[dovecot] Message causing pop3 crash

[Mark E. Mallett]

Hi-

Found a message that will generate a pop3 coredump when using
mbox format.  It seems to do with the fact that it has a mime
part with a line that's 10,000 bytes long.  However, that doesn't
seem to be the only factor.

Adjusting the size of the mail header seems to cause different kinds
of crashes.  I'll avoid attaching the message here but I've
put it at http://www.mv.com/users/mem/x/badmail

Reproducing it here on a BSD/OS system involves something like:

(login to a virgin account or one you don't care about)

    % wget http://www.mv.com/users/mem/x/badmail
    % rm -rf .imap
    % MAIL=mbox:`pwd`/badmail
    % limit coredump 10m
    % /usr/local/libexec/dovecot/pop3
    quit

at which point you should get some errors and/or a coredump.  You
may need to do it twice (i.e. let it create the .imap/ index
structure first).

If you can't make it happen I can send along more info.

-mm-

(and yes, this was a real mail message, albeit a spam, except that I
simplified it some and replaced all of the content with "x" characters)