lmtp issues with specific message on dovecot 2.3.2

3 Jul 2018


      Hello,
I am getting crash on lmtp for specific message on dovecot 2.3.2
See below the backtrace:
Jul 02 22:54:20 Panic: lmtp(xxx)<172769><yL/kH0zXOlvhogIAF3haWw:3>: Buffer
write out of range (23153 + 18446744073709551614)
Jul 02 22:54:20 Error: lmtp(xxx)<172769><yL/kH0zXOlvhogIAF3haWw:3>: Raw
backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0xcdfe4) [0x7f1fc8df9fe4] ->
/usr/lib64/dovecot/libdovecot.so.0(+0xce09e) [0x7f1fc8dfa09e] ->
/usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f1fc8d69424] ->
/usr/lib64/dovecot/libdovecot.so.0(buffer_write+0xfc) [0x7f1fc8df425c] ->
/usr/lib64/dovecot/libdovecot-sieve.so.0(rfc2822_header_append+0xe7)
[0x7f1fc5dd1087] -> /usr/lib64/dovecot/libdovecot-sieve.so.0(+0x5c01c)
[0x7f1fc5dac01c] -> /usr/lib64/dovecot/libdovecot-sieve.so.0(+0x40219)
[0x7f1fc5d90219] ->
/usr/lib64/dovecot/libdovecot-sieve.so.0(sieve_result_execute+0x2ef)
[0x7f1fc5d91c2f] -> /usr/lib64/dovecot/libdovecot-sieve.so.0(+0x525be)
[0x7f1fc5da25be] ->
/usr/lib64/dovecot/libdovecot-sieve.so.0(sieve_multiscript_run+0x96)
[0x7f1fc5da3456] -> /usr/lib64/dovecot/lib90_sieve_plugin.so(+0x3847)
[0x7f1fc6009847] ->
/usr/lib64/dovecot/libdovecot-lda.so.0(mail_deliver+0xec) [0x7f1fc93fff7c]
-> dovecot/lmtp 10.0.5.1 DATA [0x55f5bce9d97b] ->
dovecot/lmtp 10.0.5.1 DATA [0x55f5bce9c48d] ->
/usr/lib64/dovecot/libdovecot.so.0(+0x4ffa2) [0x7f1fc8d7bfa2] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x65) [0x7f1fc8e11a75] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x10f)
[0x7f1fc8e1335f] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x52)
[0x7f1fc8e11b72] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38)
[0x7f1fc8e11d98] ->
/usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f1fc8d8d723]
-> dovecot/lmtp 10.0.5.1 DATA [0x55f5bce9b4b9] ->
/lib64/libc.so.6(__libc_start_main+0xf5) [0x7f1fc8981445] -> dovecot/lmtp
10.0.5.1 DATA [0x55f5bce9b5e5]
Jul 02 22:54:20 Fatal: lmtp(xxx)<172769><yL/kH0zXOlvhogIAF3haWw:3>: master:
service(lmtp): child 172769 killed with signal 6 (core dumps disabled -
https://dovecot.org/bugreport.html#coredumps)
uname a
Linux mailsrv01 3.10.0-862.3.3.el7.x86_64 #1 SMP Fri Jun 15 04:15:27 UTC
2018 x86_64 x86_64 x86_64 GNU/Linux
dovecot version
2.3.2 (582970113)
# 2.3.2 (582970113): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.2 (7704de5e)
# OS: Linux 3.10.0-862.3.3.el7.x86_64 x86_64 CentOS Linux release 7.5.1804
(Core)
# Hostname: mailsrv01
auth_master_user_separator = * auth_verbose_passwords = sha1
default_client_limit = 2000 deliver_log_format = subject=%s from:%f
sender:%e to: %{to_envelope} size:%p msgid=%m status=%$
delivery_time=%{delivery_time} session_time=%{session_time}
disable_plaintext_auth = no doveadm_allowed_commands = quota
get,dsync-server,kick,purge,fts rescan,altmove,mailbox list,expunge,mailbox
status doveadm_password =  # hidden, use -P to show it
lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes
lmtp_rcpt_check_quota = yes login_greeting = IMAP4.
login_trusted_networks = x.x.x.x/24
mail_fsync = never
mail_gid = xxx
mail_location = mdbox:~/mdbox:ALT=/altstorage%h/mdbox
mail_plugins = quota quota_clone fts fts_solr zlib mail_uid = xxx
managesieve_notify_capability = mailto managesieve_sieve_capability =
fileinto reject envelope encoded-character vacation subaddress
comparator-i;ascii-numeric relational regex imap4flags copy include
variables body enotify environment mailbox date ihave duplicate vnd.dovecot
.filter namespace inbox {
inbox = yes
list = yes
location =
mailbox "Itens Enviados" {
auto = subscribe
special_use = \Sent
}
mailbox "Itens Excluídos" {
auto = subscribe
special_use = \Trash
