Hi-
Found a message that will generate a pop3 coredump when using mbox format. It seems to do with the fact that it has a mime part with a line that's 10,000 bytes long. However, that doesn't seem to be the only factor.
Adjusting the size of the mail header seems to cause different kinds of crashes. I'll avoid attaching the message here but I've put it at http://www.mv.com/users/mem/x/badmail
Reproducing it here on a BSD/OS system involves something like:
(login to a virgin account or one you don't care about)
% wget http://www.mv.com/users/mem/x/badmail
% rm -rf .imap
% MAIL=mbox:`pwd`/badmail
% limit coredump 10m
% /usr/local/libexec/dovecot/pop3
quitat which point you should get some errors and/or a coredump. You may need to do it twice (i.e. let it create the .imap/ index structure first).
If you can't make it happen I can send along more info.
-mm-
(and yes, this was a real mail message, albeit a spam, except that I simplified it some and replaced all of the content with "x" characters)