dovecot - Aug 2018 - lmtp Panic Buffer write out of range

Hi all,
as described here:
https://www.dovecot.org/pipermail/dovecot/2018-July/112173.html

we are experiencing the same error on dovecot version 2.3.2.1
while it never occurs on an old version as 2.2.15


It followings the error logs:

On an upgraded dovecot backend:
Aug 21 12:03:51 backend20 dovecot:
lmtp(test1 at internalinboundcm.eu)<SONkAYfje1veGgAAu8+/vw>: Panic: Buffer
write out of range (789 + 18446744073709551606)
/var/log/dovecot_lmtp_20180821.12.log-Aug 21 12:03:51 monti-backend20
dovecot: lmtp(test1 at internalinboundcm.eu)<SONkAYfje1veGgAAu8+/vw>:
Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xcb851)
[0x7f78e6f0a851] -> /usr/lib/dovecot/libdovecot.so.0(+0xcb8e9)
[0x7f78e6f0a8e9] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0)
[0x7f78e6e78851] -> /usr/lib/dovecot/libdovecot.so.0(buffer_write+0x131)
[0x7f78e6f04871] ->
/usr/lib/dovecot/libdovecot-sieve.so.0(rfc2822_header_append+0xcf)
[0x7f78e531613f] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x7d35b)
[0x7f78e531335b] ->
/usr/lib/dovecot/libdovecot-sieve.so.0(edit_mail_header_add+0x1b)
[0x7f78e531525b] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x73014)
[0x7f78e5309014] ->
/usr/lib/dovecot/libdovecot-sieve.so.0(sieve_interpreter_continue+0x81)
[0x7f78e52d2a11] ->
/usr/lib/dovecot/libdovecot-sieve.so.0(sieve_interpreter_run+0x2b)
[0x7f78e52d2c7b] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x51000)
[0x7f78e52e7000] ->
/usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_run+0x3a)
[0x7f78e52e7eba] ->
/usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x38f0) [0x7f78e554e8f0]
-> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0xf0)
[0x7f78e750da30] -> dovecot/lmtp [81.88.49.172
DATA](lmtp_local_data+0x4f1) [0x5582554451d1] -> dovecot/lmtp
[81.88.49.172 DATA](cmd_data_continue+0x243) [0x558255443ee3] ->
/usr/lib/dovecot/libdovecot.so.0(+0x4c402) [0x7f78e6e8b402] ->
/usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f78e6f228a9]
-> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x109)
[0x7f78e6f24199] ->
/usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x52)
[0x7f78e6f229b2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38)
[0x7f78e6f22bc8] ->
/usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13)
[0x7f78e6e9cff3] -> dovecot/lmtp [81.88.49.172 DATA](main+0x240)
[0x558255442f70] ->
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1) [0x7f78e6ac02e1]
-> dovecot/lmtp [81.88.49.172 DATA](_start+0x2a) [0x5582554430ba]

while once the user test1 at internalinboundcm.eu has been moved on an old
dovecot backend, with the "doveadm director move" command the message
has been properly delivered at next retry attempt:
Aug 21 12:32:31 backend01 dovecot:
lmtp(test1 at internalinboundcm.eu)<Zv32Lzbqe1tSLQAAF5Yx/g>: copy from
<lmtp DATA>: box=Spam, uid=1,
msgid=<ceb54c05728586392119651424858d85 at l2.losclientes3.com>
Aug 21 12:32:31 backend01 dovecot:
lmtp(test1 at internalinboundcm.eu)<Zv32Lzbqe1tSLQAAF5Yx/g>:
Zv32Lzbqe1tSLQAAF5Yx/g: sieve:
msgid=<ceb54c05728586392119651424858d85 at l2.losclientes3.com>: stored
mail into mailbox 'Spam'


As you can see the message was detected as spam

Let me know if you need more info or details (such us the original
message or the sieve filter that trigger the problem)

Thanks in advance
Regards
-- 
Gabriele Nencioni
System Administrator
eml gabriele.nencioni at register.it

Op 21-8-2018 om 14:57 schreef Gabriele Nencioni:
> Hi all,
> as described here:
> https://www.dovecot.org/pipermail/dovecot/2018-July/112173.html
>
> we are experiencing the same error on dovecot version 2.3.2.1
> while it never occurs on an old version as 2.2.15
This looks a lot like: 
https://dovecot.org/list/dovecot/2018-July/112167.html

That one is fixed pending release.

