Crash during "doveadm import"

[Ralf Hildebrandt]

Today I was looking for some spam and issued this command:
==========================================================

doveadm import -u restore at backup.invalid mdbox:/home/copymail2/mdbox INBOX header Reply-To bixrs.com

Then I immediately got a crash:

doveadm(restore at backup.invalid): Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000)
doveadm(restore at backup.invalid): Error: Raw backtrace:
/usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f757c0edf32] ->
/usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f757c0ee04e] -> 
/usr/lib/dovecot/libdovecot.so.0(+0xe692e) [0x7f757c0f892e] ->
/usr/lib/dovecot/libdovecot.so.0(+0xe6971) [0x7f757c0f8971] ->
/usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f757c05321b] ->
/usr/lib/dovecot/libdovecot-storage.so.0(mail_index_uint32_to_offset+0x70)[0x7f757c4a43c0] ->
/usr/lib/dovecot/libdovecot-storage.so.0(mail_cache_add+0x83b)[0x7f757c48cf4b] ->
/usr/lib/dovecot/libdovecot-storage.so.0(index_mail_parse_header+0x449)[0x7f757c46f5f9] ->
/usr/lib/dovecot/libdovecot.so.0(+0xbf2c3) [0x7f757c0d12c3] ->
/usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x74)[0x7f757c105c94] ->
/usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x29) [0x7f757c105fc9]-> 
/usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7f757c10693d] ->
/usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x68) [0x7f757c0d79c8] ->
/usr/lib/dovecot/libdovecot.so.0(message_parse_header+0x4f) [0x7f757c0d839f] ->
/usr/lib/dovecot/libdovecot-storage.so.0(+0xc9741) [0x7f757c479741] ->
/usr/lib/dovecot/libdovecot-storage.so.0(+0xca9f4) [0x7f757c47a9f4] ->
/usr/lib/dovecot/libdovecot-storage.so.0(index_storage_search_next_nonblock+0x10d)[0x7f757c47b1cd] ->
/usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next_nonblock+0x22)[0x7f757c3fd6e2] ->
/usr/lib/dovecot/libdovecot-storage.so.0(mailbox_search_next+0x3d)[0x7f757c3fd74d] -> 
doveadm(+0x31a33) [0x559bc9c63a33] -> 
doveadm(+0x2c518) [0x559bc9c5e518] -> 
doveadm(+0x2d256) [0x559bc9c5f256] ->
doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x20e) [0x559bc9c600ce]-> 
doveadm(doveadm_cmd_run_ver2+0x548) [0x559bc9c70fa8] ->
doveadm(doveadm_cmd_try_run_ver2+0x37) [0x559bc9c70ff7] ->
doveadm(main+0x1d1) [0x559bc9c4e641] ->
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7f757b653b97] ->
doveadm(_start+0x2a) [0x559bc9c4eb3a]
Command terminated by signal 6

Running it in gdb gives me:

