dovecot-1.2: Thread indexes: Crashfix.

[dovecot at dovecot.org]

details:   http://hg.dovecot.org/dovecot-1.2/rev/17cec811c5fd
changeset: 8149:17cec811c5fd
user:      Timo Sirainen <tss at iki.fi>
date:      Mon Sep 01 16:10:27 2008 +0300
description:
Thread indexes: Crashfix.

diffstat:

1 file changed, 10 insertions(+), 2 deletions(-)
src/lib-storage/index/index-thread-links.c |   12 ++++++++++--

diffs (22 lines):

diff -r 920c1ca3a8db -r 17cec811c5fd src/lib-storage/index/index-thread-links.c
--- a/src/lib-storage/index/index-thread-links.c	Mon Sep 01 15:31:20 2008 +0300
+++ b/src/lib-storage/index/index-thread-links.c	Mon Sep 01 16:10:27 2008 +0300
@@ -50,8 +50,16 @@ static void thread_link_reference(struct
 
 	i_assert(parent_idx < cache->first_invalid_msgid_str_idx);
 
-	parent = array_idx_modifiable(&cache->thread_nodes, parent_idx);
-	child = array_idx_modifiable(&cache->thread_nodes, child_idx);
+	/* either child_idx or parent_idx may cause thread_nodes array to
+	   grow. in such situation the other pointer may become invalid if
+	   we don't get the pointers in correct order. */
+	if (child_idx < parent_idx) {
+		parent = array_idx_modifiable(&cache->thread_nodes, parent_idx);
+		child = array_idx_modifiable(&cache->thread_nodes, child_idx);
+	} else {
+		child = array_idx_modifiable(&cache->thread_nodes, child_idx);
+		parent = array_idx_modifiable(&cache->thread_nodes, parent_idx);
+	}
 
 	child->parent_link_refcount++;
 	if (thread_node_has_ancestor(cache, parent, child)) {