imap dumping core in libdovecot-storage with assert "(block_count == 0 || block_idx+1 == block_count)"

[Renaud Métrich]

Thank you!

Looks like this indeed fixes the issue.

On 11/10/20 4:46 PM, Timo Sirainen wrote:
> On 10. Nov 2020, at 15.45, Timo Sirainen <timo at sirainen.com 
> <mailto:timo at sirainen.com>> wrote:
>>
>> On 4. Nov 2020, at 13.24, Renaud Métrich <rmetrich at redhat.com 
>> <mailto:rmetrich at redhat.com>> wrote:
>>> I would like to report an issue which is 100% reproducible with a 
>>> specific mail available in the reproducer attached to Red Hat's 
>>> bugzilla <https://bugzilla.redhat.com/show_bug.cgi?id=1894418> 
>>> (https://bugzilla.redhat.com/attachment.cgi?id=1726535):
>>> When performing a "FETCH <ID> (BINARY.SIZE[1]
>>>        BINARY.PEEK[1])" operation, imap crashes with following backtrace:
>>
>> Thanks, this should fix it:
>>
>> diff --git a/src/lib-storage/index/index-mail-binary.c 
>> b/src/lib-storage/index/index-mail-binary.c
>> index 2577f1afe5..f7bf984916 100644
>> --- a/src/lib-storage/index/index-mail-binary.c
>> +++ b/src/lib-storage/index/index-mail-binary.c
>> @@ -339,7 +339,7 @@ blocks_count_lines(struct binary_ctx *ctx, struct 
>> istream *full_input)
>>                 i_stream_skip(full_input, skip);
>>                 cur_block_offset += skip;
>>
>> -               if (cur_block->input->eof) {
>> +               if (i_stream_read_eof(cur_block->input)) {
>>                         /* go to the next block */
>>                         if (++block_idx == block_count) {
>> i_assert(i_stream_read_eof(full_input));
>
> Actually, that breaks things. This one should be ok:
>
> diff --git a/src/lib-storage/index/index-mail-binary.c 
> b/src/lib-storage/index/index-mail-binary.c
> index 2577f1afe5..80c319e050 100644
> --- a/src/lib-storage/index/index-mail-binary.c
> +++ b/src/lib-storage/index/index-mail-binary.c
> @@ -339,13 +339,14 @@ blocks_count_lines(struct binary_ctx *ctx, 
> struct istream *full_input)
>                 i_stream_skip(full_input, skip);
>                 cur_block_offset += skip;
>
> -               if (cur_block->input->eof) {
> +               if (i_stream_read_eof(cur_block->input)) {
>                         /* go to the next block */
> -                       if (++block_idx == block_count) {
> +                       if (block_idx+1 == block_count) {
> i_assert(i_stream_read_eof(full_input));
>                                 ret = -1;
>                                 break;
>                         }
> +                       block_idx++;
>                         cur_block++;
>                         cur_block_offset = 0;
>                 }
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://dovecot.org/pipermail/dovecot/attachments/20201115/32a45e08/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x5D129094FB6E4326.asc
Type: application/pgp-keys
Size: 3087 bytes
Desc: not available
URL: <https://dovecot.org/pipermail/dovecot/attachments/20201115/32a45e08/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://dovecot.org/pipermail/dovecot/attachments/20201115/32a45e08/attachment.sig>