dovecot - Feb 2008 - 1.1b16: (buffer_set_used_size): assertion failed: (used_size <= buf->alloc)

I haven't seen this before 1.1b16, it happened to two users today while 
they were searching
using fts.

Feb 18 16:41:36 hill dovecot: IMAP(username): file buffer.c: line 288 
(buffer_set_used_size): assertion failed: (used_size <= buf->alloc)
Feb 18 16:41:36 hill dovecot: child 53560 (imap) killed with signal 6

I can probably narrow it down to an example mail if needed.

GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain 
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for
details.
This GDB was configured as "amd64-marcel-freebsd"...
Core was generated by `imap'.
Program terminated with signal 6, Aborted.
Reading symbols from /usr/local/lib/libiconv.so.3...done.
Loaded symbols for /usr/local/lib/libiconv.so.3
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /usr/local/lib/dovecot/imap/lib01_acl_plugin.so...done.
Loaded symbols for /usr/local/lib/dovecot/imap/lib01_acl_plugin.so
Reading symbols from /usr/local/lib/dovecot/imap/lib20_fts_plugin.so...done.
Loaded symbols for /usr/local/lib/dovecot/imap/lib20_fts_plugin.so
Reading symbols from 
/usr/local/lib/dovecot/imap/lib21_fts_squat_plugin.so...done.
Loaded symbols for /usr/local/lib/dovecot/imap/lib21_fts_squat_plugin.so
Reading symbols from /libexec/ld-elf.so.1...done.
Loaded symbols for /libexec/ld-elf.so.1
#0 0x00000000109d64ac in kill () from /lib/libc.so.6
(gdb) bt full
#0 0x00000000109d64ac in kill () from /lib/libc.so.6
No symbol table info available.
#1 0x00000000109d533d in abort () from /lib/libc.so.6
No symbol table info available.
#2 0x00000000004a9e89 in i_internal_fatal_handler (type=LOG_TYPE_PANIC, 
status=0,
fmt=0x4d7760 "file %s: line %d (%s): assertion failed: (%s)", 
args=0x7fffffffbd90) at failures.c:415
backtrace = 0x7fffffffbd80 "?????\177"
#3 0x00000000004a948b in i_panic (format=0x4d7760 "file %s: line %d 
(%s): assertion failed: (%s)")
at failures.c:187
args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 
0x7fffffffbe80,
reg_save_area = 0x7fffffffbdc0}}
#4 0x00000000004a826a in buffer_set_used_size (_buf=0x64e740, 
used_size=18446744073709543512) at buffer.c:288
buf = (struct real_buffer *) 0x64e740
__PRETTY_FUNCTION__ = "buffer_set_used_size"
#5 0x00000000004a6fd9 in charset_to_utf8_try (t=0x60e2b0,
src=0xd5b000 "\n??????\n\n\n???? 
????????????????????\n?????????????????????????\n?????????????????????????\n????????????????????\n\n
\n?? 
??????????????????????\n?????????????????????????\n?????????????????????????\n?????"...,
src_size=0x7fffffffdf30, dest=0x64e740, result=0x7fffffffdf4c) at 
charset-iconv.c:107
ic_srcbuf = 0xd5b03d 
"?\n?????????????????????????\n????????????????????\n\n \n?? 
??????????????????????\n?????????????????????????\n?????????????????????????\n????????????????????\n\n
\n?? ??????????????????????\n???????????????"...
tmpbuf = "\n?\234\213?\217\213??\201\n\n\n?\200\200?\200\200 
??\223?\202??\203??\212\212????\211??\207???\220?\210???\226\n?\225\214?\220\204?\234??\232\204?\227??\200\231??\214?\202??\230??\220??\203??\210?his
incoming email as possible spam. The original message\nhas been attached 
to this so you can view it (if it i"...
ic_destbuf = 0x7fffffffbf38 "his incoming email as possible spam. The 
original message\nhas been attached to this so you can view it (if it 
isn't spam) or label\nsimilar future email. If you have any questions, 
see\nThe administra"...
srcleft = 420
destleft = 8104
dtcase = true
ret = true
#6 0x00000000004a70f8 in charset_to_utf8 (t=0x60e2b0,
src=0xd5b000 "\n??????\n\n\n???? 
????????????????????\n?????????????????????????\n?????????????????????????\n????????????????????\n\n
\n?? 
??????????????????????\n?????????????????????????\n?????????????????????????\n?????"...,
src_size=0x7fffffffdfa0, dest=0x64e740) at charset-iconv.c:136
result = CHARSET_RET_INVALID_INPUT
pos = 0
used = 1284
size = 481
ret = false
#7 0x00000000004a535c in message_decode_body (ctx=0x89e900, 
input=0x7fffffffe040, output=0x7fffffffe020)
at message-decoder.c:349
new_buf = "9??"
data = (
const unsigned char *) 0xd5b000 "\n??????\n\n\n???? 
????????????????????\n?????????????????????????\n?????????????????????????\n????????????????????\n\n
\n?? 
??????????????????????\n?????????????????????????\n?????????????????????????\n?????"...
pos = 481
size = 481
skip = 0
ret = 1
__PRETTY_FUNCTION__ = "message_decode_body"
#8 0x00000000004a549d in message_decoder_decode_next_block 
(ctx=0x89e900, input=0x7fffffffe040,
output=0x7fffffffe020) at message-decoder.c:381
No locals.
#9 0x0000000010c2692b in fts_build_mail (ctx=0x661400, uid=144) at 
fts-storage.c:138
input = (struct istream *) 0x687650
parser = (struct message_parser_ctx *) 0xcd3848
decoder = (struct message_decoder_context *) 0x89e900
raw_block = {part = 0x6012a0, hdr = 0x0,
data = 0xd5d339 "\n=C5=F3=D3=D1=A3=A1\n\n\n=A1=A1=A1=A1 
=B5=B1=C4=FA=CF=EB=B0=D1=BB=F5=CE=EF=B3=F6=D4=CB=B5=BD=CA=C0=\n=BD=E7=B8=F7=B5=D8=B5=C4=CA=B1=BA=F2=A3=AC=C4=FA=CA=C7=B7=F1=CF=EB=B5=BD=A3=\n=BA=D4=F5=D1=F9=D7=F6=B2="...,
size = 1284}
block = {part = 0x6012a0, hdr = 0x0,
data = 0xd5e000 "SPAM DETECTION SOFTWARE, RUNNING ON THE SYSTEM 
\"BOOMHAUER.EGR.MSU.EDU\", HAS\nIDENTIFIED THIS INCOMING EMAIL AS 
POSSIBLE SPAM. THE ORIGINAL MESSAGE\nHAS BEEN ATTACHED TO THIS SO YOU 
CAN VIEW IT (IF IT I"..., size = 0}
prev_part = (struct message_part *) 0x0
ret = 1
__PRETTY_FUNCTION__ = "fts_build_mail"
#10 0x0000000010c2707e in fts_build_more (ctx=0x661400) at fts-storage.c:293
_data_stack_cur_id = 4
count = 3
ret = 0
#11 0x0000000010c273d5 in fts_mailbox_search_next_nonblock 
(ctx=0x661200, mail=0x68d048,
tryagain_r=0x7fffffffe15f) at fts-storage.c:376
fbox = (struct fts_mailbox *) 0x61dc00
fctx = (struct fts_search_context *) 0x662100
ret = 0
#12 0x000000000046b9e3 in mailbox_search_next_nonblock (ctx=0x661200, 
mail=0x68d048,
tryagain_r=0x7fffffffe15f) at mail-storage.c:647
No locals.
#13 0x0000000000418fff in cmd_search_more (cmd=0x61e048) at cmd-search.c:83
ctx = (struct imap_search_context *) 0x61e190
end_time = {tv_sec = 6345472, tv_usec = 3}
tryagain = true
ret = 6344704
#14 0x000000000041923e in cmd_search_more_callback (cmd=0x61e048) at 
cmd-search.c:132
client = (struct client *) 0x60d200
finished = false
#15 0x00000000004b2d0f in io_loop_handle_timeouts_real (ioloop=0x600240) 
at ioloop.c:279
timeout = (struct timeout *) 0x600dc0
item = (struct priorityq_item *) 0x600dc0
tv = {tv_sec = 0, tv_usec = 0}
tv_call = {tv_sec = 1203370896, tv_usec = 43884}
t_id = 3
#16 0x00000000004b2d5d in io_loop_handle_timeouts (ioloop=0x600240) at 
ioloop.c:290
_data_stack_cur_id = 2
#17 0x00000000004b3c3e in io_loop_handler_run (ioloop=0x600240) at 
ioloop-kqueue.c:138
ctx = (struct ioloop_handler_context *) 0x60b0e0
events = (struct kevent *) 0x60f000
event = (const struct kevent *) 0x60f000
tv = {tv_sec = 0, tv_usec = 0}
ts = {tv_sec = 0, tv_nsec = 0}
io = (struct io_file *) 0x600940
events_count = 3
t_id = 2
ret = 0
i = 0
__PRETTY_FUNCTION__ = "io_loop_handler_run"
#18 0x00000000004b2db0 in io_loop_run (ioloop=0x600240) at ioloop.c:301
No locals.
#19 0x0000000000426b4e in main (argc=3, argv=0x7fffffffe330, 
envp=0x7fffffffe350) at main.c:293
No locals.

