dovecot-2.2: lib-index: Verify validity of ext-intro records in ...

[dovecot at dovecot.org]

details:   http://hg.dovecot.org/dovecot-2.2/rev/ba6b92cf7d49
changeset: 14882:ba6b92cf7d49
user:      Timo Sirainen <tss at iki.fi>
date:      Mon Aug 13 00:29:38 2012 +0300
description:
lib-index: Verify validity of ext-intro records in transaction log.

diffstat:

 src/lib-index/mail-transaction-log-view.c |  21 +++++++++++++++++++++
 1 files changed, 21 insertions(+), 0 deletions(-)

diffs (31 lines):

diff -r 51f9a87170f2 -r ba6b92cf7d49 src/lib-index/mail-transaction-log-view.c
--- a/src/lib-index/mail-transaction-log-view.c	Mon Aug 13 00:27:07 2012 +0300
+++ b/src/lib-index/mail-transaction-log-view.c	Mon Aug 13 00:29:38 2012 +0300
@@ -586,6 +586,27 @@
 		array_create_from_buffer(&uids, &uid_buf,
 			sizeof(struct mail_transaction_keyword_reset));
 		break;
+	case MAIL_TRANSACTION_EXT_INTRO: {
+		const struct mail_transaction_ext_intro *rec;
+		unsigned int i;
+
+		for (i = 0; i < rec_size; ) {
+			if (i + sizeof(*rec) > rec_size) {
+				/* should be just extra padding */
+				break;
+			}
+
+			rec = CONST_PTR_OFFSET(data, i);
+			if (i + sizeof(*rec) + rec->name_size > rec_size) {
+				mail_transaction_log_file_set_corrupted(file,
+					"ext intro: name_size too large");
+				return FALSE;
+			}
+			i += sizeof(*rec) + rec->name_size;
+			if ((i % 4) != 0)
+				i += 4 - (i % 4);
+		}
+	}
 	default:
 		break;
 	}