[dovecot-cvs] dovecot/src/lib-mail message-part-serialize.c,1.12,1.13 message-part-serialize.h,1.7,1.8

[cras at procontrol.fi]

Update of /home/cvs/dovecot/src/lib-mail
In directory danu:/tmp/cvs-serv14685/lib-mail

Modified Files:
	message-part-serialize.c message-part-serialize.h 
Log Message:
Do some more sanity checking when updating cached message_part. If anything
fails, log the error and set index corrupted.



Index: message-part-serialize.c
===================================================================
RCS file: /home/cvs/dovecot/src/lib-mail/message-part-serialize.c,v
retrieving revision 1.12
retrieving revision 1.13
diff -u -d -r1.12 -r1.13
--- message-part-serialize.c	6 Jan 2003 18:54:36 -0000	1.12
+++ message-part-serialize.c	11 Jan 2003 23:13:36 -0000	1.13
@@ -177,28 +177,35 @@
 	return TRUE;
 }
 
-struct message_part *message_part_deserialize(pool_t pool, const void *data,
-					      size_t size, const char **error)
+static int check_size(size_t size, const char **error)
 {
-	struct deserialize_context ctx;
-        struct message_part *part;
-
-	/* make sure it looks valid */
 	if (size < sizeof(struct serialized_message_part)) {
 		*error = "Not enough data for root";
-		return NULL;
+		return FALSE;
 	}
 
 	if ((size % sizeof(struct serialized_message_part)) != 0) {
 		*error = "Incorrect data size";
-		return NULL;
+		return FALSE;
 	}
 
 	if (size / sizeof(struct serialized_message_part) > UINT_MAX) {
 		*error = "Insane amount of data";
-		return NULL;
+		return FALSE;
 	}
 
+	return TRUE;
+}
+
+struct message_part *message_part_deserialize(pool_t pool, const void *data,
+					      size_t size, const char **error)
+{
+	struct deserialize_context ctx;
+        struct message_part *part;
+
+	if (!check_size(size, error))
+		return NULL;
+
 	memset(&ctx, 0, sizeof(ctx));
 	ctx.pool = pool;
 	ctx.spart = data;
@@ -219,21 +226,24 @@
 }
 
 int message_part_serialize_update_header(void *data, size_t size,
-					 struct message_size *hdr_size)
+					 struct message_size *hdr_size,
+					 const char **error)
 {
 	struct serialized_message_part *spart = data;
 	uoff_t first_pos;
 	off_t pos_diff;
 	size_t i, count;
+	unsigned int children;
 
-	/* make sure it looks valid */
-	if (size < sizeof(struct serialized_message_part))
+	if (!check_size(size, error))
 		return FALSE;
 
 	if (hdr_size->physical_size >= OFF_T_MAX ||
 	    spart->physical_pos >= OFF_T_MAX ||
-	    spart->header_physical_size >= OFF_T_MAX)
+	    spart->header_physical_size >= OFF_T_MAX) {
+		*error = "Invalid data";
 		return FALSE;
+	}
 
 	first_pos = spart->physical_pos;
 	pos_diff = (off_t)hdr_size->physical_size - spart->header_physical_size;
@@ -244,6 +254,7 @@
 
 	if (pos_diff != 0) {
 		/* have to update all positions, but skip the first one */
+		children = spart->children_count;
 		count = (size / sizeof(struct serialized_message_part))-1;
 		spart++;
 
@@ -251,11 +262,21 @@
 			if (spart->physical_pos < first_pos ||
 			    spart->physical_pos >= OFF_T_MAX) {
 				/* invalid offset, might cause overflow */
+				*error = "Invalid offset";
 				return FALSE;
 			}
+
+			children += spart->children_count;
 			spart->physical_pos += pos_diff;
 		}
+
+		if (children != count) {
+			*error = t_strdup_printf("Size mismatch %u vs %u",
+						 children, count);
+			return FALSE;
+		}
 	}
+
 	return TRUE;
 }
 

Index: message-part-serialize.h
===================================================================
RCS file: /home/cvs/dovecot/src/lib-mail/message-part-serialize.h,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -d -r1.7 -r1.8
--- message-part-serialize.h	6 Jan 2003 18:54:36 -0000	1.7
+++ message-part-serialize.h	11 Jan 2003 23:13:36 -0000	1.8
@@ -14,7 +14,8 @@
 
 /* Update header size in serialized struct message_part. */
 int message_part_serialize_update_header(void *data, size_t size,
-					 struct message_size *hdr_size);
+					 struct message_size *hdr_size,
+					 const char **error);
 
 /* Get message size from serialized struct message_part data. */
 int message_part_deserialize_size(const void *data, size_t size,