On Tue, 2008-02-19 at 01:04 -0500, Adam McDougall wrote:
> I haven't seen this before 1.1b16, it happened to two users today while
> they were searching
> using fts.
Hmm. You sure this is with beta16? Because:
> #5 0x00000000004a6fd9 in charset_to_utf8_try (t=0x60e2b0,
> charset-iconv.c:107
In pre-beta16 line 107 contains:

buffer_set_used_size(dest, dest->used - destleft);

In beta16 it's:

if (!dtcase)

The change was: http://hg.dovecot.org/dovecot-1.1/rev/fcfe2ea5c3ed

And it should have fixed this exact assert-crash.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20080219/3c64f552/attachment-0002.bin>

Timo Sirainen wrote:
> On Tue, 2008-02-19 at 01:04 -0500, Adam McDougall wrote:
>   
>> I haven't seen this before 1.1b16, it happened to two users today
while
>> they were searching
>> using fts.
>>     
>
> Hmm. You sure this is with beta16? Because:
>
>   
>> #5 0x00000000004a6fd9 in charset_to_utf8_try (t=0x60e2b0,
>> charset-iconv.c:107
>>     
>
> In pre-beta16 line 107 contains:
>
> buffer_set_used_size(dest, dest->used - destleft);
>
> In beta16 it's:
>
> if (!dtcase)
>
> The change was: http://hg.dovecot.org/dovecot-1.1/rev/fcfe2ea5c3ed
>
> And it should have fixed this exact assert-crash.
>
>   
Oooooops! Sorry, it was b15.  I had b16 on my mind because I had just
installed it on two other servers.  I'll try it.  Thanks.