Steps to reproduce:

• Enable CLucene FTS in Dovecot;
• Open mailbox with MUA;
• Search for message with any text;
• IMAP session crash.

OS: Gentoo Base System release 2.6

Version: FTS: dev-cpp/clucene-2.3.3.4-r6 IMAP: net-mail/dovecot-2.3.2.1 LIBC: sys-libs/musl-1.1.21

Dovecot FTS config:

plugin { fts = lucene fts_lucene = whitespace_chars=@. normalize no_snowball fts_autoindex=yes fts_autoindex_max_recent_msgs=80 fts_index_timeout=90 }

dmesg: [260150.192294] imap[18221]: segfault at 6578772cca98 ip 000063e7f1b10397 sp 00007945d5822970 error 6 in libc.so[63e7f1ae8000+a4000] [260150.192316] Code: 0f 84 44 02 00 00 48 39 ca 0f 84 62 02 00 00 48 8b 43 08 48 89 4a 10 48 89 51 18 48 89 c2 48 83 e0 fe 48 83 ca 01 48 89 53 08 <48> 83 0c 03 01 41 8b 07 48 8d 6b 10 85 c0 0f 84 68 ff ff ff 31 c0

bt full: Core was generated by `dovecot/imap'. Program terminated with signal SIGSEGV, Segmentation fault. #0 unbin (i=0, c=0x1908553de10) at src/malloc/malloc.c:195 195 src/malloc/malloc.c: No such file or directory. (gdb) bt full #0 unbin (i=0, c=0x1908553de10) at src/malloc/malloc.c:195 No locals. #1 malloc (n=<optimized out>, n@entry=4) at src/malloc/malloc.c:320 mask = <optimized out> c = 0x1908553de10 i = 0 j = 0 #2 0x000063e7f1b4984f in wcsdup (s=0x63e7ed7d0c58 L"") at src/string/wcsdup.c:7 l = 0 d = <optimized out> #3 0x000063e7eda98308 in lucene::index::Term::Term (this=0x1908553df80) at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/index/Term.cpp:26 No locals. #4 0x000063e7edad5f25 in lucene::index::SegmentTermEnum::readTerm(lucene::index::Term*) () at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/index/SegmentTermEnum.cpp:351 start = 1 length = 4 totalLength = 5 field = <optimized out> fieldname = 0x1908553d180 L"\142\157\144\171" #5 0x000063e7edad5f7c in lucene::index::SegmentTermEnum::next (this=0x19085524460) at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/index/SegmentTermEnum.cpp:180 tmp = <optimized out> this = 0x19085524460 tmp = <optimized out> tmp = <optimized out> #6 0x000063e7edad5be9 in lucene::index::SegmentTermEnum::scanTo (this=this@entry=0x19085524460, term=term@entry=0x7945d5822dc0) at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/index/SegmentTermEnum.cpp:218 No locals. #7 0x000063e7edad959c in lucene::index::TermInfosReader::scanEnum (this=<optimized out>, term=term@entry=0x7945d5822dc0) at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/index/TermInfosReader.cpp:422 enumerator = 0x19085524460 #8 0x000063e7edad96a4 in lucene::index::TermInfosReader::get (this=<optimized out>, term=term@entry=0x7945d5822dc0) at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/index/TermInfosReader.cpp:246 enumerator = <optimized out> #9 0x000063e7edab9071 in lucene::index::SegmentReader::docFreq (this=0x19085500ae0, t=0x7945d5822dc0) at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/index/SegmentReader.cpp:518 ti = <optimized out> #10 0x000063e7edae2620 in lucene::search::Similarity::idf (this=0x19085526e60, term=0x7945d5822dc0, searcher=0x190855007a0) at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/search/Similarity.cpp:184 No locals. #11 0x000063e7edaeda51 in lucene::search::TermWeight::TermWeight(lucene::search::Searcher*, lucene::search::TermQuery*, lucene::index::Term*) () at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/search/TermQuery.cpp:117 No locals. #12 0x000063e7edaeda99 in lucene::search::TermQuery::_createWeight(lucene::search::Searcher*) () at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/search/TermQuery.cpp:240 No locals. #13 0x000063e7edafa2dc in lucene::search::BooleanWeight::BooleanWeight(lucene::search::Searcher*, lucene::util::CLVector<lucene::search::BooleanClause*, lucene::util::Deletor::Object<lucene::search::BooleanClause> >*, lucene::search::BooleanQuery*) () at /usr/lib/gcc/x86_64-gentoo-linux-musl/8.2.0/include/g++-v8/bits/stl_vector.h:930 i = 1 i = <optimized out> #14 0x000063e7edafa351 in lucene::search::BooleanQuery::_createWeight(lucene::search::Searcher*) () at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/search/BooleanQuery.cpp:66 No locals. #15 0x000063e7edaef926 in