OpenSolaris

Printable Version Enter a New Search
Bug ID 6568603
Synopsis mail.local leaks memory
State 10-Fix Delivered (Fix available in build)
Category:Subcategory utility:sendmail
Keywords
Responsible Engineer John Beck
Reported Against
Duplicate Of
Introduced In solaris_8
Commit to Fix snv_68
Fixed In snv_68
Release Fixed solaris_nevada(snv_68) , solaris_10u5(s10u5_01) (Bug ID:2150862) solaris_9u8(s9u8_08) (Bug ID:2150863,)
Related Bugs 4175156
Submit Date 12-June-2007
Last Update Date 3-July-2007
Description
mail.local leaks memory as reported by fujitsu.

The process size of mail.local grows in proportion to the number of mail 
in   
/var/spool/mqueue.   
    Store() is called for one mail. Therefore, the more the number of mail incre
ases,   
    the more memory necessary to transmit mail grows. 
 
The analysis of mail.local.c is as follows. 
 
---------------------------------------- 
 
int 
main(argc, argv) 
 int argc; 
 char *argv[]; 
{ 
 struct passwd *pw; 
 int ch; 
 
    <...snip...> 
 
 for (store(from, 0); *argv; ++argv) 
      ~~~~~~~~~~~~~~~ Store() is called for one mail. 
  deliver(hfd, bfd, *argv, bouncequota); 
 return (eval); 
} 
 
static void 
store(from, lmtprcpts) 
 char *from; 
 int lmtprcpts; 
{ 
 FILE *fp = NULL; 
 time_t tval; 
 
    <...snip...> 
 
  if (in_header_section) { 
   if (strncasecmp("Content-Length:", line, 15) == 0) { 
    continue; /* skip this header */ 
   } 
  } else 
   content_length += strlen(line); 
  (void) fwrite(line, sizeof(char), line_len, fp); 
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The memory is acquired with f
write() included in store(),   
  if (ferror(fp)) { 
   if (lmtprcpts) { 
    while (lmtprcpts--) 
     printf("451 4.3.0 temporary file write error\r\n"); 
    fclose(fp); 
    ~~~~~~~~~~~When the error happens, the memory is opened. 
    return; 
   } else { 
    mailerr("451 4.3.0", 
 
    <...snip...> 
 
 } 
 
 (void) time(&tval); 
 (void) snprintf(unix_from_line, sizeof (unix_from_line), "From %s %s", 
     from, ctime(&tval)); 
 ulen = strlen(unix_from_line); 
} 
 
  ==> when store() ends normally, fclose(fp) is not executed ! 

-----
Work Around
N/A
Comments
N/A