From bf181393fe09430218a4aae1806c97fc0d5961ec Mon Sep 17 00:00:00 2001
From: Michal Hlavinka <mhlavink@redhat.com>
Date: Sat, 25 Jul 2026 12:19:42 +0200
Subject: [PATCH] fix mailbox leak causing assert crash (RHEL-176273)

Resolves: RHEL-176273
---
 dovecot-2.3.16-fixrefcount.patch | 12 ++++++++++++
 dovecot.spec                     |  9 ++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 dovecot-2.3.16-fixrefcount.patch

diff --git a/dovecot-2.3.16-fixrefcount.patch b/dovecot-2.3.16-fixrefcount.patch
new file mode 100644
index 0000000..70f687e
--- /dev/null
+++ b/dovecot-2.3.16-fixrefcount.patch
@@ -0,0 +1,12 @@
+diff --git a/src/imap/cmd-copy.c b/src/imap/cmd-copy.c
+index 59a4c7ef753..1ce018ba744 100644
+--- a/src/imap/cmd-copy.c
++++ b/src/imap/cmd-copy.c
+@@ -309,6 +309,7 @@ static bool cmd_copy_full(struct client_command_context *cmd, bool move)
+ 			mail_search_args_unref(&search_args);
+ 			client_send_box_error(cmd, copy_ctx.srcbox);
+ 			mailbox_free(&copy_ctx.srcbox);
++			mailbox_free(&destbox);
+ 			return TRUE;
+ 		}
+ 	}
diff --git a/dovecot.spec b/dovecot.spec
index 12cef13..13b032d 100644
--- a/dovecot.spec
+++ b/dovecot.spec
@@ -5,7 +5,7 @@ Name: dovecot
 Epoch: 1
 Version: 2.3.16
 %global prever %{nil}
-Release: 8%{?dist}
+Release: 9%{?dist}
 #dovecot itself is MIT, a few sources are PD, pigeonhole is LGPLv2
 License: MIT and LGPLv2
 Group: System Environment/Daemons
@@ -91,6 +91,9 @@ Patch30: dovecot-2.3-cve-2026-27857p5of5.patch
 # from upstream for < 2.4.4, RHEL-188480
 # https://github.com/dovecot/core/commit/9a0f8c1066956ea7450ca82b57f904332006a502
 Patch31: dovecot-2.3-cve-2026-42006.patch
+# from upstream for < 2.3.17, RHEL-176273
+# https://github.com/dovecot/core/commit/b401e4136fea3d6ceffcc139bdebf1df422dd221
+Patch32: dovecot-2.3.16-fixrefcount.patch
 
 Source15: prestartscript
 
@@ -217,6 +220,7 @@ mv dovecot-2.3-pigeonhole-%{pigeonholever} dovecot-pigeonhole
 %patch -P 29 -p1 -b .cve-2026-27857p4of5
 %patch -P 30 -p1 -b .cve-2026-27857p5of5
 %patch -P 31 -p1 -b .cve-2026-42006
+%patch -P 32 -p1 -b .fixrefcount
 
 sed -i '/DEFAULT_INCLUDES *=/s|$| '"$(pkg-config --cflags libclucene-core)|" src/plugins/fts-lucene/Makefile.in
 
@@ -577,6 +581,9 @@ make check
 %{_libdir}/%{name}/dict/libdriver_pgsql.so
 
 %changelog
+* Sat Jul 25 2026 Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-9
+- fix mailbox leak causing assert crash (RHEL-176273)
+
 * Fri Jun 26 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1:2.3.16-8
 - fix CVE-2026-42006: fix IMAP parser list_count_limit to correctly
   limit open braces instead of close braces (RHEL-188480)