Hi folks,

reading the environment item "vnd.dovecot.mailbox-from" in an imapsieve script that runs for an APPEND crashes the imap process with signal 11.

Version

Dovecot 2.4.5 (0cbb641) with its Pigeonhole, official dovecot/dovecot:2.4.5 container image, running rootless.

Symptom

On an IMAP APPEND into a mailbox the script runs for, the client connection drops and the log shows:

imap(wanda)<887><...>: Fatal: master: service(imap): child 887 killed with signal 11 (core dumps disabled ...)

COPY and MOVE with the same script work fine.

Cause

src/plugins/imapsieve/ext-imapsieve-environment.c:

static const char * envit_vnd_mailbox_from_get_value(...) { ... return mailbox_get_vname(isctx->event.src_mailbox); }

For an APPEND there is no source mailbox, so isctx->event.src_mailbox is NULL and mailbox_get_vname() dereferences it. The code is unchanged on pigeonhole main as of a2b3edc (2026-11-02).

envit_vnd_mailbox_to_get_value() has the same pattern for isctx->event.dest_mailbox. That one is probably always set, but a guard would not hurt.

Suggested fix

Return NULL (no value) when the mailbox is NULL:

       if (isctx->event.src_mailbox == NULL)
               return NULL;
       return mailbox_get_vname(isctx->event.src_mailbox);

and likewise for dest_mailbox. tst-environment.c already treats a NULL value as "item not available", so the environment test then simply evaluates to false.

Reproduction

Configuration:

mailbox * { sieve_script test { type = before cause = copy append path = /path/test.sieve } } sieve_plugins { sieve_imapsieve = yes } sieve_global_extensions { vnd.dovecot.environment = yes }

(plus the usual imap_sieve entry in mail_plugins for protocol imap)

test.sieve:

require ["environment", "imapsieve", "variables", "vnd.dovecot.imapsieve"]; if environment :matches "vnd.dovecot.mailbox-from" "*" { set "from" "${1}"; }

Then APPEND any message into a mailbox: the imap process dies with signal 11. A COPY or MOVE works fine.

Impact and workaround

Only the user's own imap process is affected. It is triggered by an admin-configured imapsieve script, or by a user's own imapsieve script where IMAP METADATA is enabled.

Workaround: only read the item when imap.cause is "COPY":

if environment "imap.cause" "COPY" { if environment :matches "vnd.dovecot.mailbox-from" "*" { set "from" "${1}"; } }

I have no backtrace: core dumps are disabled in this setup, so no core file was written. The cause above comes from Claude Code reading the source.

Regards, Manuel