[dovecot-cvs] dovecot/src/lib file-cache.c,1.16,1.17
tss at dovecot.org
tss at dovecot.org
Sun Dec 3 15:09:40 UTC 2006
Update of /var/lib/cvs/dovecot/src/lib
In directory talvi:/tmp/cvs-serv2606
Modified Files:
file-cache.c
Log Message:
Check against offset/size overflows.
Index: file-cache.c
===================================================================
RCS file: /var/lib/cvs/dovecot/src/lib/file-cache.c,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -d -r1.16 -r1.17
--- file-cache.c 18 Nov 2006 23:35:37 -0000 1.16
+++ file-cache.c 3 Dec 2006 15:09:37 -0000 1.17
@@ -99,6 +99,8 @@
doesn't have to deal with any extra checks. */
size = SSIZE_T_MAX;
}
+ if (offset >= (uoff_t)-1 - size)
+ size = (uoff_t)-1 - offset;
if (offset + size > cache->mmap_length &&
offset + size - cache->mmap_length > 1024*1024) {
@@ -221,6 +223,8 @@
unsigned char *bits;
unsigned int first_page, last_page;
+ i_assert(size < (uoff_t)-1 && offset < (uoff_t)-1 - size);
+
if (file_cache_set_size(cache, offset + size) < 0) {
/* couldn't grow mapping. just make sure the written memory
area is invalidated then. */
More information about the dovecot-cvs
mailing list