[Dovecot] Bug: quota-maildir.c, array accessed out of bounds

Timo,

In src/plugins/quota/quota-maildir.c, in the maildirsize_read() function, if the maildirsize file is greater that 5120 bytes, this code breaks because the while loop executes multiple times, incrementing size to a value larger than 5120, and then size is later used to referece the buf array out of bounds. To fix it you could add a break statement after "size+= ret;" so that the while loop is always only executed once:

    char buf[5120+1];
    ...

    size = 0;
    while ((ret = read(fd, buf, sizeof(buf)-1)) != 0) {
            if (ret < 0) {
                    if (errno == ESTALE)
                            break;
                    mail_storage_set_critical(storage, "read(%s) failed: %m",
                                              path);
            }
            size += ret;
    }
    if (ret < 0 || size == sizeof(buf)-1) {
            /* error / recalculation needed. */
            (void)close(fd);
            t_pop();
            return ret < 0 ? -1 : 0;
    }

    /* file is smaller than 5120 bytes, which means we can use it */
    root->total_bytes = root->total_count = 0;

    /* skip the last line if there's no LF at the end */
    while (size > 0 && buf[size-1] != '\n') size--;
    buf[size] = '\0';