[Dovecot] Dovecot-1.1.2 assertion failure in preparsed_parse_next_header_init

[Mike Abbott]

Panic: IMAP(user): file message-parser.c: line 684  
(preparsed_parse_next_header_init): assertion failed: (ctx->part- 
 >physical_pos >= ctx->input->v_offset)

Linux 2.6.24-19-386
Maildir on ext3

Looks similar to but different from http://dovecot.org/list/dovecot/2008-June/031523.html 
  .

#0  0xb7faf410 in __kernel_vsyscall ()
#1  0xb7e6f085 in raise () from /lib/tls/i686/cmov/libc.so.6
#2  0xb7e70a01 in abort () from /lib/tls/i686/cmov/libc.so.6
#3  0x080d2b65 in default_fatal_finish (type=<value optimized out>,  
status=0)
     at failures.c:149
#4  0x080d2bba in i_internal_fatal_handler (type=LOG_TYPE_PANIC,  
status=0,
     fmt=0x80e5fec "file %s: line %d (%s): assertion failed: (%s)",
     args=0xbfb4b1d4 "\017L\017\b?\002") at failures.c:423
#5  0x080d246c in i_panic (
     format=0x80e5fec "file %s: line %d (%s): assertion failed: (%s)")
     at failures.c:190
#6  0x080cc246 in preparsed_parse_next_header_init (ctx=0x812b650,
     block_r=0xbfb4b24c) at message-parser.c:684
#7  0x080cbc0d in message_parser_parse_next_block (ctx=0x812b650,
     block_r=0xbfb4b24c) at message-parser.c:753
#8  0x080cbd5e in message_parser_parse_body (ctx=0x812b650,
     hdr_callback=0x80968a0 <parse_bodystructure_part_header>,
     context=0x812e658) at message-parser.c:816
#9  0x08097f21 in index_mail_parse_body (mail=0x8122668,
     field=MAIL_CACHE_IMAP_BODYSTRUCTURE) at index-mail.c:753
#10 0x08098026 in index_mail_parse_bodystructure (mail=0x8122668,
     field=MAIL_CACHE_IMAP_BODYSTRUCTURE) at index-mail.c:860
#11 0x0809852c in index_mail_get_special (_mail=0x8122668,
     field=MAIL_FETCH_IMAP_BODYSTRUCTURE, value_r=0xbfb4b370)
     at index-mail.c:983
#12 0x08078a18 in maildir_mail_get_special (_mail=0x6, field=0,
     value_r=0xbfb4b370) at maildir-mail.c:437
#13 0x080643f4 in fetch_bodystructure (ctx=0x810b708, mail=0x8122668,
     context=0x0) at imap-fetch.c:450
#14 0x08064960 in imap_fetch (ctx=0x810b708) at imap-fetch.c:309
#15 0x0805e44e in cmd_fetch (cmd=0x810b670) at cmd-fetch.c:152
#16 0x080625cc in client_command_input (cmd=0x810b670) at client.c:580
#17 0x08062675 in client_command_input (cmd=0x810b670) at client.c:629
#18 0x08062e43 in client_handle_input (client=0x810b418) at client.c:670
#19 0x0806305e in client_input (client=0x810b418) at client.c:725
#20 0x080da4a7 in io_loop_handler_run (ioloop=0x8109a60) at ioloop- 
epoll.c:201
#21 0x080d9628 in io_loop_run (ioloop=0x8109a60) at ioloop.c:308
#22 0x0806ab5d in main (argc=Cannot access memory at address 0x2acc
) at main.c:293
(gdb) frame 6
#6  0x080cc246 in preparsed_parse_next_header_init (ctx=0x812b650,
     block_r=0xbfb4b24c) at message-parser.c:684
684		i_assert(ctx->part->physical_pos >= ctx->input->v_offset);
(gdb) p ctx
$1 = (struct message_parser_ctx *) 0x812b650
(gdb) p ctx->input
$2 = (struct istream *) 0x8113618
(gdb) p ctx->part
$3 = (struct message_part *) 0x812e7c0
(gdb) p *ctx
$4 = {parser_pool = 0x812b638, part_pool = 0x0, input = 0x8113618,
   parts = 0x812e730, part = 0x812e7c0, hdr_flags = 3,
   flags = MESSAGE_PARSER_FLAG_SKIP_BODY_BLOCK, last_boundary = 0x0,
   boundaries = 0x0, skip = 0, last_chr = 0 '\0', want_count = 0,
   hdr_parser_ctx = 0x0,
   parse_next_block = 0x80cc1e0 <preparsed_parse_next_header_init>,
   part_seen_content_type = 0, broken = 1}
(gdb) p *ctx->part
$5 = {parent = 0x812e778, next = 0x0, children = 0x0, physical_pos =  
688,
   header_size = {physical_size = 90, virtual_size = 93, lines = 0},
   body_size = {physical_size = 505, virtual_size = 514, lines = 9},
   flags = 72, context = 0x0}
(gdb) p *ctx->input
$6 = {v_offset = 759, stream_errno = 0, mmaped = 0, blocking = 1,  
closed = 0,
   seekable = 1, eof = 0, real_stream = 0x81135f0}