[Dovecot] Segfault in dovecot-lda 2.0.5

[Sean Cardus]

Hi,

I've recently started using dovecot-lda to handle my local maildir 
deliveries from Exim.  Unfortunately I've been experiencing the 
occasional failed delivery - My Exim logs were showing:

     Child process of virtual_dovecot_delivery transport (running 
command "/usr/local/libexec/dovecot/dovecot-lda -d $local_part@$domain 
-f $sender_address -a $original_local_part@$original_domain") was 
terminated by signal 11 (Segmentation fault)

I originally thought a specific mail was causing the crash, but calling 
the command myself delivered the mail without any issues.  However, I 
found if I ran a script that delivered the same mail 10 times, I could 
reliably cause multiple segfaults all with the following backtrace:

#0  0x005581e9 in maildir_sync_set_new_msgs_count (ctx=0x0, count=1) at 
maildir-sync-index.c:50
No locals.
#1  0x0055f3c0 in maildir_save_move_files_to_newcur (_ctx=0x85afe60) at 
maildir-save.c:857
         files = {arr = {buffer = 0x8555a08, element_size = 4}, v = 
0x8555a08,
           v_modifiable = 0x8555a08}
         mfp = 0x8555a2c
         new_changed = false
         mf = 0x85affa8
         newdir = true
#2  maildir_transaction_save_commit_pre (_ctx=0x85afe60) at 
maildir-save.c:951
         _data_stack_cur_id = 3
         ctx = <value optimized out>
         _t = 0x85af500
         sync_flags = <value optimized out>
         ret = <value optimized out>
         __FUNCTION__ = "maildir_transaction_save_commit_pre"
#3  0x00555e8f in index_transaction_index_commit (index_trans=0x85af540, 
result_r=0xbfd78510)
     at index-transaction.c:27
         it = 0x85af500
         ibox = 0x858a108
         ret = <value optimized out>
         __FUNCTION__ = "index_transaction_index_commit"
#4  0x00595c11 in mail_index_transaction_commit_full (_t=0xbfd78528, 
result_r=0xbfd78510)
     at mail-index-transaction.c:237
         t = 0x85af540
         index = 0x85835e0
         index_undeleted = false
#5  0x00556284 in index_transaction_commit (t=0x85af500, 
changes_r=0xbfd785a8)
     at index-transaction.c:123
         box = 0x8589ef0
         itrans = 0x0
         result = {log_file_seq = 0, log_file_offset = 0, commit_size = 
0, ignored_modseq_changes = 0}
         ret = <value optimized out>
#6  0x00533122 in mailbox_transaction_commit_get_changes (_t=0xbfd785d4, 
changes_r=0xbfd785a8)
     at mail-storage.c:1215
         _data_stack_cur_id = 2
         t = 0x85af500
         ret = <value optimized out>
#7  0x00a7eaef in mail_deliver_save (ctx=0xbfd786f8, mailbox=0x804ab55 
"INBOX", flags=0,
     keywords=0x0, storage_r=0xbfd78794) at mail-deliver.c:219
         open_ctx = {user = 0x85781b0, lda_mailbox_autocreate = false,
           lda_mailbox_autosubscribe = false}
         box = 0x8589ef0
         trans_flags = <value optimized out>
         t = 0x0
         save_ctx = 0x0
         kw = 0x0
         error = MAIL_ERROR_NONE
         mailbox_name = 0x804ab55 "INBOX"
         errstr = <value optimized out>
         changes = {pool = 0x85b5998, uid_validity = 0, saved_uids = 
{arr = {buffer = 0x85b59a8,
               element_size = 8}, v = 0x85b59a8, v_modifiable = 0x85b59a8},
           ignored_modseq_changes = 0}
         range = <value optimized out>
         ret = 0
         __FUNCTION__ = "mail_deliver_save"
#8  0x00a7edf8 in mail_deliver (ctx=0xbfd786f8, storage_r=0xbfd78794) at 
mail-deliver.c:289
         ret = -1
#9  0x0804a124 in main (argc=139843496, argv=0x855d1b8) at main.c:429
         set_roots = {0x804b390, 0x0}
         ctx = {pool = 0x855d7a8, set = 0x855ef48, dup_ctx = 0x0, 
session_id = 0x0,
           src_mail = 0x85856e0, src_envelope_sender = 0x855d7b8 
"sean at cardus.com",
           dest_user = 0x85781b0, dest_addr = 0x855d228 "sean at cardus.com",
           final_dest_addr = 0x855d228 "sean at cardus.com", 
dest_mailbox_name = 0x804ab55 "INBOX",
           dest_mail = 0x0, tried_default_save = true, saved_mail = 
false, save_dest_mail = false}
         service_flags = 1027
         user = 0x1 <Address 0x1 out of bounds>
         errstr = <value optimized out>
         path = 0x0
         storage_service = 0x855e3b0
         service_user = 0x855ec70
         service_input = {module = 0x804ab3c "lda", service = 0x804ab3c 
"lda",
           username = 0x855d202 "sean at cardus.com", local_ip = {family = 
0, u = {ip6 = {in6_u = {
                   u6_addr8 = '\000' <repeats 15 times>, u6_addr16 = {0, 
0, 0, 0, 0, 0, 0, 0},
                   u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}}, 
remote_ip = {family = 0, u = {
               ip6 = {in6_u = {u6_addr8 = '\000' <repeats 15 times>, 
u6_addr16 = {0, 0, 0, 0, 0, 0,
                     0, 0}, u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 
0}}}, userdb_fields = 0x0}
         raw_mail_user = 0x857c1b8
         raw_ns = 0x8571ea8
         raw_ns_set = {name = 0x0, type = 0x0, separator = 0x0, prefix = 
0x0,
           location = 0x804abd9 ":LAYOUT=none", alias_for = 0x0, inbox = 
false, hidden = false,
           list = 0x0, subscriptions = false, user_set = 0x0}
         storage = <value optimized out>
         box = 0x85801c0
         raw_box = <value optimized out>
         input = 0x0
         t = 0x8584d90
         headers_ctx = 0x0
         user_source = 0x804ab2c ""
         sets = <value optimized out>
         process_euid = <value optimized out>
         stderr_rejection = false
         mtime = -1
         ret = <value optimized out>
         c = <value optimized out>
         error = <value optimized out>

Any ideas?

Thanks in advance,
Sean