[Dovecot] Dovecot 1.2.6 segfault in imap_fetch_begin

[Brandon Davidson]

We recently upgraded from Dovecot 1.2.4 to 1.2.6 (with the sieve patches
of course). Everything has been running quite well since the upgrade.
The occasional issue with assert-crashing when expunging has gone away.

However, one of our users seems to have triggered a new issue. She's
been the only one to see it, but whenever she logs in, her imap process
segfaults immediately. It appears that the crash is a null pointer deref
in the array library, but I'm not sure what code is at fault for calling
in without checking array validity... or even if I'm on the right track.

Backtraces and some further information are available here. Cores
available on request.
http://uoregon.edu/~brandond/dovecot-1.2.6/bt.txt

Thanks,

-Brad