dovecot-2.0: lib-index: Verify that expunge-guid records have va...

[dovecot at dovecot.org]

details:   http://hg.dovecot.org/dovecot-2.0/rev/9a4c198597d8
changeset: 12612:9a4c198597d8
user:      Timo Sirainen <tss at iki.fi>
date:      Tue Feb 22 10:21:26 2011 +0200
description:
lib-index: Verify that expunge-guid records have valid UID.

diffstat:

 src/lib-index/mail-transaction-log-view.c |  16 ++++++++++++++--
 1 files changed, 14 insertions(+), 2 deletions(-)

diffs (31 lines):

diff -r cce208f9b393 -r 9a4c198597d8 src/lib-index/mail-transaction-log-view.c
--- a/src/lib-index/mail-transaction-log-view.c	Fri Feb 18 05:56:38 2011 +0200
+++ b/src/lib-index/mail-transaction-log-view.c	Tue Feb 22 10:21:26 2011 +0200
@@ -495,13 +495,25 @@
 		array_create_from_buffer(&uids, &uid_buf,
 			sizeof(struct mail_transaction_expunge));
 		break;
-	case MAIL_TRANSACTION_EXPUNGE_GUID:
-		if ((rec_size % sizeof(struct mail_transaction_expunge_guid)) != 0) {
+	case MAIL_TRANSACTION_EXPUNGE_GUID: {
+		const struct mail_transaction_expunge_guid *recs = data;
+		unsigned int i, count;
+
+		if ((rec_size % sizeof(*recs)) != 0) {
 			mail_transaction_log_file_set_corrupted(file,
 				"Invalid expunge guid record size");
 			return FALSE;
 		}
+		count = rec_size / sizeof(*recs);
+		for (i = 0; i < count; i++) {
+			if (recs[i].uid == 0) {
+				mail_transaction_log_file_set_corrupted(file,
+					"Expunge guid record with uid=0");
+				return FALSE;
+			}
+		}
 		break;
+	}
 	case MAIL_TRANSACTION_FLAG_UPDATE:
 		buffer_create_const_data(&uid_buf, data, rec_size);
 		array_create_from_buffer(&uids, &uid_buf,