dovecot - Nov 2007 - imap search/content-transfer-encoding assertion failed

When performing an imap search, I hit the following assertion failure:
imap(vmail): Panic: file unichar.c: line 128 (uni_ucs4_to_utf8_c):
assertion failed: (chr <= 0x40000000)
imap(vmail): Error: Raw backtrace: /usr/lib/dovecot/imap [0x80c7f7f]
-> /usr/lib/dovecot/imap [0x80c7d6a] -> /usr/lib/dovecot/imap
[0x80d8616] -> /usr/lib/dovecot/imap(uni_utf8_to_decomposed_titlecase+0x9f)
[0x80d892f] -> /usr/lib/dovecot/imap(message_decoder_decode_next_block+0x679)
[0x80c46e9] -> /usr/lib/dovecot/imap(message_search_more+0x3e)
[0x80c2e8e] -> /usr/lib/dovecot/imap(message_search_msg+0x72)
[0x80c3012] -> /usr/lib/dovecot/imap [0x8093f47] ->
/usr/lib/dovecot/imap [0x80b7719] ->
/usr/lib/dovecot/imap(mail_search_args_foreach+0x32) [0x80b77c2] ->
/usr/lib/dovecot/imap(index_storage_search_next_nonblock+0x243)
[0x8093af3] -> /usr/lib/dovecot/imap [0x805cdc7] ->
/usr/lib/dovecot/imap [0x805d138] ->
/usr/lib/dovecot/imap(io_loop_handle_timeouts+0x112) [0x80ce892] ->
/usr/lib/dovecot/imap(io_loop_handler_run+0x66) [0x80cf316] ->
/usr/lib/dovecot/imap(io_loop_run+0x28) [0x80ce768] ->
/usr/lib/dovecot/imap(main+0x4ab) [0x806675b] ->
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xc8) [0xb7e68ea8] ->
/usr/lib/dovecot/imap [0x8059141]

My quick analysis: This seemed to be caused by a single message in
this mailbox. I think dovecot is expanding base64 encoded binary data
and then inevitably failing on the utf8 conversion of the decoded
random binary data.

The mime headers for this message are:
MIME-Version: 1.0
Content-Type: multipart/mixed;
 boundary="------------080305000603070709090808"
...
This is a multi-part message in MIME format.
--------------080305000603070709090808
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
<text content>
...
--------------080305000603070709090808
Content-Type: application/x-zip-compressed;
 name="xxxxxxxx.zip"
Content-Transfer-Encoding: base64
Content-Disposition: inline;
 filename="xxxxxxxxxxxx.zip"

<base64 encoded zip file>
...
--------------080305000603070709090808--

# dovecot -n
# 1.1.beta6: /etc/dovecot/dovecot.conf
protocols: imap pop3
listen: 127.0.0.1
disable_plaintext_auth: no
login_dir: /var/run/dovecot/login
login_executable(default): /usr/lib/dovecot/imap-login
login_executable(imap): /usr/lib/dovecot/imap-login
login_executable(pop3): /usr/lib/dovecot/pop3-login
login_greeting_capability(default): yes
login_greeting_capability(imap): yes
login_greeting_capability(pop3): no
first_valid_uid: 89
mail_location: maildir:~/Maildir
mail_debug: yes
mmap_disable: yes
mail_nfs_storage: yes
mail_nfs_index: yes
mail_executable(default): /usr/lib/dovecot/rawlog /usr/lib/dovecot/imap
mail_executable(imap): /usr/lib/dovecot/rawlog /usr/lib/dovecot/imap
mail_executable(pop3): /usr/lib/dovecot/rawlog /usr/lib/dovecot/pop3
mail_plugins(default):  fts fts_lucene
mail_plugins(imap): fts fts_lucene
mail_plugins(pop3): quota
mail_plugin_dir(default): /usr/lib/dovecot/modules/imap
mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap
mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3
mail_log_prefix: %Us(%u[%r]):
mail_log_max_lines_per_sec: 100
pop3_uidl_format(default): %08Xu%08Xv
pop3_uidl_format(imap): %08Xu%08Xv
pop3_uidl_format(pop3): %f
auth default:
  mechanisms: plain cram-md5
  verbose: yes
  debug: yes
  debug_passwords: yes
  passdb:
    driver: sql
    args: /etc/dovecot/dovecot-sql.conf
  userdb:
    driver: sql
    args: /etc/dovecot/dovecot-sql.conf
  socket:
    type: listen
    client:
      path: /var/spool/postfix/private/auth
      mode: 432
      user: postfix
      group: postfix
    master:
      path: /var/run/dovecot/auth-master
      mode: 384
      user: vmail
      group: vmail
plugin:
  fts: lucene

On Mon, 2007-11-05 at 20:42 -0600, Andrew Garner wrote:
> When performing an imap search, I hit the following assertion failure:
> imap(vmail): Panic: file unichar.c: line 128 (uni_ucs4_to_utf8_c):
> assertion failed: (chr <= 0x40000000)
Fixed: http://hg.dovecot.org/dovecot/rev/8b11c9f06bbf
> My quick analysis: This seemed to be caused by a single message in
> this mailbox. I think dovecot is expanding base64 encoded binary data
> and then inevitably failing on the utf8 conversion of the decoded
> random binary data.
Fixed: http://hg.dovecot.org/dovecot/rev/eb4f1fbeecda

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20071111/85aa4651/attachment-0002.bin>