Dovecot 2.3.9 - lmtp crashes with Signal 11

[Michael Stilkerich]

Hello,

  since the upgrade from 2.3.8 to 2.3.9 (using the Ubuntu 18.04 packages from dovecot.org), lmtp crashes for me for some mails. Currently I have three pending mails in my postfix deferred queue since the upgrade a couple of days ago. I did not observe these issues with 2.3.8.

The backtrace from one of the coredumps:

Reading symbols from /usr/lib/dovecot/lmtp...Reading symbols from /usr/lib/debug/.build-id/f3/3a5089463b1234cbcf90bf10033d1dd5613821.debug...done.
done.
[New LWP 1554]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `dovecot/lmtp'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  decode_address_header (pool=pool at entry=0x560631ad6d10, hdr=0x560631add4c8 "", address_r=address_r at entry=0x560631ad7090, name_r=name_r at entry=0x560631ad7098)
    at push-notification-event-message-common.c:20
20      push-notification-event-message-common.c: No such file or directory.
(gdb) bt
#0  decode_address_header (pool=pool at entry=0x560631ad6d10, hdr=0x560631add4c8 "", address_r=address_r at entry=0x560631ad7090, name_r=name_r at entry=0x560631ad7098)
    at push-notification-event-message-common.c:20
#1  0x00007f3f37955fbb in decode_address_header (name_r=0x560631ad7098, address_r=0x560631ad7090, hdr=<optimized out>, pool=0x560631ad6d10) at push-notification-event-message-common.c:62
#2  push_notification_message_fill (mail=mail at entry=0x560631adc088, pool=0x560631ad6d10,
    event_flags=(PUSH_NOTIFICATION_MESSAGE_HDR_FROM | PUSH_NOTIFICATION_MESSAGE_HDR_TO | PUSH_NOTIFICATION_MESSAGE_HDR_SUBJECT | PUSH_NOTIFICATION_MESSAGE_HDR_DATE | PUSH_NOTIFICATION_MESSAGE_BODY_SNIPPE$), from=<optimized out>, to=<optimized out>, subject=<optimized out>, date=0x560631ad7050, date_tz=0x560631ad7058, message_id=0x560631ad7078, flags=0x560631ad706c, flags_set=0x560631ad7068,
    keywords=0x560631ad7070, snippet=0x560631ad7060, ext=0x560631ad7080) at push-notification-event-message-common.c:62
#3  0x00007f3f37955a41 in push_notification_event_messagenew_event (ptxn=0x560631ad6d38, ec=0x560631ad6fe0, msg=0x560631ad7010, mail=0x560631adc088) at push-notification-event-messagenew.c:83
#4  0x00007f3f379571bd in push_notification_trigger_msg_save_new (txn=0x560631ad6d38, mail=0x560631adc088, msg=0x560631ad7010) at push-notification-triggers.c:138
#5  0x00007f3f383f52f3 in notify_contexts_mail_save (mail=0x560631adc088) at notify-plugin.c:62
#6  0x00007f3f383f65b8 in notify_copy (ctx=0x560631ad7890, mail=0x560631a98b18) at notify-storage.c:104
#7  0x00007f3f3860873d in quota_copy (ctx=0x560631ad7890, mail=0x560631a98b18) at quota-storage.c:302
#8  0x00007f3f39f91e32 in mailbox_copy_int (_ctx=<optimized out>, mail=0x560631a98b18) at mail-storage.c:2759
#9  0x00007f3f3641907f in ?? () from /usr/lib/dovecot/libdovecot-sieve.so.0
#10 0x00007f3f3640e64c in ?? () from /usr/lib/dovecot/libdovecot-sieve.so.0
#11 0x00007f3f3640f11b in sieve_result_implicit_keep () from /usr/lib/dovecot/libdovecot-sieve.so.0
#12 0x00007f3f364226e1 in sieve_multiscript_finish () from /usr/lib/dovecot/libdovecot-sieve.so.0
#13 0x00007f3f3668e488 in ?? () from /usr/lib/dovecot/modules/lib90_sieve_plugin.so
#14 0x00007f3f3a2a260d in mail_do_deliver (storage_r=0x7ffedf944b40, ctx=0x7ffedf944c30) at mail-deliver.c:542
#15 mail_deliver (ctx=ctx at entry=0x7ffedf944c30, storage_r=storage_r at entry=0x7ffedf944b40) at mail-deliver.c:592
#16 0x000056063169c0e1 in lmtp_local_default_deliver (client=0x560631a5e898, lrcpt=<optimized out>, cmd=<optimized out>, trans=<optimized out>, lldctx=0x7ffedf944e70) at lmtp-local.c:593
#17 0x000056063169c8cf in lmtp_local_deliver (local=0x560631a849b0, local=0x560631a849b0, session=0x560631a9d748, src_mail=0x560631a98b18, llrcpt=0x560631a7f600, trans=0x560631a7fab8, cmd=0x560631a7f088)
    at lmtp-local.c:530
#18 lmtp_local_deliver_to_rcpts (session=0x560631a9d748, trans=0x560631a7fab8, cmd=0x560631a7f088, local=0x560631a849b0) at lmtp-local.c:654
#19 lmtp_local_data (client=client at entry=0x560631a5e898, cmd=cmd at entry=0x560631a7f088, trans=trans at entry=0x560631a7fab8, input=<optimized out>) at lmtp-local.c:730
#20 0x000056063169b0cf in client_default_cmd_data (client=0x560631a5e898, cmd=0x560631a7f088, trans=0x560631a7fab8, data_input=0x560631a83c00, data_size=<optimized out>) at lmtp-commands.c:275
#21 0x000056063169ae6f in cmd_data_finish (trans=0x560631a7fab8, cmd=0x560631a7f088, client=0x560631a5e898) at lmtp-commands.c:165
#22 cmd_data_continue (conn_ctx=0x560631a5e898, cmd=0x560631a7f088, trans=0x560631a7fab8) at lmtp-commands.c:213
#23 0x00007f3f39bfa2c7 in cmd_data_do_handle_input (cmd=0x560631a7f088) at smtp-server-cmd-data.c:285
#24 cmd_data_handle_input (cmd=0x560631a7f088) at smtp-server-cmd-data.c:333
#25 0x00007f3f39ca42af in io_loop_call_io (io=0x560631a7d8e0) at ioloop.c:718
#26 0x00007f3f39ca5c8c in io_loop_handler_run_internal (ioloop=ioloop at entry=0x560631a23fd0) at ioloop-epoll.c:222
#27 0x00007f3f39ca43c0 in io_loop_handler_run (ioloop=<optimized out>) at ioloop.c:770
#28 0x00007f3f39ca45e8 in io_loop_run (ioloop=0x560631a23fd0) at ioloop.c:743
#29 0x00007f3f39c124b3 in master_service_run (service=0x560631a23e60, callback=<optimized out>) at master-service.c:809
#30 0x0000560631699b45 in main (argc=<optimized out>, argv=<optimized out>) at main.c:169

I can provide one of the mails causing the crash if helpful (they are all spam).

Best regards,
  Michael