#1149106 exim4-daemon-heavy: Exim4 crashes (SEGV) on 32bit armhf when delivering to Maildir

Package:
exim4-daemon-heavy
Source:
exim4-daemon-heavy
Description:
Exim MTA (v4) daemon with extended features, including exiscan-acl
Submitter:
Vincas Dargis
Date:
2026-10-05 18:31:02 UTC
Severity:
normal
Tags:
#1149106#5
Date:
2026-09-26 15:56:00 UTC
From:
To:
Dear Maintainer,

Upgraded my Odroid-HC1 ARM device from Debian 12 -> Debian 13 and Exim
stopped delivering (receiving) email with SEGV:

```
18:09:29 7887 appendfile: mode=600 notify_comsat=0 quota=0 warning=0
18:09:29 7887   directory=/home/vmail/example.com/username/Maildir format=maildir
18:09:29 7887   message_prefix=null
18:09:29 7887   message_suffix=null
18:09:29 7887   maildir_use_size_file=no
18:09:29 7887 ensuring maildir directories exist in /home/vmail/example.com/username/Maildir
18:09:29 7887 delivering in maildir format in /home/vmail/example.com/username/Maildir
18:09:29 7887 try option 'maildir_tag'
18:09:29 7887 LOG: MAIN PANIC
18:09:29 7887   SIGSEGV (deliberate trap)
2026-09-26 18:09:29 1xASkY-000000001wE-0V64 SIGSEGV (deliberate trap)
18:09:29 7884 LOG: MAIN PANIC
18:09:29 7884   failed to read delivery status for username@example.com from delivery subprocess
18:09:29 7884 LOG: MAIN PANIC
```

