sdbox: Failing after saved mails' UIDs were already assigned caused unlink()ing garbage Mainly with dsync when it fails, the transaction is still committed and mails are given UIDs. If the transaction commit still fails, it attempts to rollback the saved mails by unlink()ing them, but at that point the path pointed to an already freed memory. This caused unlink() errors with some garbage strings as the path (and hopefully no actually valid paths). The easiest way to reproduce this was to fill up the filesystem with dsync.

--- a/src/lib-storage/index/dbox-single/sdbox-file.c	Mon Feb 01 22:40:15 2016 +0200
+++ b/src/lib-storage/index/dbox-single/sdbox-file.c	Mon Feb 01 22:48:22 2016 +0200
@@ -24,6 +24,7 @@
 	i_free(file->file.alt_path);
 	file->file.primary_path =
 		i_strdup_printf("%s/%s", mailbox_get_path(box), fname);
+	file->file.cur_path = file->file.primary_path;
 
 	if (mailbox_get_path_to(box, MAILBOX_LIST_PATH_TYPE_ALT_MAILBOX,
 				&alt_path) > 0)