[Dovecot] Coredump while searching a folder

[Matthias Rieber]

Hi,

On Sat, 19 Jun 2010 23:55:02 +0200, Matthias Rieber
<ml-dovecot at zu-con.org>
wrote:
> Hi,
> 
> while searching through the message bodies in a real folder I got a
> coredump. I used the master user for this operation. dovecot.index*
files
> have been removed before I started this operation. This looks a bit
> different to my previous report.
> 
> Coredump:


> #4  0x00002b5e8240d163 in i_panic (format=<value optimized out>) at
> failures.c:230
>         args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area =
> 0x7fffbc0b8d40, reg_save_area = 0x7fffbc0b8c80}}
> #5  0x00002b5e83e2ee6d in squat_build_word (ctx=0x127776e0, uid=574,
> data=0x126ef79f "\a\b\021�\n", 
>     char_lengths=0x126ef4b7 "\001\001\001\004\001\001", size=5) at

and the log says:

Jun 20 13:11:55 shrike dovecot: imap(matthias): Panic: file
charset-iconv.c: line 154 (charset_to_utf8): assertion failed: (dest->used
!= prev_used)
Jun 20 13:11:55 shrike dovecot: imap(matthias): Error: Raw backtrace:
/usr/local/lib/dovecot/libdovecot.so.0 [0x2ab0ffa5dd52] ->
/usr/local/lib/dovecot/libdovecot.so.0 [0x2ab0ffa5ddba] ->
/usr/local/lib/dovecot/libdovecot.so.0(i_error+0) [0x2ab0ffa5e163] ->
/usr/local/lib/dovecot/libdovecot.so.0(charset_to_utf8+0xe4)
[0x2ab0ffa54424] ->
/usr/local/lib/dovecot/libdovecot.so.0(message_decoder_decode_next_block+0x413)
[0x2ab0ffa4c133] ->
/usr/local/lib/dovecot/libdovecot.so.0(message_search_more+0xc7)
[0x2ab0ffa4fd67] ->
/usr/local/lib/dovecot/libdovecot.so.0(message_search_msg+0x67)
[0x2ab0ffa4ff37] -> /usr/local/lib/dovecot/libdovecot-storage.so.0
[0x2ab0ff7c49d0] -> /usr/local/lib/dovecot/libdovecot-storage.so.0
[0x2ab0ff78366d] ->
/usr/local/lib/dovecot/libdovecot-storage.so.0(mail_search_args_foreach+0x3c)
[0x2ab0ff7837ec] ->
/usr/local/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x293)
[0x2ab0ff7c57e3] ->
/usr/local/lib/dovecot/lib20_virtual_plugin.so(virtual_search_next_nonblock+
Jun 20 13:11:55 shrike dovecot: master: Error: service(imap): child 18358
killed with signal 6 (core dumped)

it seems to be caused by a badly encoded email.

Regards,

Matthias