On 10. Nov 2020, at 15.45, Timo Sirainen <timo@sirainen.com> wrote:

On 4. Nov 2020, at 13.24, Renaud Métrich <rmetrich@redhat.com> wrote:
I would like to report an issue which is 100% reproducible with a specific mail available in the reproducer attached to Red Hat's bugzilla (https://bugzilla.redhat.com/attachment.cgi?id=1726535):
When performing a "FETCH <ID> (BINARY.SIZE[1]
      BINARY.PEEK[1])" operation, imap crashes with following backtrace:
Thanks, this should fix it:

diff --git a/src/lib-storage/index/index-mail-binary.c b/src/lib-storage/index/index-mail-binary.c
index 2577f1afe5..f7bf984916 100644
--- a/src/lib-storage/index/index-mail-binary.c
+++ b/src/lib-storage/index/index-mail-binary.c
@@ -339,7 +339,7 @@ blocks_count_lines(struct binary_ctx *ctx, struct istream *full_input)
i_stream_skip(full_input, skip);
cur_block_offset += skip;

- if (cur_block->input->eof) {
+ if (i_stream_read_eof(cur_block->input)) {
/* go to the next block */
if (++block_idx == block_count) {
i_assert(i_stream_read_eof(full_input));

Actually, that breaks things. This one should be ok:

diff --git a/src/lib-storage/index/index-mail-binary.c b/src/lib-storage/index/index-mail-binary.c

index 2577f1afe5..80c319e050 100644

--- a/src/lib-storage/index/index-mail-binary.c

+++ b/src/lib-storage/index/index-mail-binary.c

@@ -339,13 +339,14 @@ blocks_count_lines(struct binary_ctx *ctx, struct istream *full_input)

i_stream_skip(full_input, skip);

cur_block_offset += skip;

- if (cur_block->input->eof) {

+ if (i_stream_read_eof(cur_block->input)) {

/* go to the next block */

- if (++block_idx == block_count) {

+ if (block_idx+1 == block_count) {

i_assert(i_stream_read_eof(full_input));

ret = -1;

break;

}

+ block_idx++;

cur_block++;

cur_block_offset = 0;

}