[Dovecot] Dovecot 2.0 HG 11267: Crash on THREAD

[Frode Nordahl]

Hello,

The following IMAP command crashes the latest version of Dovecot (regardless of format or contents of mailbox):
. THREAD REFS US-ASCII ALL

Backtrace:
(gdb) bt full
#0  mail_thread_cache_sync_remove (box=0x64af58, args=<value optimized out>, 
    ctx_r=0x7fffffffe128) at index-thread.c:486
No locals.
#1  mail_thread_init (box=0x64af58, args=<value optimized out>, 
    ctx_r=0x7fffffffe128) at index-thread.c:570
        tbox = 0x64b2e0
        ctx = 0x64fcf0
        search_ctx = 0x651f30
        ret = <value optimized out>
        __FUNCTION__ = "mail_thread_init"
#2  0x000000000040e09b in imap_thread (cmd=0x645e88) at cmd-thread.c:89
        __FUNCTION__ = "imap_thread"
#3  cmd_thread (cmd=0x645e88) at cmd-thread.c:136
        client = 0x6458e8
        thread_type = MAIL_THREAD_REFS
        sargs = 0x650108
        args = 0x6487c0
        charset = 0x648878 "US-ASCII"
        str = 0x648870 "REFS"
        ret = <value optimized out>
#4  0x000000000040ef7c in client_command_input (cmd=0x645e88)
    at imap-client.c:646
        client = 0x6458e8
---Type <return> to continue, or q <return> to quit---
        command = <value optimized out>
        __FUNCTION__ = "client_command_input"
#5  0x000000000040f032 in client_command_input (cmd=0x645e88)
    at imap-client.c:696
        client = 0x6458e8
        command = 0x2aaaaab44e50
        __FUNCTION__ = "client_command_input"
#6  0x000000000040f17f in client_handle_next_command (client=0x6458e8)
    at imap-client.c:737
No locals.
#7  client_handle_input (client=0x6458e8) at imap-client.c:749
        _data_stack_cur_id = 3
        remove_io = <value optimized out>
        handled_commands = false
        __FUNCTION__ = "client_handle_input"
#8  0x000000000040fb22 in client_input (client=0x6458e8) at imap-client.c:788
        cmd = <value optimized out>
        output = 0x645d28
        bytes = 27
        __FUNCTION__ = "client_input"
#9  0x00002aaaaadb2838 in io_loop_handler_run (ioloop=<value optimized out>)
    at ioloop-epoll.c:212
        ctx = <value optimized out>
---Type <return> to continue, or q <return> to quit---
        event = 0x626800
        list = 0x63f7c0
        io = 0x645dc0
        tv = {tv_sec = 1799, tv_usec = 999514}
        events_count = <value optimized out>
        t_id = 2
        msecs = <value optimized out>
        ret = 1
        i = 0
        call = <value optimized out>
#10 0x00002aaaaadb15ad in io_loop_run (ioloop=0x626580) at ioloop.c:350
No locals.
#11 0x00002aaaaada1963 in master_service_run (service=0x626450, callback=0)
    at master-service.c:480
No locals.
#12 0x000000000041739f in main (argc=1, argv=0x626370) at main.c:359
        service_flags = <value optimized out>
        storage_service_flags = 4294959856
        postlogin_socket_path = 0x0
        username = 0x0
        c = <value optimized out>
        set_roots = {0x41a640, 0x0}

--
Frode Nordahl