Recently, I started seeing the following error in my mail logs on RHEL4 servers:

Sep 30 18:36:26 mx01 pop3(woody): file lib.c: line 37 (nearest_power): assertion
 failed: (num <= ((size_t)1 << (BITS_IN_SIZE_T-1)))
Sep 30 18:36:26 mx01 dovecot: child 11238 (pop3) killed with signal 6

This has been happening since dovecot-0.99.11-10.EL4, released on 18 August 2011. The changelog for this release shows:

- fix potential crash when parsing header names that contain NUL characters
 (#728674)

It could be that this update introduced a bug, or it could simply be a coincidence and completely unrelated.

The problem is a malformed multi-part (rfc1341) message. These messages usually look something like this. In the headers, you'll see:

Content-type: multipart/mixed; boundary="M7qxj4rHbpfU"

The body, oversimplified, will look something like this:

Some text.

--M7qxj4rHbpfU
Content-type: foo

foo foo foo
foo foo foo
foo foo foo

--M7qxj4rHbpfU
Content-type: text/plain; charset=us-ascii 

bar bar bar
bar bar bar
bar bar bar

--M7qxj4rHbpfU--

This last line, the closing encapsulation boundary, indicates that there are no further parts:

--M7qxj4rHbpfU--

In cases where this crash happens, this line is missing. I suspect what's happening is that dovecot continue reading the next mail's headers as if it's part of the last part, until it reaches the new (unexpected) Content-type header.

To fix this, you can insert the missing boundary - copy one of the previous ones and add -- at the end. Or delete the offending mail - mutt -f will open the mailbox.