lmtp Panic Buffer write out of range

[Gabriele Nencioni]

Hi all,
as described here:
https://www.dovecot.org/pipermail/dovecot/2018-July/112173.html

we are experiencing the same error on dovecot version 2.3.2.1
while it never occurs on an old version as 2.2.15


It followings the error logs:

On an upgraded dovecot backend:
Aug 21 12:03:51 backend20 dovecot:
lmtp(test1 at internalinboundcm.eu)<SONkAYfje1veGgAAu8+/vw>: Panic: Buffer
write out of range (789 + 18446744073709551606)
/var/log/dovecot_lmtp_20180821.12.log-Aug 21 12:03:51 monti-backend20
dovecot: lmtp(test1 at internalinboundcm.eu)<SONkAYfje1veGgAAu8+/vw>:
Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xcb851)
[0x7f78e6f0a851] -> /usr/lib/dovecot/libdovecot.so.0(+0xcb8e9)
[0x7f78e6f0a8e9] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0)
[0x7f78e6e78851] -> /usr/lib/dovecot/libdovecot.so.0(buffer_write+0x131)
[0x7f78e6f04871] ->
/usr/lib/dovecot/libdovecot-sieve.so.0(rfc2822_header_append+0xcf)
[0x7f78e531613f] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x7d35b)
[0x7f78e531335b] ->
/usr/lib/dovecot/libdovecot-sieve.so.0(edit_mail_header_add+0x1b)
[0x7f78e531525b] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x73014)
[0x7f78e5309014] ->
/usr/lib/dovecot/libdovecot-sieve.so.0(sieve_interpreter_continue+0x81)
[0x7f78e52d2a11] ->
/usr/lib/dovecot/libdovecot-sieve.so.0(sieve_interpreter_run+0x2b)
[0x7f78e52d2c7b] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x51000)
[0x7f78e52e7000] ->
/usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_run+0x3a)
[0x7f78e52e7eba] ->
/usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x38f0) [0x7f78e554e8f0]
-> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0xf0)
[0x7f78e750da30] -> dovecot/lmtp [81.88.49.172
DATA](lmtp_local_data+0x4f1) [0x5582554451d1] -> dovecot/lmtp
[81.88.49.172 DATA](cmd_data_continue+0x243) [0x558255443ee3] ->
/usr/lib/dovecot/libdovecot.so.0(+0x4c402) [0x7f78e6e8b402] ->
/usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f78e6f228a9]
-> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x109)
[0x7f78e6f24199] ->
/usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x52)
[0x7f78e6f229b2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38)
[0x7f78e6f22bc8] ->
/usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13)
[0x7f78e6e9cff3] -> dovecot/lmtp [81.88.49.172 DATA](main+0x240)
[0x558255442f70] ->
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1) [0x7f78e6ac02e1]
-> dovecot/lmtp [81.88.49.172 DATA](_start+0x2a) [0x5582554430ba]

while once the user test1 at internalinboundcm.eu has been moved on an old
dovecot backend, with the "doveadm director move" command the message
has been properly delivered at next retry attempt:
Aug 21 12:32:31 backend01 dovecot:
lmtp(test1 at internalinboundcm.eu)<Zv32Lzbqe1tSLQAAF5Yx/g>: copy from
<lmtp DATA>: box=Spam, uid=1,
msgid=<ceb54c05728586392119651424858d85 at l2.losclientes3.com>
Aug 21 12:32:31 backend01 dovecot:
lmtp(test1 at internalinboundcm.eu)<Zv32Lzbqe1tSLQAAF5Yx/g>:
Zv32Lzbqe1tSLQAAF5Yx/g: sieve:
msgid=<ceb54c05728586392119651424858d85 at l2.losclientes3.com>: stored
mail into mailbox 'Spam'


As you can see the message was detected as spam

Let me know if you need more info or details (such us the original
message or the sieve filter that trigger the problem)

Thanks in advance
Regards
-- 
Gabriele Nencioni
System Administrator
eml gabriele.nencioni at register.it