[Dovecot] 1.2rc2: setacl crash

[Oli Schacher]

Hi
By playing around with imap acl I managed to get another crash.

Setup is the same as in my last crash report ("1.2 beta4, crash with
ACL"), except updated from beta4 to rc2 and added the slash to the
prefix, as suggested by Timo: prefix: shared/%%d/%%n/

What I did:
logged in as sales

2 setacl INBOX oli@<domain>.ch -lrs
Connection closed by foreign host.


Server Log:

Apr  4 08:05:06 box dovecot: Panic: IMAP(sales@<domain>.ch): file
../../../src/lib/array.h: line 162 (array_idx_i): assertion failed: (idx
* array->element_size < array->buffer->used)
Apr  4 08:05:06 box dovecot: IMAP(sales@<domain>.ch): Raw backtrace:
imap [0x80e7110] -> imap [0x80e716a] -> imap [0x80e6a2c] ->
/usr/lib/dovecot/imap/lib01_acl_plugin.so [0x4cd872] ->
/usr/lib/dovecot/imap/lib01_acl_plugin.so [0x4cd8d0] ->
/usr/lib/dovecot/imap/lib01_acl_plugin.so [0x4cf780] ->
/usr/lib/dovecot/imap/lib01_acl_plugin.so(acl_object_update+0x18)
[0x4cc998] -> /usr/lib/dovecot/imap/lib02_imap_acl_plugin.so [0x111fda]
-> imap [0x8063d6c] -> imap [0x8063e1b] ->
imap(client_handle_input+0x2f) [0x80648cf] -> imap(client_input+0x63)
[0x8064b03] -> imap(io_loop_handler_run+0x100) [0x80ef870] ->
imap(io_loop_run+0x28) [0x80ee9a8] -> imap(main+0x754) [0x806cdb4] ->
/lib/libc.so.6(__libc_start_main+0xdc) [0x2f1dec] -> imap [0x805ce41]
Apr  4 08:05:06 box dovecot: child 2330 (imap) killed with signal 6
(core dumped)


Backtrace:

#0  0x00503402 in __kernel_vsyscall ()
No symbol table info available.
#1  0x00304d10 in raise () from /lib/libc.so.6
No symbol table info available.
#2  0x00306621 in abort () from /lib/libc.so.6
No symbol table info available.
#3  0x080e711d in default_fatal_finish ()
No symbol table info available.
#4  0x080e716a in i_internal_fatal_handler ()
No symbol table info available.
#5  0x080e6a2c in i_panic ()
No symbol table info available.
#6  0x004cd872 in modify_right_list (pool=0x923b3a0, rightsp=0x923b4b4,
    modify_rights=0x920a358, modify_mode=ACL_MODIFY_MODE_REMOVE)
    at ../../../src/lib/array.h:162
	old_rights = (const char * const *) 0x923b3f4
	new_rights = (const char * const *) 0xbfbbae94
	null = 0x0
#7  0x004cd8d0 in vfile_object_modify_right (aclobj=0x923b278, idx=1,
    update=0xbfbbb02c) at acl-backend-vfile.c:941
	c1 = 73
	c2 = <value optimized out>
#8  0x004cf780 in acl_backend_vfile_object_update (_aclobj=0x923b278,
    update=0xbfbbb02c) at acl-backend-vfile.c:1100
	aclobj = (struct acl_object_vfile *) 0x0
	dotlock = <value optimized out>
	path = <value optimized out>
	i = 1
	fd = 6
	changed = <value optimized out>
	__PRETTY_FUNCTION__ = "acl_backend_vfile_object_update"
#9  0x004cc998 in acl_object_update (aclobj=0x923b278, update=0xbfbbb02c)
    at acl-api.c:137
No locals.
#10 0x00111fda in cmd_setacl (cmd=0x9219210) at imap-acl-plugin.c:576
	ns = (struct mail_namespace *) 0x9216b38
	storage = <value optimized out>
	box = (struct mailbox *) 0x9220a78
	backend = (struct acl_backend *) 0x92172b8
	update = {rights = {id_type = ACL_ID_USER,
    identifier = 0x921e318 "oli@<domain>.ch", rights = 0x920a358,
    neg_rights = 0x0, global = 0}, modify_mode = ACL_MODIFY_MODE_REMOVE,
  neg_modify_mode = ACL_MODIFY_MODE_REMOVE}
	mailbox = 0x921e310 "INBOX"
	identifier = 0x921e318 "oli@<domain>.ch"
	rights = 0x921e339 "lrs"
error = <value optimized out>
	negative = false
#11 0x08063d6c in client_command_input ()
No symbol table info available.
#12 0x08063e1b in client_command_input ()
No symbol table info available.
#13 0x080648cf in client_handle_input ()
No symbol table info available.
#14 0x08064b03 in client_input ()
No symbol table info available.
#15 0x080ef870 in io_loop_handler_run ()
No symbol table info available.
#16 0x080ee9a8 in io_loop_run ()
No symbol table info available.
#17 0x0806cdb4 in main ()
No symbol table info available.