dovecot - Sep 2008 - dovecot 1.1.3 coredump

I found imap core in coredump dir:

(gdb) bt
#0  0x00000000004abdea in message_parse_header_next (ctx=0x79c150,
hdr_r=0x7fffffffe478) at message-header-parser.c:114
#1  0x00000000004a8193 in read_header (mstream=0x795330) at
istream-header-filter.c:162
#2  0x00000000004a84e7 in i_stream_header_filter_read (stream=0x795330) at
istream-header-filter.c:288
#3  0x00000000004bc216 in i_stream_read (stream=0x795380) at istream.c:70
#4  0x00000000004bca0d in i_stream_read_data (stream=0x795380,
data_r=0x7fffffffe5c0, size_r=0x7fffffffe5b8, threshold=0)
     at istream.c:283
#5  0x00000000004afbd7 in message_get_body_size (input=0x795380,
body=0x7fffffffe610, has_nuls=0x0) at message-size.c:76
#6  0x0000000000421c5f in fetch_body_header_fields (ctx=0x75c130, mail=0x713048,
body=0x75c640) at imap-fetch-body.c:458
#7  0x00000000004201a1 in imap_fetch_more (ctx=0x75c130) at imap-fetch.c:309
#8  0x0000000000420400 in imap_fetch (ctx=0x75c130) at imap-fetch.c:361
#9  0x0000000000417742 in cmd_fetch (cmd=0x75c048) at cmd-fetch.c:152
#10 0x000000000041c0c2 in cmd_uid (cmd=0x75c048) at cmd-uid.c:26
#11 0x000000000041d7b4 in client_command_input (cmd=0x75c048) at client.c:580
#12 0x000000000041d9f1 in client_command_input (cmd=0x75c048) at client.c:629
#13 0x000000000041db33 in client_handle_next_command (client=0x744180,
remove_io_r=0x7fffffffe81d) at client.c:670
#14 0x000000000041db79 in client_handle_input (client=0x744180) at client.c:680
#15 0x000000000041dd14 in client_input (client=0x744180) at client.c:725
#16 0x00000000004c1669 in io_loop_handler_run (ioloop=0x71e140) at
ioloop-kqueue.c:150
#17 0x00000000004c070b in io_loop_run (ioloop=0x71e140) at ioloop.c:320
#18 0x0000000000428e39 in main (argc=3, argv=0x7fffffffe978,
envp=0x7fffffffe998) at main.c:293
(gdb) f 0
#0  0x00000000004abdea in message_parse_header_next (ctx=0x79c150,
hdr_r=0x7fffffffe478) at message-header-parser.c:114
114                             if (msg[0] == '\n' ||
(gdb) p msg[0]
Cannot access memory at address 0x0

Lines in log file before crash:
Sep 16 11:40:17 mailsupport deliver(spamhog): copy: uid=1, box=Dovecot Delivery
Mail, dest=z_topshop, msgid=<000801c917cf$0623e47b$693cbc80 at nuwqn>,
size=19779
Sep 16 11:40:17 mailsupport deliver(spamhog):
msgid=<000801c917cf$0623e47b$693cbc80 at nuwqn>: saved mail to z_topshop
Sep 16 11:40:17 mailsupport dovecot: IMAP(spamhog): Next message unexpectedly
lost from 216637
Sep 16 11:40:17 mailsupport dovecot: IMAP(spamhog): Next message unexpectedly
lost from 216637
Sep 16 11:40:17 mailsupport dovecot: child 33373 (imap) killed with signal 11

OS: FreeBSD 7.0-STABLE #0: Sun May  4 13:15:10 MSD 2008, amd64

mbox located on zfs silesystem.

related lines in dovecot -n output:

mmap_disable: yes
mbox_write_locks: fcntl
mbox_min_index_size: 1024
mail_plugins(imap): acl mail_log zlib

mail for this account stored in mbox:

user_query = SELECT uid, gid, home, mail FROM tbl_users WHERE login =
'%Lu' AND home IS NOT NULL;

sqlite> SELECT uid, gid, home, mail FROM tbl_users WHERE login =
'spamhog' AND home IS NOT NULL;
8008|8008|/home/spamhog|mbox:~/mail

-- 
WBR,
  Anton Yuzhaninov

On Thu, 2008-09-18 at 19:32 +0400, Anton Yuzhaninov
wrote:
> I found imap core in coredump dir:
> 
> (gdb) bt
> #0  0x00000000004abdea in message_parse_header_next (ctx=0x79c150,
hdr_r=0x7fffffffe478) at message-header-parser.c:114
Do you still have this core? Could you do:

p *ctx.input
p ret
p msg
p size
p parse_size
p startpos

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20080922/4a599027/attachment-0002.bin>

On 22.09.2008 23:34, Timo Sirainen wrote:
> On Thu, 2008-09-18 at 19:32 +0400, Anton Yuzhaninov wrote:
>> I found imap core in coredump dir:
>>
>> (gdb) bt
>> #0  0x00000000004abdea in message_parse_header_next (ctx=0x79c150,
hdr_r=0x7fffffffe478) at message-header-parser.c:114
> 
> Do you still have this core? Could you do:
> 
> p *ctx.input
> p ret
> p msg
> p size
> p parse_size
> p startpos
> 
(gdb) f 0
#0  0x00000000004abdea in message_parse_header_next (ctx=0x79c150,
hdr_r=0x7fffffffe478) at message-header-parser.c:114
114                             if (msg[0] == '\n' ||
(gdb) p *ctx.input
$1 = {v_offset = 0, stream_errno = 0, mmaped = 0, blocking = 1, closed = 0,
seekable = 1, eof = 0, real_stream = 0x795180}
(gdb) p ret
$2 = -2
(gdb) p msg
$3 = (const unsigned char *) 0x0
(gdb) p size
$4 = 0
(gdb) p parse_size
$5 = 0
(gdb) p startpos
$6 = 0

-- 
WBR,
  Anton Yuzhaninov