Manged to get backtrace with GDB:

```
#1  0x0057d0b4 in string_vformat_trc (g=<optimized out>, g@entry=0x0, func=func@entry=0x61a23c <__FUNCTION__.2> "appendfile_transport_entry", line=line@entry=2475, size_limit=size_limit@entry=32768, flags=<optimized out>, flags@entry=3, format=<optimized out>, format@entry=0x607af8 "%lld.M%luP%d.%s", ap=..., ap@entry=...) at string.c:1778
        length = <optimized out>
        slen = <optimized out>
        nptr = 0x22c8
        item_start = <optimized out>
        s = 0x22ce <error: Cannot access memory at address 0x22ce>
        newformat = "%d\000\000\000\237\361\276D\360c\000|\000\000"
        l_align = 0 '\000'
        null = <optimized out>
        gp = 0x2184901 ""
        L_NORMAL = L_NORMAL
        L_SHORT = L_SHORT
        L_LONG = L_LONG
        L_LONGLONG = L_LONGLONG
        L_LONGDOUBLE = L_LONGDOUBLE
        L_SIZE = L_SIZE
        taint_checked = 1 '\001'
        width = -1
        precision = -1
        initial_off = <optimized out>
        lim = 127
        need = <optimized out>
        fp = 0x607b07 ""
        __FUNCTION__ = "string_vformat_trc"
#2  0x0057d826 in string_sprintf_trc (format=format@entry=0x607af8 "%lld.M%luP%d.%s", func=func@entry=0x61a23c <__FUNCTION__.2> "appendfile_transport_entry", line=<optimized out>) at string.c:747
        g = 0x0
        flags = 3
        ap = {
          __ap = 0xbef19ffc
        }
        __FUNCTION__ = "string_sprintf_trc"
#3  0x0059fc0a in appendfile_transport_entry (tblock=0x212d754, addr=0x217fbcc) at appendfile.c:2475
        basename = <optimized out>
        i = 1
        check_path = <optimized out>
        re = <optimized out>
        ob = 0x212d7f4
        trname = 0x213eeb8 "dovecot_transport"
        statbuf = {
          st_dev = 44826983,
          st_ino = 4295000484,
          st_mode = 0,
          st_nlink = 0,
          st_uid = 0,
          st_gid = 0,
          st_rdev = 67084,
          st_size = 4096,
          st_blksize = 136,
          st_blocks = 1790424337,
          st_atim = {
            tv_sec = -5298298788879578396,
            tv_nsec = 0
          },
          st_mtim = {
            tv_sec = -5298298791948976128,
            tv_nsec = -1225641240
          },
          st_ctim = {
            tv_sec = -5387405881438633984,
            tv_nsec = 35001544
          }
        }
        fdname = <optimized out>
        deliver_dir = <optimized out>
        filename = <optimized out>
        hitchname = 0x0
        dataname = <optimized out>
        lockname = 0x0
        newname = <optimized out>
        nametag = 0x0
        cr = 0x60f484 ""
        filecount_msg = 0x60f484 ""
        path = <optimized out>
        times = {
          actime = -5264410814043121969,
          modtime = 2053
        }
        msg_tv = {
          tv_sec = 1790435780,
          tv_usec = 915461
        }
        disable_quota = <optimized out>
        isdirectory = <optimized out>
        isfifo = 0 '\000'
        wait_for_tick = 0 '\000'
        uid = 993
        gid = 993
        mbformat = 3
        mode = <optimized out>
        saved_size = -1
        mailbox_size = <optimized out>
        mailbox_filecount = -1
        hd = -1
        fd = <optimized out>
        yield = 2
        i = <optimized out>
        save_fd = 0
        mbx_lockfd = -1
        mbx_lockname = "\004\000\000\000\004\000\000\000T\327\022\002", '\000' <repeats 16 times>, "\341\003\000\000\006\000\000\000\020\000\000"
        temp_file = 0x0
        maildirsize_fd = <optimized out>
        maildir_save_errno = <optimized out>
        __FUNCTION__ = "appendfile_transport_entry"
#4  0x00527b64 in deliver_local (addr=addr@entry=0x217fbcc, shadowing=shadowing@entry=0 '\000') at deliver.c:2412
        ti = 0x212d63c
        ok = <optimized out>
        replicate = 1 '\001'
        rl = {
          rlim_cur = 0,
          rlim_max = 0
        }
        use_initgroups = 0 '\000'
        uid = 993
        gid = 993
        status = 35144964
        len = <optimized out>
        rc = <optimized out>
        pfd = {8, 9}
        pid = <optimized out>
        working_directory = 0x5d53bc "/"
        addr2 = <optimized out>
        tp = <optimized out>
        trname = 0x213eeb8 "dovecot_transport"
        __FUNCTION__ = "deliver_local"
#5  0x005280e4 in do_local_deliveries () at deliver.c:3049
        deliver_time = {
          tv_sec = 455301678012,
          tv_usec = 28132658559057920
        }
        addr3 = 0x217fbcc
        logflags = 1
        logchar = <optimized out>
        tpt_dummy = 0x0
        nextaddr = <optimized out>
        delivery_start = {
          tv_sec = 1790435780,
          tv_usec = 816966
        }
        addr2 = <optimized out>
        tp = 0x212d754
        serialize_key = 0x0
        trname = <optimized out>
        addr = <optimized out>
        dbblock = {
          dbptr = 0x41,
          lockfd = 6544944,
          readonly = 0 '\000'
        }
        dbm_file = <optimized out>
        now = <optimized out>
        __FUNCTION__ = "do_local_deliveries"
