dovecot - Mar 2016 - crash after out of memory?

We're encountering a crash when proxying to an Exchange server:

Mar 30 10:40:47 mproxy dovecot: imap-login: Login: user=<xxxbxxx>,
method=PLAIN, rip=10.39.76.71, lip=141.42.206.11, mpid=18556, TLS,
session=<H98xGkAvfvMKJ0xH>
Mar 30 10:40:49 mproxy dovecot: imap(xxxbxxx): Fatal: block_alloc(134217728):
Out of memory
Mar 30 10:40:49 mproxy dovecot: imap(xxxbxxx): Error: Raw backtrace:
/usr/lib/dovecot/libdovecot.so.0(+0x85afe) [0x7fb0b829eafe] ->
/usr/lib/dovecot/libdovecot.so.0(+0x85bec) [0x7fb0b829ebec] ->
/usr/lib/dovecot/libdovecot.so.0(i_error+0) [0x7fb0b824373a] ->
/usr/lib/dovecot/libdovecot.so.0(+0x9f284) [0x7fb0b82b8284] ->
/usr/lib/dovecot/libdovecot.so.0(+0x9f2c3) [0x7fb0b82b82c3] ->
/usr/lib/dovecot/libdovecot.so.0(+0x9f357) [0x7fb0b82b8357] ->
/usr/lib/dovecot/libdovecot.so.0(+0x81a6d) [0x7fb0b829aa6d] ->
/usr/lib/dovecot/libdovecot.so.0(buffer_write+0x6c) [0x7fb0b829acdc] -> 
/usr/lib/dovecot/libdovecot.so.0(+0x6ea54) [0x7fb0b8287a54] ->
/usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x53) [0x7fb0b82a8ee3] ->
/usr/lib/dovecot/libdovecot.so.0(i_stream_read_copy_from_parent+0x118)
[0x7fb0b82a96a8] ->
/usr/lib/dovecot/libdovecot-storage.so.0(+0xc00ba) [0x7fb0b85e10ba] ->
/usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x53) [0x7fb0b82a8ee3] -> 
/usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7fb0b82a991d] ->
/usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x72)
[0x7fb0b828d2a2] ->
/usr/lib/dovecot/libdovecot.so.0(+0x6e919) [0x7fb0b8287919] ->
/usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x53) [0x7fb0b82a8ee3] -> 
/usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7fb0b82a991d] ->
/usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x72)
[0x7fb0b828d2a2] ->
/usr/lib/dovecot/libdovecot.so.0(+0x6e919) [0x7fb0b8287919] ->
/usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x53) [0x7fb0b82a8ee3] -> 
/usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7fb0b82a991d] ->
/usr/lib/dovecot/libdovecot.so.0(message_get_header_size+0x74) [0x7fb0b8290e34]
->
/usr/lib/dovecot/libdovecot-storage.so.0(imap_msgpart_open+0x317)
[0x7fb0b8609f37] ->
dovecot/imap [xxxbxxx 10.39.76.71 UID fetch](+0x1f1de) [0x7fb0b8a9a1de] -> 
dovecot/imap [xxxbxxx 10.39.76.71 UID fetch](+0x1d60c) [0x7fb0b8a9860c] -> 
dovecot/imap [xxxbxxx 10.39.76.71 UID fetch](imap_fetch_more+0x3a)
[0x7fb0b8a9970a] ->
dovecot/imap [xxxbxxx 10.39.76.71 UID fetch](cmd_fetch+0x354) [0x7fb0b8a8b954] 
Mar 30 10:40:49 mproxy dovecot: imap(xxxbxxx): Fatal: master: service(imap):
child 18556 returned error 83 (Out of memory (service
imap { vsz_limit=256 MB }, you may need to increase it) - set CORE_OUTOFMEM=1
environment to get core dump)

It happens for this user ONLY. Using the automatic bosch build:
2.2.21-1~auto+152
-- 
Ralf Hildebrandt
  Gesch?ftsbereich IT | Abteilung Netzwerk
  Charit? - Universit?tsmedizin Berlin
  Campus Benjamin Franklin
  Hindenburgdamm 30 | D-12203 Berlin
  Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962
  ralf.hildebrandt at charite.de | http://www.charite.de

On 30 Mar 2016, at 11:51, Ralf Hildebrandt <Ralf.Hildebrandt at
charite.de> wrote:
> 
> We're encountering a crash when proxying to an Exchange server:
> 
> Mar 30 10:40:47 mproxy dovecot: imap-login: Login: user=<xxxbxxx>,
method=PLAIN, rip=10.39.76.71, lip=141.42.206.11, mpid=18556, TLS,
session=<H98xGkAvfvMKJ0xH>
> Mar 30 10:40:49 mproxy dovecot: imap(xxxbxxx): Fatal:
block_alloc(134217728): Out of memory
> Mar 30 10:40:49 mproxy dovecot: imap(xxxbxxx): Error: Raw backtrace:
> /usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x72)
[0x7fb0b828d2a2] ->
> /usr/lib/dovecot/libdovecot.so.0(+0x6e919) [0x7fb0b8287919] ->
> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x53) [0x7fb0b82a8ee3] ->
> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7fb0b82a991d]
->
> /usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x72)
[0x7fb0b828d2a2] ->
The user has an email that contains a huge >100MB header line?

I think there's something in here that could use fixing. It shouldn't be
that easy to make Dovecot use up that much memory. Some istream buffer size
limit is missing somewhere I think.. The attached patch might help?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: imapc-memory-limit.diff
Type: application/octet-stream
Size: 1228 bytes
Desc: not available
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20160330/e6cbb21b/attachment-0001.obj>
-------------- next part --------------

* Timo Sirainen <tss at iki.fi>:
>    The user has an email that contains a huge >100MB header line?
I hope not :)
I "solved" the problem by setting the vsz_limit_default to 1G
>    I think there's something in here that could use fixing. It
shouldn't be
>    that easy to make Dovecot use up that much memory. Some istream buffer
>    size limit is missing somewhere I think.. The attached patch might help?
Is it in the official tree? I'm using the autobuilds nowadays. Could
tell you tomorrow!

-- 
Ralf Hildebrandt
  Gesch?ftsbereich IT | Abteilung Netzwerk
  Charit? - Universit?tsmedizin Berlin
  Campus Benjamin Franklin
  Hindenburgdamm 30 | D-12203 Berlin
  Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962
  ralf.hildebrandt at charite.de | http://www.charite.de