That really shouldn't be happening. What dovecot version is this with? Can you run it with valgrind?
its version 1.1.15
valgrind --trace-children=yes dovecot --exec-mail ext /usr/libexec/dovecot/expire-tool --test
==31981== Memcheck, a memory error detector. ==31981== Copyright (C) 2002-2005, and GNU GPL'd, by Julian Seward et al. ==31981== Using LibVEX rev 1575, a library for dynamic binary translation. ==31981== Copyright (C) 2004-2005, and GNU GPL'd, by OpenWorks LLP. ==31981== Using valgrind-3.1.1, a dynamic binary instrumentation framework. ==31981== Copyright (C) 2000-2005, and GNU GPL'd, by Julian Seward et al. ==31981== For more details, rerun with: -v ==31981== ==31981== Memcheck, a memory error detector. ==31981== Copyright (C) 2002-2005, and GNU GPL'd, by Julian Seward et al. ==31981== Using LibVEX rev 1575, a library for dynamic binary translation. ==31981== Copyright (C) 2004-2005, and GNU GPL'd, by OpenWorks LLP. ==31981== Using valgrind-3.1.1, a dynamic binary instrumentation framework. ==31981== Copyright (C) 2000-2005, and GNU GPL'd, by Julian Seward et al. ==31981== For more details, rerun with: -v ==31981== Warning: Growing pool 'Expire pool' with: 1024 ==31981== Invalid read of size 1 ==31981== at 0x4021FB8: strlen (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==31981== by 0x80BA37F: vstrconcat (strfuncs.c:165) ==31981== by 0x80BABE2: t_strconcat (strfuncs.c:265) ==31981== by 0x804A948: auth_input (auth-client.c:142) ==31981== by 0x80B1A16: io_loop_handler_run (ioloop-epoll.c:209) ==31981== by 0x80B0B07: io_loop_run (ioloop.c:336) ==31981== by 0x804A5E3: auth_client_put_user_env (auth-client.c:229) ==31981== by 0x804B5C6: main (expire-tool.c:43) ==31981== Address 0x4 is not stack'd, malloc'd or (recently) free'd ==31981== ==31981== Process terminating with default action of signal 11 (SIGSEGV) ==31981== Access not within mapped region at address 0x4 ==31981== at 0x4021FB8: strlen (in /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so) ==31981== by 0x80BA37F: vstrconcat (strfuncs.c:165) ==31981== by 0x80BABE2: t_strconcat (strfuncs.c:265) ==31981== by 0x804A948: auth_input (auth-client.c:142) ==31981== by 0x80B1A16: io_loop_handler_run (ioloop-epoll.c:209) ==31981== by 0x80B0B07: io_loop_run (ioloop.c:336) ==31981== by 0x804A5E3: auth_client_put_user_env (auth-client.c:229) ==31981== by 0x804B5C6: main (expire-tool.c:43) ==31981== ==31981== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 3 from 1) ==31981== malloc/free: in use at exit: 34,477 bytes in 35 blocks. ==31981== malloc/free: 36 allocs, 1 frees, 34,637 bytes allocated. ==31981== For counts of detected errors, rerun with: -v ==31981== searching for pointers to 35 not-freed blocks. ==31981== checked 93,876 bytes. ==31981== ==31981== LEAK SUMMARY: ==31981== definitely lost: 0 bytes in 0 blocks. ==31981== possibly lost: 0 bytes in 0 blocks. ==31981== still reachable: 34,477 bytes in 35 blocks. ==31981== suppressed: 0 bytes in 0 blocks. ==31981== Reachable blocks (those to which a pointer was found) are not shown. ==31981== To see them, rerun with: --show-reachable=yes Segmentation Fault
Andre