[Dovecot] dovecot-lda (2.1.12) segfaults

[Timo Sirainen]

On Thu, 2012-12-13 at 03:56 -0800, Joseph Tam wrote:
> We uograded our dovecot from version 2.1.10 -> 2.10.12, but within
> the first hour of use, dovecot-lda would segfault during delivery.
> This left a lock file lying around causing the user's mail readers to
> hang; much hilarity ensues.  All further deliveries to the same user
> will result in a crash.
> 
> The only thing that fixes this condition is to blow away the user's
> INBOX cache index.  Reindexing with "doveadm index" does not fix
> anything.
> 
> I've installed a test version with one user's problematic INBOX
> cache indices and ran
> 
>  	gdb dovecot-lda
>  	(gdb) run -t testuser </dev/null
> 
> and it crashes with the following backtrace
> 
>  	Program received signal SIGSEGV, Segmentation fault.
>  	0xff2a0440 in mail_cache_header_fields_read (cache=0x5c120) at mail-cache-fields.c:323
>  	323             if (field_hdr->size < sizeof(*field_hdr) +
..
>  	(gdb) p field_hdr
>  	$1 = (const struct mail_cache_header_fields *) 0x20

So mail_cache_map() returned a broken pointer..

> Is this enough debug info to work your magic, Timo?  I can supply the cache data
> if you neded it.  It's compiled on a Solaris10.

Can you still reproduce this in any way? I found two bugs, would be nice
to know if they solve it:

http://hg.dovecot.org/dovecot-2.1/rev/2f848393f78e
http://hg.dovecot.org/dovecot-2.1/rev/bded819417d9