302978 - sending password when using sendmail causes apache crash with bad headers

Status: RESOLVED WORKSFORME

(Bugzilla :: User Accounts, defect)

Description

[Chris Dawson]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

If you set the MTA to sendmail and then attempt to send password credentials, a
crash occurs because $mailer->close seems to print to stdout, which causes a
crash in apache when it receives headers prematurely.  I think this occurs here:
Bugzilla/BugMail.pm on line 633.

Reproducible: Always

Steps to Reproduce:
1.  Set MTA to sendmail, save settings
2.  Logout
3.  Go to login page, enter username to retrieve password
4.  Apache crashes
5.  Look in logs, notice this line:  [Mon Aug 01 11:48:21 2005] [error] [client
192.168.1.1] malformed header from script. Bad
header=/var/lib/nobody/dead.letter...: token.cgi, referer: http
s://.../bugzilla/index.cgi?GoAheadAndLogIn=1

Actual Results:  
Log files indicate:

[Mon Aug 01 11:48:21 2005] [error] [client 192.168.1.1] malformed header from
script. Bad header=/var/lib/nobody/dead.letter...: token.cgi, referer: http
s://.../bugzilla/index.cgi?GoAheadAndLogIn=1

This usually means that a CGI has printed to stdout prematurely and this has
confused apache.  The normal CGI procedure is that the CGI prints a few headers,
and then prints the body of the HTML.  In this case I believe the mailer prints
some debugging information which confuses apache.

Expected Results:  
Should not crash, should send out email to the user.

Comment 1

[Joel Peshkin]

This WORKS4ME, even if I use an address that would cause sendmail to use dead.letter

Comment 2

[Frédéric Buclin]

WFM too.