# gdb doveadm
(gdb) set args import -u restore at backup.invalid
mdbox:/home/copymail2/mdbox  mailbox INBOX header Reply-To bixrs.com
(gdb) run
Starting program: /usr/bin/doveadm import -u restore at backup.invalid mdbox:/home/copymail2/mdbox INBOX header Reply-To bixrs.com
(gdb) bt
#0  __GI_raise (sig=sig at entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff68ec8b1 in __GI_abort () at abort.c:79
#2  0x00007ffff73728e1 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at failures.c:459
#3  fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:471
#4  0x00007ffff7372971 in default_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:479
#5  0x00007ffff72cd21b in i_panic (format=format at entry=0x7ffff772dd60 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:523
#6  0x00007ffff771e3c0 in mail_index_uint32_to_offset (offset=<optimized out>) at mail-index-util.c:10
#7  0x00007ffff7706f4b in mail_cache_header_fields_write (ctx=0x55555585b690, buffer=<optimized out>, buffer=<optimized out>) at mail-cache-transaction.c:609
#8  mail_cache_header_add_field (field_idx=15, ctx=0x55555585b690) at mail-cache-transaction.c:690
#9  mail_cache_add (ctx=0x55555585b690, seq=1, field_idx=field_idx at entry=15, data=0x7ffff773b736, data_size=0) at mail-cache-transaction.c:739
#10 0x00007ffff76ebc34 in index_mail_cache_add_idx (mail=mail at entry=0x55555586e8d8, field_idx=field_idx at entry=15, data=data at entry=0x7ffff773b736, data_size=data_size at entry=0) at index-mail.c:631
#11 0x00007ffff76e95f9 in index_mail_parse_header_finish (mail=<optimized out>) at index-mail-headers.c:132
#12 index_mail_parse_header (part=<optimized out>, hdr=<optimized out>, mail=<optimized out>) at index-mail-headers.c:313
#13 0x00007ffff734b2c3 in read_header (mstream=0x555555879530) at istream-header-filter.c:356
#14 i_stream_header_filter_read (stream=0x555555879530) at istream-header-filter.c:446
#15 0x00007ffff737fc94 in i_stream_read_memarea (stream=stream at entry=0x5555558795b0) at istream.c:313
#16 0x00007ffff737ffc9 in i_stream_read (stream=stream at entry=0x5555558795b0) at istream.c:271
#17 0x00007ffff738093d in i_stream_read_data (stream=0x5555558795b0, data_r=data_r at entry=0x7fffffffdc18, size_r=size_r at entry=0x7fffffffdc20, threshold=threshold at entry=1) at istream.c:745
#18 0x00007ffff73519c8 in i_stream_read_bytes (wanted=2, size_r=0x7fffffffdc20, data_r=0x7fffffffdc18, stream=<optimized out>) at ../../src/lib/istream.h:217
#19 message_parse_header_next (ctx=0x55555582e580, hdr_r=hdr_r at entry=0x7fffffffdc80) at message-header-parser.c:85
#20 0x00007ffff735239f in message_parse_header (input=<optimized out>, hdr_size=hdr_size at entry=0x0, flags=flags at entry=MESSAGE_HEADER_PARSER_FLAG_CLEAN_ONELINE, 
    callback=callback at entry=0x7ffff76f2cb0 <search_header>, context=context at entry=0x7fffffffdcf0) at message-header-parser.c:392
#21 0x00007ffff76f3741 in search_arg_match_text (ctx=0x55555585bad0, args=0x5555558216d0) at index-search.c:759
#22 search_match_once (ctx=0x55555585bad0) at index-search.c:1398
#23 0x00007ffff76f49f4 in search_match_next (ctx=0x55555585bad0) at index-search.c:1505
#24 search_more_with_mail (mail=<optimized out>, ctx=0x55555585bad0) at index-search.c:1621
#25 search_more_with_prefetching (mail_r=<optimized out>, ctx=<optimized out>) at index-search.c:1703
#26 search_more (ctx=ctx at entry=0x55555585bad0, mail_r=mail_r at entry=0x7fffffffde20) at index-search.c:1777
#27 0x00007ffff76f51cd in index_storage_search_next_nonblock (_ctx=0x55555585bad0, mail_r=0x7fffffffdef0, tryagain_r=0x7fffffffde87) at index-search.c:1805
#28 0x00007ffff76776e2 in mailbox_search_next_nonblock (ctx=0x55555585bad0, mail_r=0x7fffffffdef0, tryagain_r=<optimized out>) at mail-storage.c:2307
#29 0x00007ffff767774d in mailbox_search_next (ctx=0x55555585bad0, mail_r=mail_r at entry=0x7fffffffdef0) at mail-storage.c:2292
#30 0x0000555555586c02 in doveadm_mail_iter_next (iter=<optimized out>, mail_r=mail_r at entry=0x7fffffffdef0) at doveadm-mail-iter.c:161
#31 0x0000555555585a33 in cmd_import_box (search_args=<optimized out>, info=0x55555584f820, dest_user=<optimized out>, ctx=0x55555581fda8) at doveadm-mail-import.c:143 #32 cmd_import_run (_ctx=0x55555581fda8, user=0x5555558374a8) at doveadm-mail-import.c:203
#33 0x0000555555580518 in doveadm_mail_next_user (ctx=ctx at entry=0x55555581fda8, error_r=error_r at entry=0x7fffffffe0d0) at doveadm-mail.c:462
#34 0x000055555558116e in doveadm_mail_single_user (ctx=ctx at entry=0x55555581fda8, error_r=error_r at entry=0x7fffffffe0d0) at doveadm-mail.c:492
#35 0x0000555555581256 in doveadm_mail_cmd_exec (ctx=ctx at entry=0x55555581fda8, wildcard_user=wildcard_user at entry=0x0) at doveadm-mail.c:653
#36 0x00005555555820ce in doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=<optimized out>) at doveadm-mail.c:1149
#37 0x0000555555592fa8 in doveadm_cmd_run_ver2 (argc=8, argv=0x5555557f6bb8, cctx=cctx at entry=0x7fffffffe2c0) at doveadm-cmd.c:575
#38 0x0000555555592ff7 in doveadm_cmd_try_run_ver2 (cmd_name=<optimized out>, argc=<optimized out>, argv=<optimized out>, cctx=0x7fffffffe2c0) at doveadm-cmd.c:497
#39 0x0000555555570641 in main (argc=<optimized out>, argv=<optimized out>) at doveadm.c:395


-- 
Ralf Hildebrandt
  Geschäftsbereich IT | Abteilung Netzwerk
  Charité - Universitätsmedizin Berlin
  Campus Benjamin Franklin
  Hindenburgdamm 30 | D-12203 Berlin
  Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962
  ralf.hildebrandt at charite.de | https://www.charite.de