Segfault on LIST Command

[Thorsten Hater]

Dear all,

I experience SegFaults in the imap binary on a LIST "" "" command,
as sent by Claws mail. Using LIST "" "INBOX" or similar is fine.
Here is an example telnet session

$ telnet 127.0.0.1 143
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE
AUTH=PLAIN] Dovecot ready.
01 LOGIN **** ****
01 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE
SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT
MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS
LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN
CONTEXT=SEARCH LIST-STATUS BINARY MOVE SPECIAL-USE QUOTA] Logged in
02 LIST "" ""
Connection closed by foreign host.

In the log file

dovecot[8375]: imap(***): Fatal: master: service(imap): child 15803 killed
with signal 11 (core dumps disabled)

Please find the config below.

Best regards,
 Thorsten

$ doveconf -n
# 2.2.26.0 (23d1de6): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.16 (1dc4c73)
# OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.6
auth_debug = yes
auth_debug_passwords = yes
auth_socket_path = /var/run/dovecot/auth-userdb
auth_verbose = yes
base_dir = /var/run/dovecot/
default_internal_user = pop
first_valid_uid = 48
import_environment = TZ DEBUG=1
last_valid_uid = 48
login_trusted_networks = ****
mail_debug = yes
mail_gid = pop
mail_plugins = " mail_log notify zlib quota"
mail_uid = pop
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character
vacation subaddress comparator-i;ascii-numeric relational regex imap4flags
copy include variables body enotify environment mailbox date index ihave
duplicate mime foreverypart extracttext
namespace inbox {
  inbox = yes
  list = children
  location =
  mailbox Drafts {
    auto = no
    special_use = \Drafts
  }
  mailbox Sent {
    auto = no
    special_use = \Sent
  }
  mailbox Trash {
    auto = no
    autoexpunge = 30 days
    special_use = \Trash
  }
  mailbox drafts {
    auto = no
    special_use = \Drafts
  }
  mailbox sent {
    auto = no
    special_use = \Sent
  }
  mailbox spamverdacht {
    auto = no
    autoexpunge = 30 days
    special_use = \Junk
  }
  mailbox trash {
    auto = no
    autoexpunge = 30 days
    special_use = \Trash
  }
  mailbox virenverdacht {
    auto = no
    autoexpunge = 30 days
    special_use = \Junk
  }
  prefix = INBOX.
  separator = .
  subscriptions = yes
  type = private
}
passdb {
  args = nopassword=y
  driver = static
}
plugin {
  last_login_dict = file:~/lastlogin
  mail_log_events = delete undelete expunge copy mailbox_delete
mailbox_rename
  mail_log_fields = uid box msgid size
  quota = maildir:User quota
  quota_warning = storage=80%% 80 %u %{userdb:quota_bytes}
  quota_warning2 = storage=90%% 90 %u %{userdb:quota_bytes}
  quota_warning3 = storage=95%% 95 %u %{userdb:quota_bytes}
  sieve = ldap:/etc/dovecot/pigeonhole-ldap.conf
  sieve_dir = ~/sieve
  sieve_plugins = sieve_storage_ldap
  zlib_save = gz
  zlib_save_level = 6
}
service imap {
  executable = imap postlogin
}
service pop3 {
  executable = pop3 postlogin
}
service postlogin {
  executable = script-login -d rawlog
}
service quota-warning {
  executable = script /bin/quota-warning.sh
}
ssl = no
userdb {
  args = /etc/dovecot/userdb-ldap.conf
  driver = ldap
  result_failure = return-fail
  result_internalfail = return-fail
  result_success = continue-ok
}
userdb {
  default_fields = quota_bytes=42M
  driver = bdb_quota
  override_fields = quota_rule=*:bytes=%{userdb:quota_bytes}
  result_failure = return-fail
  result_internalfail = return-fail
  result_success = continue-ok
}
verbose_proctitle = yes
protocol lda {
  auth_socket_path = /var/run/dovecot/auth-userdb
  mail_plugin_dir = /lib/dovecot/modules
  mail_plugins = " mail_log notify zlib quota sieve"
}
protocol imap {
  mail_plugins = " mail_log notify zlib quota imap_xauth last_login
imap_quota"
}
protocol pop3 {
  mail_plugins = " mail_log notify zlib quota last_login"
}