Trash Plugin bugs

[Alexei Gradinari]

> 3. Trash plugin does not check 'unlimited' values in
> bytes_ceil/count_ceil and may overflow them
> when add expunged size/messages
check any overflow

-       ctx->bytes_ceil += size_expunged;
-       ctx->count_ceil += expunged_count;
+        if (ctx->bytes_ceil > ((uint64_t)-1 - size_expunged)) {
+                ctx->bytes_ceil = (uint64_t)-1;
+        } else {
+                ctx->bytes_ceil += size_expunged;
+        }
+        if (ctx->count_ceil > ((uint64_t)-1 - expunged_count)) {
+                ctx->count_ceil = (uint64_t)-1;
+        } else {
+                ctx->count_ceil += expunged_count;
+        }

Attached the last patch.

Regards,
Alexei
-------------- next part --------------
A non-text attachment was scrubbed...
Name: trash-plugin.patch
Type: application/octet-stream
Size: 2118 bytes
Desc: not available
URL: <http://dovecot.org/pipermail/dovecot/attachments/20150413/68ffc75d/attachment.obj>