[Dovecot] imap segfault in mail-cache.c

[Todd Burroughs]

Found an imap crash.  I'm using the CVS copy from March 23.  This is
running under Linux, kernel 2.6.11.something.  We use mbox over NFS,
everything is on the NFS server.  There is currently only one dovecot
server accessing the mailbox.


Here's the log messages:
dovecot: Apr 05 13:11:20 Error:  27911 IMAP(support): UIDVALIDITY changed (1112720886 -> 1112721068) in mbox file /mailhome/new/m/support/mbox
dovecot: Apr 05 13:11:20 Error:  27911 IMAP(support): mbox sync: UID inserted in the middle of mailbox /mailhome/new/m/support/mbox (316790 > 316789)
dovecot: Apr 05 13:11:20 Error:  27911 IMAP(support): Corrupted index cache file /mailhome/new/m/support/.imap/INBOX/dovecot.index.cache: indexid changed
dovecot: Apr 05 13:11:20 Error: child 27911 (imap) killed with signal 11


Here's a backtrace.  Note that cache->hdr is NULL.

Core was generated by `imap'.
Program terminated with signal 11, Segmentation fault.

#0  0x080777f9 in mail_cache_lock (cache=0x80c4e20) at mail-cache.c:404
404                     cache->hdr_copy = *cache->hdr;
(gdb) bt
#0  0x080777f9 in mail_cache_lock (cache=0x80c4e20) at mail-cache.c:404
#1  0x0807a1e9 in mail_cache_handler_init (ctx_r=0xbffff3d8, cache=0x80c4e20)
     at mail-cache-sync-update.c:40
#2  0x0807a3a0 in mail_cache_expunge_handler (sync_ctx=0xbffff520, seq=32,
     data=0x80cc964, context=0x80c8ce0) at mail-cache-sync-update.c:85
#3  0x08081ba3 in mail_index_sync_record (ctx=0xbffff520, hdr=0x80c5e34,
     data=0x80cb590) at mail-index-sync-update.c:135
#4  0x080826b9 in mail_index_sync_update_index (sync_ctx=0x80c5d98,
     sync_only_external=0) at mail-index-sync-update.c:648
#5  0x08080913 in mail_index_sync_commit (ctx=0x80c5d98)
     at mail-index-sync.c:595
#6  0x0806e432 in mbox_sync (ibox=0x80c3fe0, flags=MBOX_SYNC_REWRITE)
     at mbox-sync.c:1418
#7  0x08067eb9 in mbox_storage_close (box=0x80c3fe0) at mbox-storage.c:914
#8  0x0808a72d in mailbox_close (box=0xffffff02) at mail-storage.c:299
#9  0x08057efc in _cmd_select_full (cmd=0x80b9050, readonly=0)
     at cmd-select.c:50
#10 0x08057f31 in cmd_select (cmd=0x80b9050) at cmd-select.c:99
#11 0x080593f5 in _client_input (context=0x80b9010) at client.c:334
#12 0x0809b28a in io_loop_handler_run (ioloop=0x80b79e8) at ioloop-poll.c:184
#13 0x0809a9a9 in io_loop_run (ioloop=0x80b79e8) at ioloop.c:218
#14 0x080602a7 in main (argc=1, argv=0xbffffa34, envp=0xbffffa3c) at main.c:229

(gdb) bt full
#0  0x080777f9 in mail_cache_lock (cache=0x80c4e20) at mail-cache.c:404
         view = (struct mail_index_view *) 0x80c4748
         ext = (const struct mail_index_ext *) 0x80c62c8
         i = 0
         ret = -1
#1  0x0807a1e9 in mail_cache_handler_init (ctx_r=0xbffff3d8, cache=0x80c4e20)
     at mail-cache-sync-update.c:40
         ctx = (struct mail_cache_sync_context *) 0x80c6958
         ret = Variable "ret" is not available.

(gdb) p cache->hdr
$1 = (const struct mail_cache_header *) 0x0


Todd Burroughs