}
mailbox Rascunhos {
auto = subscribe
special_use = \Drafts
}
mailbox Spam {
auto = subscribe
special_use = \Junk
}
prefix =
separator = .
}
passdb {
args = /etc/dovecot/dovecot-ldap.conf.ext
driver = ldap
}
plugin {
fts = solr
fts_solr = url=http://x.x.x.x:8983/solr/dovecot/
imapsieve_mailbox1_before = file:/etc/dovecot/antispam/report-spam.sieve
imapsieve_mailbox1_causes = COPY
imapsieve_mailbox1_name = Spam
imapsieve_mailbox2_before = file:/etc/dovecot/antispam/report-ham.sieve
imapsieve_mailbox2_causes = COPY
imapsieve_mailbox2_from = Spam
imapsieve_mailbox2_name = *
last_login_dict = redis:host=x.x.x.x:port=6379
quota = count:User quota
quota_clone_dict = redis:host=x.x.x.x:port=6379
quota_rule = *:bytes=0
quota_rule2 = Itens Excluídos:storage=+xM
quota_vsizes = yes
quota_warning = storage=95%% quota-warning 95 %u
quota_warning2 = storage=80%% quota-warning 80 %u
sieve = ~/.dovecot.sieve
sieve_before = /etc/dovecot/sieve/audit.sieve
sieve_before2 = /etc/dovecot/sieve/duplicate.sieve
sieve_before3 = /etc/dovecot/sieve/spam.sieve
sieve_dir = ~/sieve
sieve_global_extensions = +vnd.dovecot.pipe
sieve_pipe_bin_dir = /etc/dovecot/antispam
sieve_plugins = sieve_imapsieve sieve_extprograms
sieve_vacation_default_period = 7d
sieve_vacation_max_period = 30d
sieve_vacation_min_period = 1h
}
protocols = imap pop3 lmtp sieve
service anvil {
client_limit = 2000
}
service auth {
client_limit = 2000
}
service doveadm {
inet_listener {
port = 9011
}
inet_listener http {
port = 9010
}
vsz_limit = 768 M
}
service imap-login {
process_limit = 800
process_min_avail = 200
service_count = 1
vsz_limit = 512 M
}
service imap-postlogin {
executable = script-login dovecot-postlogin imap
unix_listener imap-postlogin {
user = mail
}
user = $default_internal_user
}
service imap {
executable = imap imap-postlogin
process_limit = 20000
vsz_limit = 768 M
}
service indexer-worker {
vsz_limit = 512 M
}
service lmtp {
inet_listener lmtp {
address = *
port = 24
}
vsz_limit = 512 M
}
service managesieve-login {
inet_listener sieve {
port = 4190
}
process_min_avail = 10
}
service managesieve {
process_limit = 512
}
service pop3-postlogin {
executable = script-login dovecot-postlogin pop3
unix_listener pop3-postlogin {
user = mail
}
user = $default_internal_user
}
service pop3 {
executable = pop3 pop3-postlogin
}
service quota-warning {
executable = script quota-warning
unix_listener quota-warning {
user = mail
}
}
service stats {
chroot = empty
client_limit = 20000
drop_priv_before_exec = no
executable = stats
extra_groups =
group =
idle_kill = 4294967295 secs
privileged_group =
process_limit = 1
process_min_avail = 0
protocol =
service_count = 0
type =
unix_listener stats-reader {
group =
mode = 0600
user =
}
unix_listener stats-writer {
group =
mode = 0600
user =
}
user = $default_internal_user
vsz_limit = 18446744073709551615 B
}
ssl = no
submission_host = x.x.x.x
userdb {
driver = prefetch
}
userdb {
args = /etc/dovecot/dovecot-ldap.conf.ext
driver = ldap
}
verbose_proctitle = yes
protocol lda {
mail_fsync = optimized
mail_plugins = quota quota_clone sieve } protocol imap {
imap_max_line_length = 128 k
mail_max_userip_connections = 30
mail_plugins = quota quota_clone fts fts_solr zlib imap_quota last_login
imap_sieve } protocol lmtp {
mail_fsync = optimized
mail_plugins = quota quota_clone sieve } protocol pop3 {
mail_max_userip_connections = 10
mail_plugins = quota quota_clone fts fts_solr zlib last_login
pop3_logout_format = in=%i out=%o top=%t/%p, retr=%r/%b, del=%d/%m,
size=%s
pop3_no_flag_updates = yes
pop3_save_uidl = yes
pop3_uidl_format = %08Xu%08Xv
}
Regards,
Ricardo

Ricardo Machini Barbosa

Benny Pedersen

Stephan Bosch

tags

participants (3)