Recently, I started seeing the following error in my mail logs on RHEL4 servers:
Sep 30 18:36:26 mx01 pop3(woody): file lib.c: line 37 (nearest_power): assertion failed: (num <= ((size_t)1 << (BITS_IN_SIZE_T-1))) Sep 30 18:36:26 mx01 dovecot: child 11238 (pop3) killed with signal 6
This has been happening since dovecot-0.99.11-10.EL4, released on 18 August 2011. The changelog for this release shows:
- fix potential crash when parsing header names that contain NUL characters (#728674)
It could be that this update introduced a bug, or it could simply be a coincidence and completely unrelated.
The problem is a malformed multi-part (rfc1341) message. These messages usually look something like this. In the headers, you'll see:
Content-type: multipart/mixed; boundary="M7qxj4rHbpfU"
The body, oversimplified, will look something like this:
Some text. --M7qxj4rHbpfU Content-type: foo foo foo foo foo foo foo foo foo foo --M7qxj4rHbpfU Content-type: text/plain; charset=us-ascii bar bar bar bar bar bar bar bar bar --M7qxj4rHbpfU--
This last line, the closing encapsulation boundary, indicates that there are no further parts:
--M7qxj4rHbpfU--
In cases where this crash happens, this line is missing. I suspect what's happening is that dovecot continue reading the next mail's headers as if it's part of the last part, until it reaches the new (unexpected) Content-type header.
To fix this, you can insert the missing boundary - copy one of the previous ones and add -- at the end. Or delete the offending mail - mutt -f will open the mailbox.