LMTP delivery segfaults when user is over quota.

Hello!

I'm having crashes with LMTP delivery when user is over quota on the latest CentOS 7.4 with the latest Dovecot 2.3.0.1 from Dovecot repo.

I see the issue has been fixed on January 17, but it doesn't seem to have made it into 2.3.0.1 (I compared with the source from https://dovecot.org/releases/2.3/dovecot-2.3.0.1.tar.gz).

https://github.com/dovecot/core/commit/2bf919786518d138cc07d9cc21e14ad5e07e5...

I also noticed a similar construct being used on line 465 (rcpt->rcpt.rcpt->path) that was causing the segfault on the above commit on line 136.

struct smtp_address *rcpt_to = rcpt->rcpt.rcpt->path;

Should that also use rcpt->rcpt.path; ?

Thanks from the other side of the gulf! Reio