dovecot-1.2: mail_index_map_modseq_clone() caused memory corrupt...

[dovecot at dovecot.org]

details:   http://hg.dovecot.org/dovecot-1.2/rev/2653007d906d
changeset: 8862:2653007d906d
user:      Timo Sirainen <tss at iki.fi>
date:      Wed Mar 25 15:52:52 2009 -0400
description:
mail_index_map_modseq_clone() caused memory corruption.

diffstat:

1 file changed, 16 insertions(+), 4 deletions(-)
src/lib-index/mail-index-modseq.c |   20 ++++++++++++++++----

diffs (32 lines):

diff -r 9d00503821d6 -r 2653007d906d src/lib-index/mail-index-modseq.c
--- a/src/lib-index/mail-index-modseq.c	Wed Mar 25 15:38:57 2009 -0400
+++ b/src/lib-index/mail-index-modseq.c	Wed Mar 25 15:52:52 2009 -0400
@@ -612,12 +612,24 @@ mail_index_map_modseq_clone(const struct
 mail_index_map_modseq_clone(const struct mail_index_map_modseq *mmap)
 {
 	struct mail_index_map_modseq *new_mmap;
+	const struct metadata_modseqs *src_metadata;
+	struct metadata_modseqs *dest_metadata;
+	unsigned int i, count;
+
+	src_metadata = array_get(&mmap->metadata_modseqs, &count);
 
 	new_mmap = i_new(struct mail_index_map_modseq, 1);
-	i_array_init(&new_mmap->metadata_modseqs,
-		     array_count(&mmap->metadata_modseqs) + 16);
-	array_append_array(&new_mmap->metadata_modseqs,
-			   &mmap->metadata_modseqs);
+	i_array_init(&new_mmap->metadata_modseqs, count + 16);
+
+	for (i = 0; i < count; i++) {
+		dest_metadata = array_append_space(&new_mmap->metadata_modseqs);
+		if (array_is_created(&src_metadata[i].modseqs)) {
+			i_array_init(&dest_metadata->modseqs,
+				     array_count(&src_metadata[i].modseqs));
+			array_append_array(&dest_metadata->modseqs,
+					   &src_metadata[i].modseqs);
+		}
+	}
 	return new_mmap;
 }