[Dovecot] [Dovecot 2.1.7] SegFault on doveadm search through director proxy

[Daniel Parthey]

> mail01: 2.0.20
> mail02: 2.1.7
> mail03: 2.0.20
> mail04: 2.0.20
> 
> Director for user at example.org currently points to mail02.
> 
> Compiled and installed 2.1.7 on mail02 (Ubuntu Lucid),
> gettings segfaults on mail02 now.
> 
> Got a core dump and created a gdb backtrace:
> 
> mail02# doveadm -c /etc/dovecot-director/dovecot-director.conf search -u user at example.org all
> [...]
> 67b3b72453278b4f6a3d000051abeb58 447
> 67b3b72453278b4f6a3d000051abeb58 448
> 67b3b72453278b4f6a3d000051abeb58 449
> 67b3b72453278b4f6a3d000051abeb58 450
> 67b3b72453278b4f6a3d000051abeb58 451
> 67b3b72453278b4f6a3d000051abeb58 452
> 67b3b72453278b4f6a3d000051abeb58 453
> 67b3b72453278b4f6a3d000051abeb58 454
> 67b3b72453278b4f6a3d000051abeb58 455
> 67b3b72453278b4f6a3d000051abeb58 456
> Segmentation fault (core dumped)

(gdb) bt full
#0  0x00007ff6c763de32 in vfprintf () from /lib/libc.so.6
No symbol table info available.
#1  0x00007ff6c76f2ea1 in __printf_chk () from /lib/libc.so.6
No symbol table info available.
#2  0x000000000041ed4e in printf (value=0x64697567 <Address 0x64697567 out of bounds>) at /usr/include/bits/stdio2.h:105
No locals.
#3  doveadm_print_flow_print (value=0x64697567 <Address 0x64697567 out of bounds>) at doveadm-print-flow.c:51
        hdr = <value optimized out>
#4  0x0000000000415667 in doveadm_print (value=0x1c28970 "67b3b72453278b4f6a3d000051abeb58") at doveadm-print.c:65
        headers = 0x1c37120
#5  0x000000000041638d in server_flush_field (conn=0x1c4ab10) at server-connection.c:111
        text = 0x0
#6  server_handle_input (conn=0x1c4ab10) at server-connection.c:150
        str = 0x1c28938
        i = <value optimized out>
#7  server_connection_input (conn=0x1c4ab10) at server-connection.c:254
        data = 0x1c4eae0 "b4f6a3d000051abeb58\t450\t67b3b72453278b4f6a3d000051abeb58\t451\t67b3b72453278b4f6a3d000051abeb58\t452\t67b3b72453278b4f6a3d000051abeb58\t453\t67b3b72453278b4f6a3d000051abeb58\t454\t67b3b72453278b4f6a3d000051ab"...
        size = 8192
        line = <value optimized out>
        reply = <value optimized out>
#8  0x00007ff6c79c3176 in io_loop_call_io (io=0x1c386d0) at ioloop.c:379
        ioloop = 0x1c30820
        t_id = 2
#9  0x00007ff6c79c41ff in io_loop_handler_run (ioloop=<value optimized out>) at ioloop-epoll.c:213
        ctx = 0x1c35ff0
        event = 0x1c36660
        list = 0x1c30350
        io = 0x64697567
        tv = {tv_sec = 59, tv_usec = 945631}
        msecs = <value optimized out>
        ret = <value optimized out>
        i = 0
        call = false
#10 0x00007ff6c79c3118 in io_loop_run (ioloop=0x1c30820) at ioloop.c:398
No locals.
#11 0x00007ff6c79af403 in master_service_run (service=0x1c306d0, callback=0xffffe906) at master-service.c:544
No locals.
#12 0x0000000000414cae in doveadm_server_flush_one (server=0x1c46b00) at doveadm-mail-server.c:149
        count = 0
#13 0x0000000000414dd2 in doveadm_mail_server_flush () at doveadm-mail-server.c:307
        server = 0x1c46b00
#14 0x000000000041009a in doveadm_mail_cmd (cmd=0x1c35ca8, argc=4, argv=0x1c303a0) at doveadm-mail.c:529
        ctx = 0x1c36cb0
        getopt_args = 0x4336e6 "AS:u:"
        wildcard_user = 0x0
        error = <value optimized out>
        ret = 0
        c = <value optimized out>
#15 0x0000000000410501 in doveadm_mail_try_run (cmd_name=0x1c303f0 "search", argc=1227192544, argv=0x437727) at doveadm-mail.c:577
        cmd__foreach_end = 0x1c35e28
        cmd = 0x1c35ca8
        cmd_name_len = 0
        __FUNCTION__ = "doveadm_mail_try_run"
#16 0x0000000000417051 in main (argc=4, argv=0x1c30388) at doveadm.c:373
        cmd_name = 0x1c303f0 "search"
        quick_init = false
        c = <value optimized out>