LMTP crashes on Debian with dovecot backports from rename-it.nl

[Timo Sirainen]

On 29 Dec 2015, at 06:12, Christian Schmidt <christian.schmidt at chemie.uni-hamburg.de> wrote:
> 
> Hello dovecot-users,
> 
> we're running Debian 7.9 with dovecot from Stephan Bosch's repository:
> deb http://xi.rename-it.nl/debian/ oldstable-auto/dovecot-2.2 main
> 
> Starting with dovecot 2.2.20-1 build 28, we suddenly discovered that
> some mails (to be locally delivered) "got stuck". dovecot's log revealed
> messages like the following one:

> Dec 29 09:56:51 mailhost dovecot:
> lmtp(MAILRECIPIENT at chemie.uni-hamburg.de): Panic: file
> ../../../src/lib/array.h: line 219 (array_idx_i):
> 	assertion failed: (idx * array->element_size < array->buffer->used)
..
> lmtp(MAILRECIPIENT at chemie.uni-hamburg.de): Error: Raw backtrace:
> /usr/lib/dovecot/libdovecot.so.0(+0x8360f) [0x7f58fce4f60f] ->
> /usr/lib/dovecot/libdovecot.so.0(+0x8366e) [0x7f58fce4f66e] ->
> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f58fcdf8a3e] ->
> /usr/lib/dovecot/libdovecot-storage.so.0(+0x3cc75) [0x7f58fd107c75] ->
> /usr/lib/dovecot/libdovecot-storage.so.0(+0xabeda) [0x7f58fd176eda] ->
> /usr/lib/dovecot/libdovecot-storage.so.0(index_mail_get_first_header+0xba)
> [0x7f58fd17723a] ->
> /usr/lib/dovecot/libdovecot-storage.so.0(mail_get_first_header+0x38)
> [0x7f58fd108cd8] ->
> /usr/lib/dovecot/modules/lib20_mail_log_plugin.so(+0x1b5c)
> [0x7f58fb16cb5c] ->

So looking up a header causes a crash. Can you send me one such mail that causes this crash? The mail can probably be put through http://dovecot.org/tools/maildir-anonymize.pl to preserve the crash but hide all the actual email contents.

> Dec 29 09:56:50 mailhost dovecot:
> lmtp(MAILRECIPIENT at chemie.uni-hamburg.de): Fatal: master: service(lmtp):
> child 15897 killed with signal 6 (core dumps disabled)

gdb backtrace would also be useful. See http://dovecot.org/bugreport.html

> All dovecot builds newer than 2.2.20-1~auto+26 show the same behaviour.

So either https://github.com/dovecot/core/commit/a556e29bb9e48968b88c783148f3308bf90c7912 or https://github.com/dovecot/core/commit/7d800c558b4a40f11748d4ebfc2bf89eb743f03c broke it. But I don't have any good ideas why they might have broken it.