OOM in Dovecot 2.2.13 imap

[Bernhard Schmidt]

Hi Timo,

thanks for your answer.

>> we run Dovecot 2.2.13 on Debian Wheezy with a couple thousand
>> mailboxes. We have two users that repeatedly trigger an OOM
>> condition with IMAP.
>>
>> Jun 23 12:53:21 lxmhs74 dovecot: imap(USER): Fatal:
>> pool_system_realloc(268435456): Out of memory
> ..
>> #6  0x00007f11766e6cda in o_stream_grow_buffer
>> (fstream=fstream at entry=0x7f11789f41c0, bytes=<optimized out>) at
>> ostream-file.c:440 size = 268435456 new_size = <optimized out>
>> end_size = <optimized out>
> ..
>> #11 0x00007f1175692849 in o_stream_zlib_send_outbuf
>> (zstream=0x7f11789f9340) at ostream-zlib.c:94 ret = <optimized
>> out> size = 12113 #12 0x00007f1175692982 in
>> o_stream_zlib_send_flush (zstream=zstream at entry=0x7f11789f9340,
>> final=final at entry=true) at ostream-zlib.c:189
>
> This is most likely because of the IMAP COMPRESS extension, which
> causes the output stream buffer to get really large. So the easiest
> fix would be to just disable imap_zlib plugin and it'll probably
> work. But this should get fixed properly.. I just can't figure out
> how this can happen. What was the IMAP client doing that caused it?
> Could you run a few more gdb commands:
>
>> #17 0x00007f1176e8d269 in client_output (client=0x7f11789f4470) at
>> imap-client.c:1019
>
> Assuming client_output is again in frame 17, run:
>
> f 17 p *client.command_queue p *client.command_queue.next


#0  0x00007f1176307475 in raise () from /lib/x86_64-linux-gnu/libc.so.6
(gdb) f 17
#17 0x00007f1176e8d269 in client_output (client=0x7f11789f4470) at
imap-client.c:1019
1019    imap-client.c: No such file or directory.
(gdb) p *client.command_queue
$1 = {prev = 0x0, next = 0x0, client = 0x7f11789f4470, pool =
0x7f11789f4c60, tag = 0x7f11789f4d60 "9", name = 0x7f11789f4d68 "UID
fetch",
   args = 0x7f11789f4d78 "3044 (UID RFC822.SIZE BODY.PEEK[])", cmd_flags
= COMMAND_FLAG_BREAKS_SEQS,
   func = 0x7f1176e83d10 <cmd_fetch_continue>, context = 0x7f11789f4da0,
module_contexts = {arr = {buffer = 0x7f11789f4d00, element_size = 8},
     v = 0x7f11789f4d00, v_modifiable = 0x7f11789f4d00}, parser =
0x7f11789df950, state = CLIENT_COMMAND_STATE_WAIT_OUTPUT, sync = 0x0,
   uid = 1, cancel = 0, param_error = 0, search_save_result = 0,
search_save_result_used = 0, temp_executed = 1, tagline_sent = 0}
(gdb) p *client.command_queue.next
Cannot access memory at address 0x0

We could easily live without IMAP COMPRESS for now, but if this
backtrace confirms your suspicion we will gladly try a build with your
patches applied.

Thanks,
Bernhard