[pkg-kolab] Bug#411240: kolab-cyrus-imapd: Corrupt quota files cause data loss

[Ulrich P. Klein]

Package: kolab-cyrus-imapd
Version: 2.2.13-2
Severity: grave
Justification: renders package unusable

Today I discovered that lmtpd segfaulted on any local mail.  After a
little inveestigating, I found that the problem was caused by the
following lines in imap/quota_db.c:

---8<------
int quota_read(struct quota *quota, struct txn **tid, int wrlock)
{
    int r;
    int qrlen;
    const char *data;
    int datalen;

    if (!quota->root || !(qrlen = strlen(quota->root)))
        return IMAP_QUOTAROOT_NONEXISTENT;

    if (wrlock)
        r = QDB->fetchlock(qdb, quota->root, qrlen, &data, &datalen, tid);
    else
        r = QDB->fetch(qdb, quota->root, qrlen, &data, &datalen, tid);

    switch (r) {
    case CYRUSDB_OK:
        sscanf(data, "%lu %d", &quota->used, &quota->limit);
        break;
---8<------

An ltrace showed that data pointed to 0 when sscanf was called.  I found
two files:
  /var/lib/cyrus/domain/u/ulrich-p-klein.de/quota/k/user.klein
  /var/lib/cyrus/domain/u/ulrich-p-klein.de/quota/k/user.klein.NEW
The first file was empty, the second (sorry, I didn't keep it) was 5
bytes long.  Calling cyrqouta or cyrquota -f didn't help.

After removal of those files, everything worked fine.

-- System Information:
Debian Release: 4.0
  APT prefers testing-proposed-updates
  APT policy: (900, 'testing-proposed-updates'), (900, 'testing'), (400, 'stable'), (300, 'unstable')
Architecture: amd64 (x86_64)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18amd64
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)

Versions of packages kolab-cyrus-imapd depends on:
ii  kolab-cy 2.2.13-2                        Cyrus mail system (common files)
ii  libc6    2.3.6.ds1-12                    GNU C Library: Shared libraries
ii  libcomer 1.39+1.40-WIP-2006.11.14+dfsg-1 common error description library
ii  libdb4.2 4.2.52+dfsg-1                   Berkeley v4.2 Database Libraries [
ii  libkrb53 1.6.dfsg~alpha1-1               MIT Kerberos runtime libraries
ii  libldap2 2.1.30-13.2                     OpenLDAP libraries
ii  libsasl2 2.1.22.dfsg1-8                  Authentication abstraction library
ii  libssl0. 0.9.8c-4                        SSL shared libraries
ii  libwrap0 7.6.dbs-12                      Wietse Venema's TCP wrappers libra

kolab-cyrus-imapd recommends no packages.

-- no debconf information