Wed Aug 23 18:14:43 CEST 2006

Wed Jun 14 13:32:39 2006
Shatadal Ghosh wrote,
> Stunnel crashes when I use it to send e-mail (SMTP via TLS) via gmail.
> 
> According to the e-mail client configuration page on the gmail website
> http://mail.google.com/support/bin/answer.py?answer=13287&topic=1555
> 
> I tried to use SMTP over TLS to connect to smtp.gmail.com:587
....

> 2006.06.14 03:17:26 LOG5[3956:2812]: Negotiations for smtp
> (client side) started
> 2006.06.14 03:17:26 LOG7[3956:2812]:  <- 220 mx.gmail.com ESMTP
> w66sm450524pyw
> 2006.06.14 03:17:26 LOG7[3956:2812]:  -> 220 mx.gmail.com ESMTP
> w66sm450524pyw
> 
> <logfile ends>

I have confused with the same problem on my FreeBSD executable.
gdb says,

....
2006.08.24 00:18:20 LOG7[65395:134637568]:  <- 220 dion.ne.jp ESMTP
2006.08.24 00:18:20 LOG7[65395:134637568]:  -> 220 dion.ne.jp ESMTP

Program received signal SIGBUS, Bus error.
fdputline (c=0x8076000, fd=7, line=0x8056237 "EHLO localhost") at network.c:565
565         safeconcat(line, crlf);
(gdb) until

Program terminated with signal SIGBUS, Bus error.
The program no longer exists.
----

safeconcat() may be safe, but argument pointers are used little
bit dangerous manner.

I had made a work around to address to it, and looks work fine
here. Similer codes could be in sources.




diff -ru stunnel-4.15.orig/src/network.c stunnel-4.15/src/network.c

--- stunnel-4.15.orig/src/network.c	Wed Mar  1 23:41:08 2006
+++ stunnel-4.15/src/network.c	Thu Aug 24 00:24:24 2006
@@ -555,6 +555,7 @@
 
 void fdputline(CLI *c, int fd, char *line) {
     char logline[STRLEN];
+    char xline[STRLEN];
     const char crlf[]="\r\n";
 
     if(strlen(line)+2>=STRLEN) { /* 2 for crlf */
@@ -562,8 +563,9 @@
         longjmp(c->err, 1);
     }
     safecopy(logline, line); /* the line without crlf */
-    safeconcat(line, crlf);
-    write_blocking(c, fd, line, strlen(line));
+    safecopy(xline, line); /* the line without crlf */
+    safeconcat(xline, crlf);
+    write_blocking(c, fd, xline, strlen(xline));
     safestring(logline);
     s_log(LOG_DEBUG, " -> %s", logline);
 }

