[Dovecot] Dovecot crashes with malformed Qpopper's mbox

[前田 剛]

I am testing migration from Qpopper 4.0.5 and have come across a problem.

Dovecot dies while processing UIDL command when accessing malformed
Qpopper's mbox which has duplicated "From " separator. Qpopper
occasionally makes such header while rewriting mbox.

In the attached file, unnecessary "From " at line 3.

----------------

* Dovecot 1.0.0 on Debian 4.0(x86)

* ext3 filesystem(not NFS)

* description
    Dovecot dies while processing UIDL command with malformed
    Qpopper's mbox which has duplicated "From " separator.

    This occurs when "pop3_reuse_xuidl" is "yes".


    conversation with Dovecot
    ~~~~~~~~~~~~~~~~~~~~~~~~~
    $ telnet localhost 110
    Trying 127.0.0.1...
    Connected to localhost.
    Escape character is '^]'.
    +OK Dovecot ready.
    user xxxxxxxx
    +OK
    pass xxxxxxxx
    +OK Logged in.
    uidl
    Connection closed by foreign host.


* Dovecot configuration
    # /usr/local/etc/dovecot.conf
    protocols: imap pop3
    ssl_disable: yes
    disable_plaintext_auth: no
    login_dir: /usr/local/var/run/dovecot/login
    login_executable(default): /usr/local/libexec/dovecot/imap-login
    login_executable(imap): /usr/local/libexec/dovecot/imap-login
    login_executable(pop3): /usr/local/libexec/dovecot/pop3-login
    mail_extra_groups: mail
    mail_location: mbox:~/:INBOX=/var/mail/%u
    mail_full_filesystem_access: yes
    mbox_write_locks: fcntl
    mail_executable(default): /usr/local/libexec/dovecot/imap
    mail_executable(imap): /usr/local/libexec/dovecot/imap
    mail_executable(pop3): /usr/local/libexec/dovecot/pop3
    mail_plugin_dir(default): /usr/local/lib/dovecot/imap
    mail_plugin_dir(imap): /usr/local/lib/dovecot/imap
    mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3
    pop3_reuse_xuidl(default): no
    pop3_reuse_xuidl(imap): no
    pop3_reuse_xuidl(pop3): yes
    pop3_uidl_format(default):
    pop3_uidl_format(imap):
    pop3_uidl_format(pop3): %08Xu%08Xv
    auth default:
      passdb:
        driver: pam
      userdb:
        driver: passwd
      socket:
        type: listen
        client:
          path: /var/spool/postfix/private/auth
          mode: 432
          user: postfix
          group: postfix
        master:


* how to reproduce

    1. set "pop3_reuse_xuidl = yes".
    2. replace test user's mailbox with attached file.
    3. pop3 login and exec "UIDL". POP3 process will die.

-- 
// --------------------------------------------------------------
// MAEDA, Go <maeda-g at secom-sanin.co.jp>


-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: syslog.txt
Url: http://dovecot.org/pipermail/dovecot/attachments/20070524/4fc993cf/attachment.txt 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: malformed-mbox.txt
Url: http://dovecot.org/pipermail/dovecot/attachments/20070524/4fc993cf/attachment-0001.txt