dovecot - Oct 2012 - backtrace for non-existant %{ldap:attr} on login

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

I'm fetching the user and auth data from LDAP, this is the string:

pass_attrs = 
uid=user,userPassword=password,homeDirectory=userdb_home,mailUidNumber=userdb_uid,mailGidNumber=userdb_gid,mailLocationDovecot=userdb_mail,uid=userdb_user,=userdb_quota_rule=*:bytes=%{ldap:mailQuotaBytes},
=userdb_quota_rule2=Trash:bytes=+%{ldap:mailQuotaBytesTrash}

If mailQuotaBytesTrash or mailQuotaBytes is not present, the LOGIN process 
does not work:

1 login user pwd
1 NO [UNAVAILABLE] Temporary authentication failure. [mailsrv2:2012-10-31 
08:56:51]
* OK Waiting for authentication process to respond..

If I add those two attributes, the user can login successfully.

dovecot-2.1.10/sbin/dovecot --version
2.1.10 (9cdeab12f3e1)

The log entries:

2012-10-31 09:56:51 auth: Panic: pool_data_stack_realloc(): stack frame 
changed

2012-10-31 09:56:51 auth: Error: Raw backtrace: 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(+0x4857a) 
[0x7f2c0528c57a] -> 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(+0x485c6) 
[0x7f2c0528c5c6] -> 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(i_error+0) 
[0x7f2c0525feaf] -> 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(+0x58f2e) 
[0x7f2c0529cf2e] -> 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(+0x442f5) 
[0x7f2c052882f5] -> 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(buffer_get_space_unsafe+0x68)
[0x7f2c05288728] -> 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(str_vprintfa+0x6d) 
[0x7f2c052a796d] -> 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(str_printfa+0x88) 
[0x7f2c052a7ac8] -> dovecot2.1/auth [0 wait, 1 passdb, 0 userdb]() 
[0x42682e] -> 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(var_expand_with_funcs+0x6fb)
[0x7f2c052ac48b] -> dovecot2.1/auth [0 wait, 1 passdb, 0 
userdb](db_ldap_result_iterate_next+0x12f) [0x42734f] -> dovecot2.1/auth 
[0 wait, 1 passdb, 0 userdb]() [0x428974] -> dovecot2.1/auth [0 wait, 1 
passdb, 0 userdb]() [0x428f5f] -> dovecot2.1/auth [0 wait, 1 passdb, 0 
userdb]() [0x4282a1] -> 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x36) 
[0x7f2c05298756] -> 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x9f) 
[0x7f2c0529978f] -> 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(io_loop_run+0x28) 
[0x7f2c052986f8] -> 
/usr/local/dovecot-2.1.10/lib/dovecot/libdovecot.so.0(master_service_run+0x13) 
[0x7f2c052840d3] -> dovecot2.1/auth [0 wait, 1 passdb, 0 
userdb](main+0x376) [0x41bba6] -> /lib/libc.so.6(__libc_start_main+0xfd) 
[0x7f2c04449c8d] -> dovecot2.1/auth [0 wait, 1 passdb, 0 userdb]() 
[0x40cf89]

2012-10-31 09:56:51 auth: Fatal: master: service(auth): child 15865 killed 
with signal 6 (core dumps disabled)
2012-10-31 09:56:51 imap-login: Warning: Auth connection closed with 1 
pending requests (max 0 secs, pid=15869, EOF)


- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEVAwUBUJDqe2oxLS8a3A9mAQI+YQf/Qd4IIeM35Hmmpl1IMcQwJFK4854G5Dku
yK+GsWhE2gxI6KaLO6DSI/kpN79qhQRkHsUAHzoPiZ7kQpZprNaEP/CIPkTzw//i
HyC2Odpfa8fWUOqtH5Cp6X5spF6hQa4mmQyzgXguF9bdjZkNu4vQ78wRuQGG4eHi
BOkNL0b93DsN3NSIoXDpiAiJn1aleTLe7mYkfsGewjb+AN+FpR4hLbf32yRRn8J0
Fkn8agEijixGMXEBD4ZprTbX9NbUr92YPfRycMnA2A00MUUlv/iKlqXRpMLafRjL
bnHL/QE80xHoKKJUR96/RjruciIolAtlyYvhTU9ibRpLYm5Hcd9bZg==iPvg
-----END PGP SIGNATURE-----

On 31.10.2012, at 11.08, Steffen Kaiser wrote:
> If mailQuotaBytesTrash or mailQuotaBytes is not present, the LOGIN process
does not work:
..
> 2012-10-31 09:56:51 auth: Panic: pool_data_stack_realloc(): stack frame
changed
I'm not entirely sure why that happens when nonexistent attributes, but this
fixes the crash:
http://hg.dovecot.org/dovecot-2.1/rev/3a33e686fc38

Maybe there's another bug in there as well that tries to write some large
garbage to the string instead?..