imapd THREAD=REFERENCES crash (heap corruption?)

[brong]

From: Larry Greenfield
Bugzilla-Id: 1241
Version: 2.1.x
Owner: Larry Greenfield

[brong]

From: Larry Greenfield

a backtrace is attached below. it's likely either heap corruption or a
corrupted mailboxes cache, but a brief examination of the mailboxes cache makes
it look ok.

probably calls for a purify run.

(gdb) bt
#0 0xfeec1bc8 in _malloc_unlocked () from /usr/lib/libc.so.1
#1 0xfeec1a50 in malloc () from /usr/lib/libc.so.1
#2 0x62704 in xstrdup (str=0x19f12b "content-transfer-encodingandyenc")
at xmalloc.c:56
#3 0x3e5a0 in index_extract_subject (
subj=0x19f12b "content-transfer-encodingandyenc", is_refwd=0x182210)
at index.c:3421
#4 0x3e228 in index_msgdata_load (msgno_list=0x1b0120, n=81,
sortcrit=0xffbee798) at index.c:3272
#5 0x3f7e0 in _index_thread_ref (msgno_list=0x1b0120, nmsg=81,
loadcrit=0xffbee798, searchproc=0, sortcrit=0xffbee778, usinguid=0)
at index.c:4496
#6 0x402fc in index_thread_ref (msgno_list=0x1b0120, nmsg=81, usinguid=0)
at index.c:4579
#7 0x3fe64 in index_thread (mailbox=0x51, algorithm=1, searchargs=0x1b00a0,
usinguid=0) at index.c:1191
#8 0x2f994 in cmd_thread (tag=0x1ae948 "A00007", usinguid=0) at imapd.c:3421
#9 0x2b410 in cmdloop () at imapd.c:1492
#10 0x28e84 in service_main (argc=0, argv=0xffbef7ec, envp=0xffbef7f8)
at imapd.c:655
#11 0x26c8c in main (argc=2, argv=0xffbef7ec, envp=0xffbef7f8) at service.c:444
(gdb)

[brong]

Attachment-Id: 27
From: Larry Greenfield
Type: application/octet-stream
File: internet.ietf-822.tar.gz

gzip'd tarball of the mailbox in question

[brong]

From: Larry Greenfield

added ken to cc list. added tarball as an attachment.

[brong]

From: Ken Murchison

Did you try reconstructing the mailbox? I have seen a corrupted cache file
cause crashes. Of course it woul dbe nice if it handled this better.

[brong]

From: Ken Murchison

Fixed. The problem was bogus msgids without a closing quote, ie:

<"from <20020405153410.A86065196@localhost> <01KG8OEDVO280000JN@mauve.mrochek.com>