lucene::search::Query::weight (this=this@entry=0x7945d5822da0, searcher=searcher@entry=0x190855007a0) at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/search/SearchHeader.cpp:121 query = <optimized out> weight = <optimized out> sum = <optimized out> norm = <optimized out> #16 0x000063e7edaf0cd7 in lucene::search::IndexSearcher::_search(lucene::search::Query*, lucene::search::Filter*, int) () at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/search/IndexSearcher.cpp:222 weight = <optimized out> scorer = <optimized out> bits = <optimized out> hq = <optimized out> totalHits = <optimized out> hitCol = {<lucene::search::HitCollector> = {<lucene::debug::LuceneVoidBase> = {_vptr.LuceneVoidBase = 0x2}, <No data fields>}, minScore = -1.75304399e+30, bits = 0x30, hq = 0xffffffffffffffff, nDocs = 40, totalHits = 0x63e7eda6f2cc <lucene::util::Compare::WChar::operator()(wchar_t const*, wchar_t const*) const+20>} scoreDocsLength = <optimized out> scoreDocs = <optimized out> totalHitsInt = <optimized out> wq = <optimized out> #17 0x000063e7edaf4344 in lucene::search::Hits::getMoreDocs(unsigned long) () at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/search/Hits.cpp:120 _min = <optimized out> n = <optimized out> topDocs = 0x0 scoreDocs = <optimized out> scoreDocsLength = <optimized out> scoreNorm = <optimized out> ---Type <return> to continue, or q <return> to quit--- #18 0x000063e7edaf443e in lucene::search::Hits::Hits (this=0x1908553a1a0, s=0x190855007a0, q=<optimized out>, f=<optimized out>, _sort=<optimized out>) at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/search/Hits.cpp:60 No locals. #19 0x000063e7edaef7fc in lucene::search::Searcher::search(lucene::search::Query*, lucene::search::Filter*) () at /var/tmp/portage/dev-cpp/clucene-2.3.3.4-r6/work/clucene-core-2.3.3.4/src/core/CLucene/search/SearchHeader.cpp:188 No locals. #20 0x000063e7edd7edf0 in lucene_index_search(lucene_index*, array__lucene_query&, fts_result*, array__seq_range*) () at lucene-wrapper.cc:1361 hits = <optimized out> last_uid = <optimized out> score = <optimized out> ret = 0 query = {<lucene::search::Query> = {<lucene::util::NamedObject> = {_vptr.NamedObject = 0x63e7edd6e970 <vtable for lucene::search::BooleanQuery+16>}, boost = 1}, clauses = 0x190855007e0, static maxClauseCount = 1024, static allowDocsOutOfOrder = false, disableCoord = false, minNrShouldMatch = 0} mailbox_term = {<lucene::debug::LuceneBase> = {_vptr.LuceneBase = 0x63e7edd68e80 <vtable for lucene::index::Term+16>, __cl_refcount = 2}, cachedHashCode = 0, _field = 0x190854bd7c0 L"\142\157\170", _text = 0x1908553a0a0 L"\142\146\064\141\067\066\061\060\146\062\070\143\063\142\065\143\066\145\060\062\060\060\060\060\065\143\146\143\061\141\061\064", textLenBuf = 32, textLen = 32, internF = true} mailbox_query = {<lucene::search::Query> = {<lucene::util::NamedObject> = {_vptr.NamedObject = 0x63e7edd6d918 <vtable for lucene::search::TermQuery+16>}, boost = 1}, term = 0x7945d5822dc0} #21 0x000063e7edd7ff54 in lucene_index_lookup (index=0x190854ee8e0, args=args@entry=0x1908553b468, flags=flags@entry=(unknown: 0), result=result@entry=0x7945d5823000) at lucene-wrapper.cc:1421 uids_arr = <optimized out> arg = 0x0 def_queries = {arr = {buffer = 0x190854b2438, element_size = 16}, v = 0x190854b2438, v_modifiable = 0x190854b2438} have_definites = true maybe_queries = {arr = {buffer = 0xc, element_size = 18446744073709551612}, v = 0xc, v_modifiable = 0xc} have_maybies = <optimized out> #22 0x000063e7edd7c0d4 in fts_backend_lucene_lookup () at fts-backend-lucene.c:489 _data_stack_cur_id = 5 backend = 0x190854ee780 ret = <optimized out> #23 0x000063e7f09a85dd in fts_backend_lookup (backend=0x190854ee780, box=0x190854fc148, args=args@entry=0x1908553b468, flags=flags@entry=(unknown: 0), result=result@entry=0x7945d5823000) at fts-api.c:353 No locals. #24 0x000063e7f09acd92 in fts_search_lookup_level_single (and_args=<optimized out>, args=0x1908553b468, fctx=0x190854f5520) at fts-search.c:50 flags = (unknown: 0) level = <optimized out> result = {box = 0x0, definite_uids = {arr = {buffer = 0x19085528378, element_size = 8}, v = 0x19085528378, v_modifiable = 