imap dumping core in libdovecot-storage with assert "(block_count == 0 || block_idx+1 == block_count)"

[Timo Sirainen]

On 4. Nov 2020, at 13.24, Renaud Métrich <rmetrich at redhat.com> wrote:
> I would like to report an issue which is 100% reproducible with a specific mail available in the reproducer attached to Red Hat's bugzilla <https://bugzilla.redhat.com/show_bug.cgi?id=1894418>(https://bugzilla.redhat.com/attachment.cgi?id=1726535 <https://bugzilla.redhat.com/attachment.cgi?id=1726535>):
> When performing a "FETCH <ID> (BINARY.SIZE[1]
>       BINARY.PEEK[1])" operation, imap crashes with following backtrace:

Thanks, this should fix it:

diff --git a/src/lib-storage/index/index-mail-binary.c b/src/lib-storage/index/index-mail-binary.c
index 2577f1afe5..f7bf984916 100644
--- a/src/lib-storage/index/index-mail-binary.c
+++ b/src/lib-storage/index/index-mail-binary.c
@@ -339,7 +339,7 @@ blocks_count_lines(struct binary_ctx *ctx, struct istream *full_input)
                i_stream_skip(full_input, skip);
                cur_block_offset += skip;

-               if (cur_block->input->eof) {
+               if (i_stream_read_eof(cur_block->input)) {
                        /* go to the next block */
                        if (++block_idx == block_count) {
                                i_assert(i_stream_read_eof(full_input));

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://dovecot.org/pipermail/dovecot/attachments/20201110/a5dd5a05/attachment.html>