[bug-mailutils] mh pick program

[d.henman]

I have discovered, what I believe is a bug in the mh pick program.

-- example of running pick
$ pick --folder=emacs --search=lisp
5
6
9
10
11
12
13
18
20
21
23
25
54
zsh: segmentation fault (core dumped)  pick --folder=emacs --search=lisp

-----

Pick does run find when I tried it with a search string that had only one 
message containing it, and then when two messages matches a search string when 
searching through a folder with only fifteen messages.

It dies when I try to find one message, containing the target string, which I 
created, and know exists, in a folder containing 132 messages. (see gdb paste 
#2 below).

$ pick --folder=emacs --search=Buckaroo
zsh: segmentation fault (core dumped)  pick --folder=emacs --search=Buckaroo
echo $?
139

----

So it seems a limit to how many messages I can search through and causes some 
kind of memory problem.  

Though I don't have the limit yet, it recall seeing iterator i around 30 or 32 
before blowing up...

Regards,
  Darel Henman

--- gdb results (paste #1)
Breakpoint 1, main (argc=4198695, argv=0x10013c2e) at pick.c:362
362       if (seq_list)
(gdb) l
357       mbox = mh_open_folder (mh_current_folder (), 0);
358
359       argc -= index;
360       argv += index;
361
362       if (seq_list)
363         obstack_init (&msgno_stk);
364
365       mh_msgset_parse (mbox, &msgset, argc, argv, "all");
366       status = mh_iterate (mbox, &msgset, pick_message, NULL);
(gdb) n
365       mh_msgset_parse (mbox, &msgset, argc, argv, "all");
(gdb) n
366       status = mh_iterate (mbox, &msgset, pick_message, NULL);
(gdb) n

Program received signal SIGSEGV, Segmentation fault.
mu_hdrent_find_stream_pos (hdr=0x100207d0, pos=0, pent=0x22c988, poff=0x22c984)
    at header.c:119
119           *poff = MU_STR_SIZE (p->nlen, p->vlen) - 1;
(gdb) bt
#0  mu_hdrent_find_stream_pos (hdr=0x100207d0, pos=0, pent=0x22c988,
    poff=0x22c984) at header.c:119
#1  0x004370b8 in header_read (is=0x1004b6c0,
    buffer=0x22ca7b "address@hidden)I�\"", buflen=1, off=0,
    pnread=0x22ca20) at header.c:1007
#2  0x0043b3c3 in mu_stream_read (is=0x1004b6c0,
    buf=0x22ca7b "address@hidden"", count=1, offset=0,
    pnread=0x22ca20) at stream.c:180
#3  0x00439293 in message_read (is=0x1004b4f0,
    buf=0x22ca7b "address@hidden"", buflen=1, off=0,
    pnread=0x22ca74) at message.c:811
#4  0x0043af6b in mu_stream_readline (is=0x1004b4f0, buf=0x22caec "",
    count=128, offset=0, pnread=0x22cab8) at stream.c:302
#5  0x0043b040 in mu_stream_sequential_readline (stream=0x1004b4f0,
    buf=0x22caec "", size=128, nbytes=0x22cb6c) at stream.c:871
#6  0x00401c17 in pick_eval_node (node=0x10014670, env=0x1004b4f0)
    at pick.y:325
#7  0x00401c49 in pick_eval (msg=0x100191e8) at pick.y:401
#8  0x00401872 in pick_message (mbox=0x10014720, msg=0x100191e8, num=31,
    data=0x0) at pick.c:302
#9  0x00403f24 in mh_iterate (mbox=0x10014720, msgset=0x22cc5c,
    itr=0x401860 <pick_message>, data=0x0) at mh_init.c:539
#10 0x004011a9 in main (argc=4198825, argv=0x10014720) at pick.c:366

---- end of gdb paste #1


---- start of gdb paste #2    searching through 134 messages for a message that
                              does exist containing search pattern (exactly 
one).

(gdb) b 368
Breakpoint 2 at 0x4011a9: file pick.c, line 368.
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
mu_hdrent_find_stream_pos (hdr=0x10020ab8, pos=0, pent=0x22c988, poff=0x22c984)
    at header.c:119
119           *poff = MU_STR_SIZE (p->nlen, p->vlen) - 1;
(gdb) bt
#0  mu_hdrent_find_stream_pos (hdr=0x10020ab8, pos=0, pent=0x22c988,
    poff=0x22c984) at header.c:119
#1  0x004370b8 in header_read (is=0x1004b3b0,
    buffer=0x22ca7b "\020\030H\001\020$(Aju(B\004\020l)I�\"", buflen=1, 
off=0,
    pnread=0x22ca20) at header.c:1007
#2  0x0043b3c3 in mu_stream_read (is=0x1004b3b0,
    buf=0x22ca7b "\020\030H\001\020$(Aju(B\004\020l�\"", count=1, offset=0,
    pnread=0x22ca20) at stream.c:180
#3  0x00439293 in message_read (is=0x1004b1e0,
    buf=0x22ca7b "\020\030H\001\020$(Aju(B\004\020l�\"", buflen=1, off=0,
    pnread=0x22ca74) at message.c:811
#4  0x0043af6b in mu_stream_readline (is=0x1004b1e0, buf=0x22caec "",
    count=128, offset=0, pnread=0x22cab8) at stream.c:302
#5  0x0043b040 in mu_stream_sequential_readline (stream=0x1004b1e0,
    buf=0x22caec "", size=128, nbytes=0x22cb6c) at stream.c:871
#6  0x00401c17 in pick_eval_node (node=0x10014818, env=0x1004b1e0)
    at pick.y:325
#7  0x00401c49 in pick_eval (msg=0x10020928) at pick.y:401
#8  0x00401872 in pick_message (mbox=0x100148c8, msg=0x10020928, num=31,
    data=0x0) at pick.c:302
#9  0x00403f24 in mh_iterate (mbox=0x100148c8, msgset=0x22cc5c,
    itr=0x401860 <pick_message>, data=0x0) at mh_init.c:539
#10 0x004011a9 in main (argc=4198825, argv=0x100148c8) at pick.c:366
(gdb)

--- end of paste #2