0x19085528378}, maybe_uids = {arr = {buffer = 0x190855284b8, element_size = 8}, v = 0x190855284b8, v_modifiable = 0x190855284b8}, scores = {arr = {buffer = 0x190855285f8, element_size = 8}, v = 0x190855285f8, v_modifiable = 0x190855285f8}, scores_sorted = false} flags = <optimized out> level = <optimized out> result = <optimized out> #25 fts_search_lookup_level () at fts-search.c:210 _data_stack_cur_id = 4 ret = <optimized out> #26 0x000063e7f09ad32c in fts_search_lookup_level () at fts-search.c:220 ret = 0 #27 0x000063e7f09ad48e in fts_search_lookup () at fts-search.c:360 last_uid = 622 seq1 = 544 seq2 = 807 __func__ = "fts_search_lookup" #28 0x000063e7f09af460 in fts_mailbox_search_init () at fts-storage.c:250 ft = 0x19085511e60 fbox = <optimized out> flist = <optimized out> ctx = 0x190854f5240 fctx = 0x190854f5520 #29 0x000001905d983992 in imap_search_start () at imap-search.c:586 cmd = 0x190854e9628 __func__ = "imap_search_start" #30 0x000001905d9753e5 in cmd_search (cmd=<optimized out>) at cmd-search.c:48 ctx = 0x190854e9830 sargs = 0x1908553b308 args = 0x19085527620 charset = 0x190854f3860 "utf-8" ret = 1 #31 0x000001905d97cad4 in command_exec () at imap-commands.c:201 hook = 0x1905db9cda0 finished = <optimized out> __func__ = "command_exec" #32 0x000001905d97b262 in client_command_input () at imap-client.c:1152 client = 0x190854e89c8 command = <optimized out> __func__ = "client_command_input" #33 0x000001905d97b305 in client_command_input () at imap-client.c:1215 client = 0x190854e89c8 command = <optimized out> __func__ = "client_command_input" ---Type <return> to continue, or q <return> to quit--- #34 0x000001905d97b6cd in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x190854e89c8) at imap-client.c:1257 No locals. #35 client_handle_input () at imap-client.c:1271 _data_stack_cur_id = 3 ret = <optimized out> remove_io = false handled_commands = false ret = <optimized out> remove_io = <optimized out> __func__ = "client_handle_input" client = 0x190854e89c8 handled_commands = <optimized out> _data_stack_cur_id = <optimized out> ret = <optimized out> remove_io = <optimized out> __func__ = "client_handle_input" _data_stack_cur_id = <optimized out> #36 0x000001905d97bb9e in client_input () at imap-client.c:1317 cmd = 0x190854cfba0 output = 0x190854e9440 bytes = 80 __func__ = "client_input" #37 0x000063e7f14f8c58 in io_loop_call_io () at ioloop.c:674 ioloop = 0x63e7f1ae7f20 t_id = 2 __func__ = "io_loop_call_io" #38 0x000063e7f14fa116 in io_loop_handler_run_internal () at ioloop-epoll.c:222 ctx = 0x1905db9cfc0 events = <optimized out> event = 0x190854bc360 list = 0x190854bd1a0 io = <optimized out> tv = {tv_sec = 1799, tv_usec = 999332} events_count = <optimized out> msecs = <optimized out> ret = <optimized out> i = 0 j = <optimized out> call = <optimized out> __func__ = "io_loop_handler_run_internal" #39 0x000063e7f14f8cfa in io_loop_handler_run () at ioloop.c:726 __func__ = "io_loop_handler_run" #40 0x000063e7f14f8e68 in io_loop_run () at ioloop.c:699 __func__ = "io_loop_run" #41 0x000063e7f1480dbb in master_service_run (service=0x63e7f1ae7de0, callback=callback@entry=0x1905d987e60 <client_connected>) at master-service.c:767 No locals. #42 0x000001905d96dfc4 in main () at main.c:521 set_roots = {0x1905db9aa20 <smtp_submit_setting_parser_info>, 0x1905db9a740 <imap_setting_parser_info>, 0x0} login_set = {auth_socket_path = 0x190854b2060 "\003", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x1905d9886b0 <login_client_connected>, failure_callback = 0x1905d987f28 <login_client_failed>, request_auth_token = true} service_flags = <optimized out> storage_service_flags = MAIL_STORAGE_SERVICE_FLAG_NO_NAMESPACES username = 0x0 auth_socket_path = <optimized out> c = <optimized out> error = 0x4cd0 <error: Cannot access memory at address 0x4cd0> #43 0x000063e7f1b0506b in libc_start_main_stage2 (main=0x1905d96dc80 <main>, argc=1, argv=0x7945d5823688) at src/env/__libc_start_main.c:94 envp = 0x7945d5823698 #44 0x000001905d96e168 in _start_c () at imap-client.c:1433 No symbol table info available. #45 0x0000000000000000 in ?? () No symbol table info available. (gdb)

-- Alexander Miroshnichenko