[Dovecot] Dovecot 1.1rc3 crashes with Dbox + imap_quota plugin

[eric at flerd.com]

Version: Dovecot v1.1.rc3
OS: CentOS 5 running in OpenVZ
CPU: x86_64


Was running fine with maildir and decided to get dbox a try. Test user
created with a dbox mailstore backend and when a client logs in that tries
to run a getquotaroot imap command the process SIGSEGV's. 

Have been able to narrow it down to dbox crashing against dict quota as
well as dirsize.  Maildir works just fine. 

example telnet session:

...
5 getquota *

5 NO Quota root doesn't exist.

6 getquotaroot inbox

Connection closed by foreign host.

------

Got the backtrace from a coredump as well:

Program terminated with signal 11, Segmentation fault.

#0  0x0000000000463d99 in mail_index_get_header_ext (view=0x0, ext_id=2,
data_r=0x7fff8ad72140, 

    data_size_r=0x7fff8ad72138) at mail-index-view.c:550

550             view->v.get_header_ext(view, NULL, ext_id, data_r,
data_size_r);


----

(gdb) bt full

#0  0x0000000000463d99 in mail_index_get_header_ext (view=0x0, ext_id=2,
data_r=0x7fff8ad72140, 

    data_size_r=0x7fff8ad72138) at mail-index-view.c:550

No locals.

#1  0x000000000044604c in dbox_sync_want_flush_dirty (mbox=0x2aaaaaae5cc8,
close_flush_dirty_flags=true)

    at dbox-sync.c:262

        hdr = <value optimized out>

        data = <value optimized out>

        data_size = <value optimized out>

#2  0x0000000000446101 in dbox_sync_begin (mbox=0x0, ctx_r=0x7fff8ad72278,
close_flush_dirty_flags=64, force=64)

    at dbox-sync.c:297

        storage = (struct mail_storage *) 0x2aaaaaadb878

        ctx = <value optimized out>

        sync_flags = <value optimized out>

        ret = <value optimized out>

        rebuild = <value optimized out>

#3  0x00000000004468c8 in dbox_sync (mbox=0x0, close_flush_dirty_flags=64)
at dbox-sync.c:396

        sync_ctx = (struct dbox_sync_context *) 0x2aaaaaae5cc8

#4  0x000000000043f0c4 in dbox_storage_mailbox_close (box=0x0) at
dbox-storage.c:312

        mbox = <value optimized out>

        ret = <value optimized out>

#5  0x00002aaaab62df50 in fts_mailbox_close (box=0x2aaaaaae5cc8) at
fts-storage.c:65

        fbox = (struct fts_mailbox *) 0x2aaaaaae8f90

        ret = <value optimized out>

#6  0x00002aaaab42a5ed in cmd_getquotaroot (cmd=0x2aaaaaadc338) at
imap-quota-plugin.c:98

        storage = <value optimized out>

        box = (struct mailbox *) 0x0

        iter = (struct quota_root_iter *) 0x0

        root = <value optimized out>

        orig_mailbox = 0x2aaaaaae0518 "INBOX"

        mailbox = 0x49a6ca "INBOX"

        str = (string_t *) 0x2aaaaaacf1c0

#7  0x000000000041ab18 in client_command_input (cmd=0x0) at client.c:546

        client = (struct client *) 0x2aaaaaadbf50

        command = <value optimized out>

        __PRETTY_FUNCTION__ = "client_command_input"

#8  0x000000000041abb9 in client_command_input (cmd=0x2aaaaaadc338) at
client.c:595

        client = (struct client *) 0x2aaaaaadbf50

        command = (struct command *) 0x7fff8ad72140

        __PRETTY_FUNCTION__ = "client_command_input"

#9  0x000000000041b32f in client_handle_input (client=0x2aaaaaadbf50) at
client.c:636

        _data_stack_cur_id = 3

        ret = <value optimized out>

       remove_io = <value optimized out>

        handled_commands = false

#10 0x000000000041b54f in client_input (client=0x2aaaaaadbf50) at
client.c:691

        cmd = <value optimized out>

        output = (struct ostream *) 0x2aaaaaadc1e8

        bytes = 27

        __PRETTY_FUNCTION__ = "client_input"

#11 0x0000000000486a38 in io_loop_handler_run (ioloop=<value optimized
out>) at ioloop-epoll.c:201

        ctx = <value optimized out>

        event = (const struct epoll_event *) 0x2aaaaaad7dc0

        list = (struct io_list *) 0x2aaaaaad8780

        io = (struct io_file *) 0x2aaaaaadc280

        tv = {tv_sec = 1799, tv_usec = 999598}

        events_count = <value optimized out>

        t_id = 2

        msecs = <value optimized out>

        ret = 1

        i = 0

        call = <value optimized out>

#12 0x0000000000485d1d in io_loop_run (ioloop=0x2aaaaaad7b60) at
ioloop.c:301

No locals.

#13 0x0000000000422871 in main (argc=<value optimized out>, argv=0x0,
envp=0x7fff8ad72578) at main.c:293

No locals.



----------

Let me know if there's any other info you need.