Unexplainable behavior from pop3proxyd

[Eli Ben-Shoshan]

I have observed a weird behaviour out of the pop3 proxy. When the proxy 
quits it dumps core. When I examine the core with gdb it tells me that 
it dumps core when calling FD_SET in function prot_fill line 402 of 
prot.c. I then proceeded to run the program in gdb and found out that 
pop3proxyd was dumping core becasue the file descriptor passed to FD_SET 
is invalid. When I steped through the program, I found that s->fd 
changed after the call to prot_flush(s->flushonread) in line 371 of 
prot.c. It usually changes to either a very large integer (1.7 million) 
or a negative number. What is even more strange is that if I put an 
empty syslog in function shut_down at line 406 of pop3proxyd, the 
problem stops occuring most of the time. This really boggled my brain 
for a few days since I could not see anything in prot_flush that could 
do this. Has anyone had this problem? I did come up with a patch that 
seems to have stoped the problem from occuring which I have attached to 
this email. Here are the stats for the system I am running this on:

AIX 4.3.3
cyrus-imapd 2.1.11
cyrus-sasl 2.1.7
BerkleyDB 4.0.14
Any assistance would be great. Thanks.

--
Eli Ben-Shoshan                                  [EMAIL PROTECTED]
Computer Programmer-Analyst
University of Florida Computing and Networking Services
VOX: (352) 392-2061                              FAX: (352) 392-9440
--- cyrus-imapd-2.1.11/lib/prot.c       Mon Oct 21 16:44:22 2002
+++ cyrus-imapd-2.1.11-hacked/lib/prot.c        Fri Feb 28 11:05:24 2003
@@ -333,6 +333,7 @@
     int haveinput; 
     time_t read_timeout;
     struct prot_waitevent *event, *next;
+    int fd_before, fd_after = s->fd;
    
     assert(!s->write);
 
@@ -368,11 +369,18 @@
                    s->readcallback_proc = 0;
                    s->readcallback_rock = 0;
                }
+               fd_before = s->fd;
                if (s->flushonread) prot_flush(s->flushonread);
+               fd_after = s->fd;
            }
            else {
                haveinput = 1;
            }
+       }
+
+       if ( fd_before != fd_after ) {
+         syslog(LOG_DEBUG,"[OSG] file descriptor changed: [%d] [%d]", fd_before, 
fd_after);
+         s->fd = fd_before;
        }
 
        if (!haveinput && (s->read_timeout || s->dontblock)) {