[Dovecot] LDA crashes on delivery (using sieve)

[interfaSys sàrl]

Hello,

The current version of LDA can crash (seg fault 11) under certain
circumstances.

I don't know why it happens only with some accounts, but here is a
backtrace. The user has a sieve filter in place :

(gdb) bt full
#0  0x0000000800443434 in smtp_client_open () from
/usr/lib/dovecot/libdovecot-lda.so.0
No symbol table info available.
#1  0x00000008009943ab in lda_sieve_smtp_open.2406.2210 () from
/usr/lib/dovecot/lib90_sieve_plugin.so
No symbol table info available.
#2  0x0000000800e80532 in sieve_smtp_open () from
/usr/lib/dovecot/libdovecot-sieve.so.0
No symbol table info available.
#3  0x0000000800e6157d in act_redirect_send.23018 () from
/usr/lib/dovecot/libdovecot-sieve.so.0
No symbol table info available.
#4  0x0000000800e7e175 in act_redirect_commit.23025 () from
/usr/lib/dovecot/libdovecot-sieve.so.0
No symbol table info available.
#5  0x0000000800e5f2bd in sieve_result_execute () from
/usr/lib/dovecot/libdovecot-sieve.so.0
No symbol table info available.
#6  0x0000000800e5ee7b in sieve_multiscript_execute.25305 () from
/usr/lib/dovecot/libdovecot-sieve.so.0
No symbol table info available.
#7  0x0000000800e496f8 in sieve_multiscript_run () from
/usr/lib/dovecot/libdovecot-sieve.so.0
No symbol table info available.
#8  0x0000000800994652 in lda_sieve_multiscript_execute.2399.2297 ()
from /usr/lib/dovecot/lib90_sieve_plugin.so
No symbol table info available.
#9  0x00000008009942c7 in lda_sieve_deliver_mail.2402.2206 () from
/usr/lib/dovecot/lib90_sieve_plugin.so
No symbol table info available.
#10 0x00000008004435d8 in mail_deliver () from
/usr/lib/dovecot/libdovecot-lda.so.0
No symbol table info available.
#11 0x00000000004029f7 in main (argc=7, argv=0x7fffffffe830) at main.c:434
        set_roots = {0x404520, 0x0}
        ctx = {pool = 0x800a0d820, set = 0x800a3cc98, session =
0x800a0d840, dup_ctx = 0x800abf0c0, session_id = 0x0, src_mail =
0x800a34840, src_envelope_sender = 0x800a0d858 "mailtest at example.com",
dest_user = 0x800a89040, dest_addr = 0x7fffffffebfd "test at example.com",
  final_dest_addr = 0x7fffffffebfd "test at example.com", dest_mailbox_name
= 0x40356b "INBOX", dest_mail = 0x0, var_expand_table = 0x0,
tried_default_save = false, saved_mail = false, save_dest_mail = false,
mailbox_full = false, dsn = false}
        service_flags = 1027
        user = (const __unknown__ *) 0x7fffffffebcc "test at example.com"
        errstr = (const __unknown__ *) 0x0
        path = (const __unknown__ *) 0x0
        storage_service = (struct mail_storage_service_ctx *) 0x800a30840
        service_user = (struct mail_storage_service_user *) 0x800a3c0a0
        service_input = {module = 0x403567 "lda", service = 0x403567
"lda", username = 0x7fffffffebcc "test at example.com", session_id = 0x0,
local_ip = {family = 0, u = {ip6 = {__u6_addr = {__u6_addr8 = '\0'
<repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32
= {0, 0, 0, 0}}}, ip4 = {
        s_addr = 0}}}, remote_ip = {family = 0, u = {ip6 = {__u6_addr =
{__u6_addr8 = '\0' <repeats 15 times>, __u6_addr16 = {0, 0, 0, 0, 0, 0,
0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, ip4 = {s_addr = 0}}}, local_port =
0, remote_port = 0, userdb_fields = 0x0, flags_override_add = 0,
flags_override_remove = 0,
  no_userdb_lookup = 0}
        storage = (struct mail_storage *) 0x0
        user_source = (const __unknown__ *) 0x4034c0 ""
        destaddr_source = (const __unknown__ *) 0x403576 "-a parameter"
        process_euid = 0
        stderr_rejection = false
        ret = 1
        c = -1
        error = MAIL_ERROR_NONE


Cheers,

Olivier