Regards,

Stephan.
>
>
> It followings the error logs:
>
> On an upgraded dovecot backend:
> Aug 21 12:03:51 backend20 dovecot:
> lmtp(test1 at internalinboundcm.eu)<SONkAYfje1veGgAAu8+/vw>: Panic:
Buffer
> write out of range (789 + 18446744073709551606)
> /var/log/dovecot_lmtp_20180821.12.log-Aug 21 12:03:51 monti-backend20
> dovecot: lmtp(test1 at internalinboundcm.eu)<SONkAYfje1veGgAAu8+/vw>:
> Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xcb851)
> [0x7f78e6f0a851] -> /usr/lib/dovecot/libdovecot.so.0(+0xcb8e9)
> [0x7f78e6f0a8e9] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0)
> [0x7f78e6e78851] -> /usr/lib/dovecot/libdovecot.so.0(buffer_write+0x131)
> [0x7f78e6f04871] ->
> /usr/lib/dovecot/libdovecot-sieve.so.0(rfc2822_header_append+0xcf)
> [0x7f78e531613f] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x7d35b)
> [0x7f78e531335b] ->
> /usr/lib/dovecot/libdovecot-sieve.so.0(edit_mail_header_add+0x1b)
> [0x7f78e531525b] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x73014)
> [0x7f78e5309014] ->
> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_interpreter_continue+0x81)
> [0x7f78e52d2a11] ->
> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_interpreter_run+0x2b)
> [0x7f78e52d2c7b] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x51000)
> [0x7f78e52e7000] ->
> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_run+0x3a)
> [0x7f78e52e7eba] ->
> /usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x38f0) [0x7f78e554e8f0]
> -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0xf0)
> [0x7f78e750da30] -> dovecot/lmtp [81.88.49.172
> DATA](lmtp_local_data+0x4f1) [0x5582554451d1] -> dovecot/lmtp
> [81.88.49.172 DATA](cmd_data_continue+0x243) [0x558255443ee3] ->
> /usr/lib/dovecot/libdovecot.so.0(+0x4c402) [0x7f78e6e8b402] ->
> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f78e6f228a9]
> -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x109)
> [0x7f78e6f24199] ->
> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x52)
> [0x7f78e6f229b2] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38)
> [0x7f78e6f22bc8] ->
> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13)
> [0x7f78e6e9cff3] -> dovecot/lmtp [81.88.49.172 DATA](main+0x240)
> [0x558255442f70] ->
> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1) [0x7f78e6ac02e1]
> -> dovecot/lmtp [81.88.49.172 DATA](_start+0x2a) [0x5582554430ba]
>
> while once the user test1 at internalinboundcm.eu has been moved on an old
> dovecot backend, with the "doveadm director move" command the
message
> has been properly delivered at next retry attempt:
> Aug 21 12:32:31 backend01 dovecot:
> lmtp(test1 at internalinboundcm.eu)<Zv32Lzbqe1tSLQAAF5Yx/g>: copy
from
> <lmtp DATA>: box=Spam, uid=1,
> msgid=<ceb54c05728586392119651424858d85 at l2.losclientes3.com>
> Aug 21 12:32:31 backend01 dovecot:
> lmtp(test1 at internalinboundcm.eu)<Zv32Lzbqe1tSLQAAF5Yx/g>:
> Zv32Lzbqe1tSLQAAF5Yx/g: sieve:
> msgid=<ceb54c05728586392119651424858d85 at l2.losclientes3.com>:
stored
> mail into mailbox 'Spam'
>
>
> As you can see the message was detected as spam
>
> Let me know if you need more info or details (such us the original
> message or the sieve filter that trigger the problem)
>
> Thanks in advance
> Regards

On 08/22/2018 04:03 PM, Stephan Bosch wrote:
> Op 21-8-2018 om 14:57 schreef Gabriele Nencioni:
>> Hi all,
>> as described here:
>> https://www.dovecot.org/pipermail/dovecot/2018-July/112173.html
>>
>> we are experiencing the same error on dovecot version 2.3.2.1
>> while it never occurs on an old version as 2.2.15
> 
> This looks a lot like:
> https://dovecot.org/list/dovecot/2018-July/112167.html
> 
> That one is fixed pending release.
Great! Thank you very much!
Do you know the release date approximately?

Regards,
-- 
Gabriele Nencioni
System Administrator
eml gabriele.nencioni at register.it