Subject: dovecot-sieve: sieve processing panics in merge_modified_headers: assertion failed: (stream->pos >= init_pos)

From: Graham Cobb <[email-masked]>
Date: Thu, 26 Apr 2018 10:20:19 +0100

Package: dovecot-sieve
Version: 1:2.2.35-2
Severity: normal

sieve processing crashes reproducibly with certain emails. This causes
these emails to be bounced with delivery failures.

mail.log contains the following information (backtrace manually reformatted for readability):

Apr 26 10:04:26 black dovecot: lda(default-user): Panic: file edit-mail.c: line 1908 (merge_modified_headers): assertion failed: (stream->pos >= init_pos)
Apr 26 10:04:26 black dovecot: lda(default-user): Error: Raw backtrace:
/usr/lib/dovecot/libdovecot.so.0(+0xa0a02) [0x7f55d2d30a02]
-> /usr/lib/dovecot/libdovecot.so.0(+0xa0ac7) [0x7f55d2d30ac7]
-> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f55d2cc0718]
-> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x7f816) [0x7f55d2067816]
-> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x7fdc2) [0x7f55d2067dc2]
-> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x53) [0x7f55d2d3c303]
-> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7f55d2d3cdbd]
-> /usr/lib/dovecot/libdovecot.so.0(message_parse_header_next+0x71) [0x7f55d2d18ba1]
-> /usr/lib/dovecot/libdovecot.so.0(+0x825a9) [0x7f55d2d125a9]
-> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x53) [0x7f55d2d3c303]
-> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x3d) [0x7f55d2d3cdbd]
-> /usr/lib/dovecot/libdovecot.so.0(io_stream_copy+0x85) [0x7f55d2d52d25]
-> /usr/lib/dovecot/libdovecot.so.0(+0xc5014) [0x7f55d2d55014]
-> /usr/lib/dovecot/libdovecot.so.0(o_stream_send_istream+0x30) [0x7f55d2d52b70]
-> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x51bfc) [0x7f55d2039bfc]
-> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x42498) [0x7f55d202a498]
-> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_result_execute+0x202) [0x7f55d202b972]
-> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x544ee) [0x7f55d203c4ee]
-> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_run+0xa2) [0x7f55d203d262]
-> /usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x3877) [0x7f55d22ab877]
-> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0xb6) [0x7f55d331eb26]
-> /usr/lib/dovecot/dovecot-lda(main+0x67b) [0x5626fbc94bdb]
-> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7f55d28f1a87]
-> /usr/lib/dovecot/dovecot-lda(_start+0x2a) [0x5626fbc9523a]

If this is not an already known upstream bug, I can spend the time to create a small sieve file and a small message to reproduce.

-- Package-specific info:

dovecot configuration
---------------------
# 2.2.35 (b1cb664): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.23 ()
# OS: Linux 4.15.0-2-amd64 x86_64 Debian buster/sid 
# Hostname: black.home.cobb.me.uk
log_timestamp = "%Y-%m-%d %H:%M:%S "
login_trusted_networks = 192.168.0.0/16 127.0.0.1
mail_location = maildir:~/dovecot:INDEX=/var/indexes/%u
mail_max_userip_connections = 50
mail_privileged_group = mail
maildir_stat_dirs = yes
namespace {
  hidden = yes
  inbox = no
  list = children
  location = mbox:~/mail
  prefix = "#mbox/"
  separator = /
  type = private
}
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix = 
  separator = /
}
passdb {
  driver = pam
}
passdb {
  args = scheme=SSHA512 username_format=%n /etc/dovecot/users
  driver = passwd-file
}
plugin {
  sieve = file:~/sieve;active=~/.dovecot.sieve
  sieve_extensions = +editheader +vnd.dovecot.debug
}
protocols = " imap"
service imap {
  process_limit = 100
}
service pop3 {
  process_limit = 100
}
ssl_cert = </etc/dovecot/private/dovecot-cert.pem
ssl_client_ca_dir = /etc/ssl/certs
ssl_key =  # hidden, use -P to show it
userdb {
  driver = passwd
}
userdb {
  args = username_format=%n /etc/dovecot/users
  driver = passwd-file
}
protocol lmtp {
  mail_plugins = " sieve"
}
protocol lda {
  mail_plugins = " sieve"
}

-- System Information:
Debian Release: buster/sid
  APT prefers testing
  APT policy: (900, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.15.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_IE.utf8, LC_CTYPE=en_IE.utf8 (charmap=UTF-8) (ignored: LC_ALL set to en_IE.utf8), LANGUAGE=en_IE.utf8 (charmap=UTF-8) (ignored: LC_ALL set to en_IE.utf8)
Shell: /bin/sh linked to /bin/bash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages dovecot-sieve depends on:
ii  dovecot-core  1:2.2.35-2
ii  libc6         2.27-3
ii  ucf           3.0038

dovecot-sieve recommends no packages.

dovecot-sieve suggests no packages.

Versions of packages dovecot-sieve is related to:
ii  dovecot-core [dovecot-common]  1:2.2.35-2
pn  dovecot-dev                    <none>
pn  dovecot-gssapi                 <none>
ii  dovecot-imapd                  1:2.2.35-2
pn  dovecot-ldap                   <none>
pn  dovecot-lmtpd                  <none>
pn  dovecot-managesieved           <none>
pn  dovecot-mysql                  <none>
pn  dovecot-pgsql                  <none>
pn  dovecot-pop3d                  <none>
ii  dovecot-sieve                  1:2.2.35-2
pn  dovecot-sqlite                 <none>

-- no debconf information

---

From: Stephan Bosch <[email-masked]>
Date: Mon, 30 Apr 2018 11:30:34 +0200

Looks eerily like something we just fixed in Pigeonhole.

---

From: Stephan Bosch <[email-masked]>
Date: Mon, 30 Apr 2018 11:58:07 +0200

> Looks eerily like something we just fixed in Pigeonhole.

https://github.com/dovecot/pigeonhole/commit/890c6e26d4f452304b2dfc10f6b71827198a7cbb
and subsequent small fixes

Regards,

Stephan.

>> Apr 26 10:04:26 black dovecot: lda(default-user): Panic: file 
>> edit-mail.c: line 1908 (merge_modified_headers): assertion failed: 
>> (stream->pos >= init_pos)
>> If this is not an already known upstream bug, I can spend the time to 
>> create a small sieve file and a small message to reproduce.
>>
>>
>> Locale: LANG=en_IE.utf8, LC_CTYPE=en_IE.utf8 (charmap=UTF-8) 
>> (ignored: LC_ALL set to en_IE.utf8), LANGUAGE=en_IE.utf8 
>> (charmap=UTF-8) (ignored: LC_ALL set to en_IE.utf8)