Dovecot 2.2.16 crashes when fetching mails with Trojita 0.5

[Dennis Schridde]

Hello!

When I fetch certain emails from my Dovecot 2.2.16 server using Trojita 0.5, 
dovecot/imap will crash reproducibly. Please find config and backtrace from 
coredump attached.

Best regards,
Dennis
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dovecot-imap-core-1179.gdb.log
Type: text/x-log
Size: 4905 bytes
Desc: not available
URL: <http://dovecot.org/pipermail/dovecot/attachments/20150422/2021aae0/attachment.bin>
-------------- next part --------------
# 2.2.16: /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.7
# OS: Linux 3.19.5-hardened x86_64 Gentoo Base System release 2.2 ext4
auth_mechanisms = plain login
auth_username_format = %Ln
dict {
  acl_shared = file:/var/lib/dovecot/shared-acl
  expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
  mail_attribute = file:/var/lib/dovecot/mail-attribute
  quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext
}
imap_metadata = yes
import_environment = LD_LIBRARY_PATH=/usr/lib/dovecot
mail_attribute_dict = proxy::mail_attribute
mail_location = mdbox:/var/mail/user/%u
mail_plugins = expire virtual zlib
mailbox_list_index = yes
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate spamtest
mdbox_preallocate_space = yes
namespace ns_default {
  location =
  mailbox drafts {
    auto = subscribe
    special_use = \Drafts
  }
  mailbox sent {
    auto = subscribe
    special_use = \Sent
  }
  mailbox spam {
    auto = subscribe
    special_use = \Junk
  }
  mailbox spam/ham {
    auto = subscribe
  }
  mailbox spam/unsure {
    auto = subscribe
  }
  mailbox trash {
    auto = subscribe
    special_use = \Trash
  }
  prefix =
  separator = /
  type = private
}
namespace ns_virtual {
  inbox = yes
  list = children
  location = virtual:/var/mail/virtual:INDEX=/var/mail/user-virtual/%u:CONTROL=/var/mail/user-virtual/%u
  prefix = [virtual]/
  separator = /
  type = private
}
passdb {
  args = *
  driver = pam
}
plugin {
  acl = vfile:/etc/dovecot/global-acls:cache_secs=300
  acl_shared_dict = proxy::acl_shared
  antispam_backend = dspam
  antispam_dspam_args = --client;--user;%Lu;--source=error;--signature=%%s
  antispam_dspam_binary = /usr/bin/dspamc
  antispam_dspam_notspam = --class=innocent
  antispam_dspam_result_header = X-DSPAM-Result
  antispam_dspam_spam = --class=spam
  antispam_signature = X-DSPAM-Signature
  antispam_signature_missing = error
  antispam_spam = spam
  antispam_trash = trash
  antispam_unsure = spam/unsure
  expire = spam
  expire2 = spam/ham
  expire_dict = proxy::expire
  sieve = file:/var/mail/user-sieve/%u;active=/var/mail/user-sieve/%u.sieve
  sieve_after = /var/mail/sieve/after.d
  sieve_before = /var/mail/sieve/before.d
  sieve_extensions = +spamtest
  sieve_global = /var/mail/sieve/global
  sieve_spamtest_max_value = 1.0
  sieve_spamtest_status_header = x-dspam-probability: ([[:digit:]]+.[[:digit:]]+)
  sieve_spamtest_status_type = score
  zlib_save = lz4
}
protocols = imap lmtp sieve
service auth {
  unix_listener /var/spool/postfix/private/dovecot-auth {
    group = postfix
    mode = 0660
    user = postfix
  }
  unix_listener auth-userdb {
    group = mailusers
    mode = 0660
  }
}
service dict {
  unix_listener dict {
    group = mailusers
    mode = 0660
  }
}
service lmtp {
  unix_listener /var/spool/dspam/dovecot-lmtp {
    group = dspam
    mode = 0660
    user = dspam
  }
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0660
    user = postfix
  }
}
ssl = required
ssl_cert = </etc/ssl/private/imap-combined.pem
ssl_key = </etc/ssl/private/imap-key.pem
userdb {
  driver = passwd
}
protocol lmtp {
  mail_plugins = expire virtual zlib sieve
}
protocol lda {
  mail_plugins = expire virtual zlib sieve
}
protocol imap {
  mail_plugins = expire virtual zlib antispam imap_zlib
}