[Dovecot] Crash in pop3 with recent dovecot, backtrace

[Leo]

Hi,

I have the same crashes in pop3 with the recent dovecot release 2.2.11
on Fedora 16 x86_64. The log file shows:

dovecot: pop3(username at example.com): Fatal: master: service(pop3): child
26735 killed with signal 11 (core dumped)

New mails will be successfully fetched by the client but all the dovecot
files in the users maildir (dovecot.index.log, dovecot.index.cache, ...)
are not being updated anymore.

Here is my backtrace:

-----> start backtrace <-----

Reading symbols from /usr/local/libexec/dovecot/pop3...done.
[New LWP 26735]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `dovecot/pop3'.
Program terminated with signal 11, Segmentation fault.
#0  client_update_mails (client=0x2388560) at pop3-commands.c:256
256                                    
seq_range_array_add(&deleted_msgs, client->msgnum_to_seq_map[msgnum]);
(gdb) bt full
#0  client_update_mails (client=0x2388560) at pop3-commands.c:256
        search_args = <optimized out>
        ctx = <optimized out>
        mail = 0x7fb36483ac5d
        deleted_msgs = {arr = {buffer = 0x236c088, element_size = 8}, v
= 0x236c088, v_modifiable = 0x236c088}
        seen_msgs = {arr = {buffer = 0x237765a, element_size =
140408462221679}, v = 0x237765a,
          v_modifiable = 0x237765a}
        msgnum = <optimized out>
        bit = 1
#1  0x0000000000407800 in cmd_quit (args=<optimized out>,
client=0x2388560) at pop3-commands.c:289
No locals.
#2  client_command_execute (client=0x2388560, name=<optimized out>,
args=0x408200 "") at pop3-commands.c:920
No locals.
#3  0x0000000000405fb8 in client_handle_input (client=0x2388560) at
pop3-client.c:739
        _data_stack_cur_id = 3
        line = 0x237765a "QUIT"
        args = <optimized out>
        ret = <optimized out>
#4  0x00007fb364828e06 in io_loop_call_io (io=0x2388d10) at ioloop.c:388
        ioloop = 0x2374730
        t_id = 2
#5  0x00007fb364829c9f in io_loop_handler_run (ioloop=<optimized out>)
at ioloop-epoll.c:220
        ctx = 0x2374a90
        events = 0x0
        event = 0x23758f0
        list = 0x23764c0
        io = <optimized out>
        tv = {tv_sec = 9, tv_usec = 999836}
        events_count = <optimized out>
        msecs = <optimized out>
        ret = 1
        i = <optimized out>
        call = <optimized out>
        __FUNCTION__ = "io_loop_handler_run"
#6  0x00007fb364828918 in io_loop_run (ioloop=0x2374730) at ioloop.c:412
        __FUNCTION__ = "io_loop_run"
#7  0x00007fb3647d7533 in master_service_run (service=0x23745c0,
callback=<optimized out>) at master-service.c:566
No locals.
#8  0x00000000004041f7 in main (argc=1, argv=0x2374390) at main.c:277
        set_roots = {0x408e60, 0x0}
        login_set = {auth_socket_path = 0x236c048
"/run/dovecot/auth-master", postlogin_socket_path = 0x0,
          postlogin_timeout_secs = 60, callback = 0x4045e0
<login_client_connected>,
          failure_callback = 0x404590 <login_client_failed>,
request_auth_token = 0}
        service_flags = <optimized out>
        storage_service_flags = <optimized out>
        username = <optimized out>
        c = <optimized out>
(gdb)

-----> end backtrace <-----

Kind regards,
Leo