[Dovecot] Segfault in imap

[Todd Burroughs]

Found a new segfault in imap.  The first log entry always happens on my
mailbox, but doesn't seem to affect anything.  This is CVS version from
Aug. 15.


dovecot: Aug 21 17:16:56 Error:  28017 IMAP(todd): Corrupted index cache file /mailhome/new/t/b/todd/.imap/INBOX/dovecot.index.cache: Duplicated field in header: hdr.RESENT-TO
dovecot: Aug 21 17:19:44 Error: child 28017 (imap) killed with signal 11


(gdb) bt full
#0  0x08076b50 in index_mail_get_flags (_mail=0x80cbd20) at index-mail.c:152
         data = (struct index_mail_data *) 0x80cbd84
#1  0x0808eb4d in mail_get_flags (mail=0xb7de7088) at mail.c:32
No locals.
#2  0x0805a9d5 in fetch_flags (ctx=0x80c1ed0, mail=0x80cbd20, context=0x0)
     at imap-fetch.c:445
         flags = Variable "flags" is not available.

(gdb) bt
#0  0x08076b50 in index_mail_get_flags (_mail=0x80cbd20) at index-mail.c:152
#1  0x0808eb4d in mail_get_flags (mail=0xb7de7088) at mail.c:32
#2  0x0805a9d5 in fetch_flags (ctx=0x80c1ed0, mail=0x80cbd20, context=0x0)
     at imap-fetch.c:445
#3  0x0805af0c in imap_fetch (ctx=0x80c1ed0) at imap-fetch.c:265
#4  0x0805693b in cmd_fetch (cmd=0x80bfba8) at cmd-fetch.c:166
#5  0x0805999b in _client_input (context=0x80bfb68) at client.c:334
#6  0x080a045a in io_loop_handler_run (ioloop=0x80be9b0) at ioloop-poll.c:184
#7  0x0809f9d9 in io_loop_run (ioloop=0x80be9b0) at ioloop.c:230
#8  0x08060877 in main (argc=1, argv=0xbffffa44, envp=0xbffffa4c) at main.c:229


(gdb) p *data
$1 = {flags = 0, date = 0, received_date = 1124608407, virtual_size = 2870,
   physical_size = 2856, sent_date = {time = -1, timezone = 0}, parse_line = {
     field_idx = 0, start_pos = 0, end_pos = 0, line_num = 0, cache = 0},
   parse_line_num = 0, parts = 0x0, envelope = 0x0, body = 0x0,
   bodystructure = 0x0, uid_string = 0x0, envelope_data = 0x0, seq = 11473,
   rec = 0xb7de7088, cache_flags = 0, access_part = 3, stream = 0x80cc224,
   filter_stream = 0x0, hdr_size = {physical_size = 2545, virtual_size = 2545,
     lines = 57}, body_size = {physical_size = 311, virtual_size = 325,
     lines = 14}, parser_ctx = 0x0, parsing_count = 0, keywords = {
     buffer = 0x0, element_size = 0}, all_cache_fields = 0x0,
   all_cache_fields_count = 0, save_sent_date = 0, save_envelope = 0,
   save_bodystructure_header = 0, save_bodystructure_body = 0,
   parsed_bodystructure = 0, hdr_size_set = 1, body_size_set = 1,
   messageparts_saved_to_cache = 0}

(gdb) p *data->rec
Cannot access memory at address 0xb7de7088