dovecot/imap killed with signal 6 after SEARCH in specific mailbox

[Jiri]

Dne 2020-12-07 17:06, John Fawcett napsal:
> On 07/12/2020 16:58, Jiri wrote:
>> Hi All,
>> on my older production server (Deb9 dovecot version 2.2.27-3+deb9u6) a
>> client reported that searching text in one mailbox failed while other
>> mailboxes do search ok.
>> He is using Rouddcube webmail and is searching the whole messages
>> including the body.
>> Errorlog shows panic and assertion failed logs.
>> So I'v moved the 'problematic' mailbox to my latest production server
>> (Deb10 2.3.4.1-5+deb10u4 = 2.3.4.1 (f79e8e7e4)) where I have more RAM
>> to eliminate that and the same error appeared.
>> There is nothing special about the mailbox, roughly 600MiB and 2200
>> messges.
>> Other much larger mailboxes on the same server do search fine.
>> After turning on imap logging in Roundcube mail, the critical command
>> was:
>> A0004 UID SEARCH RETURN (ALL) TEXT whatever
>> I increased default_process_limit and default_client_limit, I run:
>> doveadm index -u ttt at mail2.swpraha.cz -q INBOX
>> but didn't help.
>> 
>> 
>> I used the gdb method to reproduce it and to get the whole info
>> including backtrace:
>> 
>> vmail at s6mail:~$ gdb --args /usr/lib/dovecot/imap -u 
>> ttt at mail2.swpraha.cz
>> (gdb) r
>> <snip>
>> 
>> <snip>   Thanks for any suggestion
>> --Jiri Kacena
> 
> Looks like this (or something very similar) was already fixed
> 
> https://github.com/dovecot/core/commit/a668d767a710ca18ab6e7177d8e8be22a6b024fb
> 
> John

Thanks John, your answer was helpful.
It was the malformed boundary indeed.
Before the fix gets to Debian, I had to manually locate the 'poisoned' 
message and fix the last boundary line.

--Jiri