#6  0x0052a9c8 in deliver_message (id=<optimized out>, forced=forced@entry=1 '\001', give_up=give_up@entry=0 '\000') at deliver.c:8446
        i = <optimized out>
        rc = <optimized out>
        final_yield = 0
        process_recipients = <optimized out>
        now = <optimized out>
        addr_last = <optimized out>
        filter_message = 0x0
        info = <optimized out>
        dbblock = {
          dbptr = 0x2133ca8,
          lockfd = -1,
          readonly = 0 '\000'
        }
        dbm_file = <optimized out>
        has_privs = <optimized out>
        reset_point = <optimized out>
        __FUNCTION__ = "deliver_message"
#7  0x0050c40a in main (argc=<optimized out>, cargv=<optimized out>) at exim.c:5151
        status = 15523
        pid = <optimized out>
        argv = <optimized out>
        arg_receive_timeout = -1
        arg_smtp_receive_timeout = -1
        arg_error_handling = 0
        filter_sfd = -1
        filter_ufd = -1
        group_count = <optimized out>
        i = 3
        rv = <optimized out>
        list_queue_option = <optimized out>
        msg_action = <optimized out>
        msg_action_arg = <optimized out>
        namelen = <optimized out>
        queue_only_reason = 0
        rcpt_dsn_flags = <optimized out>
        recipients_arg = <optimized out>
        sender_address_domain = 0
        test_retry_arg = <optimized out>
        test_rewrite_arg = <optimized out>
        perl_start_option = <optimized out>
        original_egid = <optimized out>
        admin_only_arg = <optimized out>
        arg_queue_only = <optimized out>
        bi_option = <optimized out>
        checking = <optimized out>
        count_queue = <optimized out>
        extract_recipients = <optimized out>
        flag_G = <optimized out>
        flag_n = <optimized out>
        forced_delivery = 1 '\001'
        f_end_dot = <optimized out>
        deliver_give_up = <optimized out>
        list_queue = <optimized out>
        list_options = <optimized out>
        list_config = <optimized out>
        local_queue_only = <optimized out>
        one_msg_action = <optimized out>
        opt_D_used = <optimized out>
        queue_only_set = <optimized out>
        receiving_message = <optimized out>
        sender_ident_set = <optimized out>
        session_local_queue_only = <optimized out>
        unprivileged = <optimized out>
        removed_privilege = 0 '\000'
        usage_wanted = <optimized out>
        verify_address_mode = <optimized out>
        verify_as_sender = <optimized out>
        rcpt_verify_quota = <optimized out>
        version_printed = <optimized out>
        alias_arg = <optimized out>
        called_as = <optimized out>
        cmdline_syslog_name = <optimized out>
        start_queue_run_id = <optimized out>
        stop_queue_run_id = <optimized out>
        expansion_test_message = <optimized out>
        ftest_domain = <optimized out>
        ftest_localpart = <optimized out>
        ftest_prefix = <optimized out>
        ftest_suffix = <optimized out>
        malware_test_file = <optimized out>
        real_sender_address = <optimized out>
        log_oneline = <optimized out>
        originator_home = 0x5d53bc "/"
        sz = <optimized out>
        pw = 0x6807cc <pwcache>
        statbuf = {
          st_dev = 21,
          st_ino = 5,
          st_mode = 8576,
          st_nlink = 1,
          st_uid = 0,
          st_gid = 5,
          st_rdev = 34818,
          st_size = 0,
          st_blksize = 1024,
          st_blocks = 0,
          st_atim = {
            tv_sec = 1790435699,
            tv_nsec = 0
          },
          st_mtim = {
            tv_sec = 1790435699,
            tv_nsec = 0
          },
          st_ctim = {
            tv_sec = 1790433725,
            tv_nsec = 319048639
          }
        }
        passed_qr_pid = <optimized out>
        passed_qr_pipe = <optimized out>
        group_list = <error reading variable group_list (value requires 262144 bytes, which is more than max-value-size)>
        info_flag = <optimized out>
        info_stdout = <optimized out>
        rsopts = {0x5e8a60 "f", 0x60c208 "ff", 0x6077ac "r", 0x5ddaa8 "rf", 0x5ddaac "rff"}
        __FUNCTION__ = "main"
r0             0x22ce              8910
r1             0x22c8              8904
r2             0x22ce              8910
r3             0xbef1a014          3203506196
r4             0x6                 6
r5             0x607b06            6322950
r6             0x0                 0
r7             0xffffffff          4294967295
r8             0xffffffff          4294967295
r9             0x2184901           35145985
r10            0x21848bc           35145916
r11            0x73                115
r12            0xffffffff          4294967295
sp             0xbef19f08          0xbef19f08
lr             0x57d0b5            5755061
pc             0xb67e39ee          0xb67e39ee <__GI_strlen+174>
cpsr           0x20070030          537329712
fpscr          0x80000010          -2147483632
=> 0xb67e39ee <__GI_strlen+174>:	ldrd	r2, r3, [r1]
```

