I committed this change to all hg branches: http://hg.dovecot.org/dovecot-2.1/rev/4461b48fcc1f

After that I realized that it doesn't actually matter, because it fixes only a situation where input buffer's size is less than 84 bytes. This happened on a test program where I was using a 64 byte buffer, but the real code in Dovecot always uses much larger buffers.

So, don't worry, there's no way to actually DOS Dovecot with this. No need for distro people to create any security releases.