[Dovecot] 1.1.2: imap crash with SIGSEGV

[Ralf Hildebrandt]

And the fourth and last one

GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
Reading symbols from /lib/i686/cmov/libdl.so.2...Reading symbols from /usr/lib/debug/lib/i686/cmov/libdl-2.7.so...done.
done.
Loaded symbols for /lib/i686/cmov/libdl.so.2
Reading symbols from /lib/i686/cmov/libc.so.6...Reading symbols from /usr/lib/debug/lib/i686/cmov/libc-2.7.so...done.
done.
Loaded symbols for /lib/i686/cmov/libc.so.6
Reading symbols from /lib/ld-linux.so.2...Reading symbols from /usr/lib/debug/lib/ld-2.7.so...done.
done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /usr/local/lib/dovecot/imap/lib10_quota_plugin.so...done.
Loaded symbols for /usr/local/lib/dovecot/imap/lib10_quota_plugin.so
Reading symbols from /usr/local/lib/dovecot/imap/lib11_imap_quota_plugin.so...done.
Loaded symbols for /usr/local/lib/dovecot/imap/lib11_imap_quota_plugin.so
Reading symbols from /usr/local/lib/dovecot/imap/lib11_trash_plugin.so...done.
Loaded symbols for /usr/local/lib/dovecot/imap/lib11_trash_plugin.so
Reading symbols from /usr/local/lib/dovecot/imap/lib20_fts_plugin.so...done.
Loaded symbols for /usr/local/lib/dovecot/imap/lib20_fts_plugin.so
Reading symbols from /usr/local/lib/dovecot/imap/lib20_mail_log_plugin.so...done.
Loaded symbols for /usr/local/lib/dovecot/imap/lib20_mail_log_plugin.so
Reading symbols from /usr/local/lib/dovecot/imap/lib21_fts_squat_plugin.so...done.
Loaded symbols for /usr/local/lib/dovecot/imap/lib21_fts_squat_plugin.so
Core was generated by `/usr/local/libexec/dovecot/imap'.
Program terminated with signal 11, Segmentation fault.
[New process 22723]
#0  array_idx_modifiable_i (array=0x9feabec, idx=0) at array.c:11
11		if (pos >= array->buffer->used) {
#0  array_idx_modifiable_i (array=0x9feabec, idx=0) at array.c:11
#1  0x080c4788 in mail_index_sync_ext_reset (ctx=0xbf94fa80, u=0xbf94f9f0)
    at mail-index-sync-ext.c:518
#2  0x080b65f9 in mail_index_sync_record (ctx=0xbf94fa80, hdr=0x9fead40, 
    data=0x9fed0e0) at mail-index-sync-update.c:546
#3  0x080b6bef in mail_index_sync_map (_map=0x9fdc648, 
    type=MAIL_INDEX_SYNC_HANDLER_HEAD, force=true)
    at mail-index-sync-update.c:828
#4  0x080b048f in mail_index_map (index=0x9fdc610, 
    type=MAIL_INDEX_SYNC_HANDLER_HEAD) at mail-index-map.c:953
#5  0x080acec3 in mail_index_try_open (index=0x9fdc610) at mail-index.c:290
#6  0x080ad21f in mail_index_open (index=0x9fdc610, flags=49, 
    lock_method=FILE_LOCK_METHOD_FCNTL) at mail-index.c:354
#7  0x080a11f2 in index_storage_mailbox_open (ibox=0x9fd8e50)
    at index-storage.c:383
#8  0x080709ab in maildir_open (storage=0x9fd1cc0, name=0x9fd66ee "Drafts", 
    flags=0) at maildir-storage.c:448
#9  0x08070b14 in maildir_mailbox_open (_storage=0x9fd1cc0, 
    name=0x9fd66ee "Drafts", input=0x0, flags=0) at maildir-storage.c:512
#10 0xb7eb61ca in mail_log_mailbox_open (storage=0x9fd1cc0, 
    name=0x9fd66ee "Drafts", input=0x0, flags=0) at mail-log-plugin.c:450
#11 0xb7ec766a in quota_mailbox_open (storage=0x9fd1cc0, 
    name=0x9fd66ee "Drafts", input=0x0, flags=0) at quota-storage.c:366
#12 0x080a52b9 in mailbox_open (storage=0x9fd1cc0, name=0x9fd66ee "Drafts", 
    input=0x0, flags=0) at mail-storage.c:459
#13 0x08060cbc in cmd_select_full (cmd=0x9fd25f0, readonly=false)
    at cmd-select.c:32
#14 0x08060ea9 in cmd_select (cmd=0x9fd25f0) at cmd-select.c:88
#15 0x0806276c in client_command_input (cmd=0x9fd25f0) at client.c:580
#16 0x08062803 in client_command_input (cmd=0x9fd25f0) at client.c:629
#17 0x08062dbd in client_handle_input (client=<value optimized out>)
    at client.c:670
#18 0x0806323e in client_input (client=0x9fd23a8) at client.c:725
#19 0x080dd8d0 in io_loop_handler_run (ioloop=0x9fce9b0) at ioloop-epoll.c:203
#20 0x080dcd40 in io_loop_run (ioloop=0x9fce9b0) at ioloop.c:320
#21 0x0806b3aa in main (argc=) at main.c:293