Looks like issue is that format "%lld.M%luP%d.%s" expects 32bit integer on 32bit armhf while msg_tv.tv_usec is 64bit.

#1149106#12
Date:
2026-09-26 16:14:42 UTC
From:
To:

#1149106#19
Date:
2026-09-26 19:59:18 UTC
From:
To:

#1149106#24
Date:
2026-09-27 10:21:33 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
exim4, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149106@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Metzler <ametzler@debian.org> (supplier of updated exim4 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 27 Sep 2026 11:50:53 +0200
Source: exim4
Architecture: source
Version: 4.100.1-2
Distribution: unstable
Urgency: high
Maintainer: Exim4 Maintainers <pkg-exim4-maintainers@lists.alioth.debian.org>
Changed-By: Andreas Metzler <ametzler@debian.org>
Closes: 1149106
Changes:
 exim4 (4.100.1-2) unstable; urgency=high
 .
   * Cherry-pick two fixes from upstream GIT master.
   * Fix crash on 32bit platforms when delivering to Maildir. Closes: #1149106
Checksums-Sha1:
 f2ccb270f748ac39161d9b53d9c5c99959061531 3455 exim4_4.100.1-2.dsc
 f6f091ded5fd6ee23cf9b2857c37bf15f5a003bc 466068 exim4_4.100.1-2.debian.tar.xz
Checksums-Sha256:
 008f8dd91b1a009d51fc068d082533a904c91aa4e966cf4615f416a3415886ba 3455 exim4_4.100.1-2.dsc
 c367d79fd6a10de6e78f063424992e16212636819fde6ba4a64bcfead2894776 466068 exim4_4.100.1-2.debian.tar.xz
Files:
 a84851aa59646149d636c1911d2d2ada 3455 mail standard exim4_4.100.1-2.dsc
 b1ae48c9822b59a899fa9a8855e530f5 466068 mail standard exim4_4.100.1-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmq45/wACgkQpU8BhUOC
FITg4Q/7BE1OkJkUuI2KUqMZ/uznOei7ncZMKQlFPwyVXz3xfj93mWm9PlQ22MhJ
KAxp9yOxHJUhyoPeq2Rkix9MamM9GTJRqU9N06s18yDrSLS9eTtpnG1ntBoaEke5
vD8Ey1vojOirgZqMkunW5E79wj+BZr5ssTC0Cd52zKIgRfj217t5KIGw0B2Wwuoa
Ub7heIvwZSMnHQsHv9pFT2djsTS/GZP9RGxtNkuIqWiTzpgj19YXs1NtXYkmIuAx
bzqC688XBbMru06QgvY6XOqoOTy9alm8g84WijpHhOzTT104YRMqbadZLfc2r1kv
PRbl7pM5hmkpbjZALHK/TGlOoQwuhX1O2KrlfuUwGOqIxb8Z16+mZ/R0b2Q2Vltp
na9O+cbrCyiEOGk2YCIzxEAk+oiaOHF3WvT61xNgiW7PHiwvfmmBOn9e8PNhHICu
a/FrVvPditsKkYu2GyYVWrnJi595NldggcgWUVrsitnZAVCL63d0eA7dUoKzprpi
P49tui6HsW5EHBAwM954jFQtnXvmi7qCUpqVho+PHzlK77P1X6bh3ckAQJaDmxN3
q83ncawm4cgNZD4vrYD3P4X9BrD0LhcWXnLKpI1YYPvPBrMgR86Om+z/hZdny7Iq
hUhR0wR1BmB9bL253JGybNrDuBXOBwUQo3UX/6gRzo3T4hPmpa4=
=nemg
-----END PGP SIGNATURE-----

#1149106#29
Date:
2026-09-28 17:02:23 UTC
From:
To:
Will this fix be available in trixie-backports?
#1149106#34
Date:
2026-09-29 16:32:50 UTC
From:
To:
[...]

Yes, but I will need to wait for migration to testing before updating
bpo.

cu Andreas

#1149106#39
Date:
2026-10-05 18:29:13 UTC
From:
To:
Great, it looks like it migrated already!