]> git.ipfire.org Git - thirdparty/dovecot/core.git/commitdiff
lib-storage: Prevent recursion in header parsing
authorAki Tuomi <aki.tuomi@dovecot.fi>
Thu, 5 Jan 2017 08:50:55 +0000 (10:50 +0200)
committerGitLab <gitlab@git.dovecot.net>
Tue, 10 Jan 2017 12:27:39 +0000 (14:27 +0200)
If header parsing error occurs and error handling tries
to get fields, such as Message-ID, it will cause
crash. This fixes problem by preventing reading from
non-cached headers while they are being parsed.

Fixes lmtp: Panic: file ../../../src/lib/array.h: line 219 (array_idx_i):
assertion failed: (idx * array->element_size < array->buffer->used)

src/lib-storage/index/index-mail-headers.c

index ae5cad6730a791812267c0642cbe6c9bdefae1da..27ea3148bfffab00c3419f4ae814c373549f92dc 100644 (file)
@@ -634,7 +634,14 @@ index_mail_get_raw_headers(struct index_mail *mail, const char *field,
                                      _mail->seq, &field_idx, 1) <= 0) {
                /* not in cache / error - first see if it's already parsed */
                p_free(mail->mail.data_pool, dest);
-
+               if (mail->data.header_parser_initialized) {
+                   /* don't try to parse headers recursively. we're here
+                      because message size was wrong and istream-mail
+                      wants to log some cached headers. */
+                   i_assert(mail->lookup_abort == MAIL_LOOKUP_ABORT_NOT_IN_CACHE);
+                   mail_set_aborted(mail);
+                   return -1;
+               }
                if (mail->header_seq != mail->data.seq ||
                    index_mail_header_is_parsed(mail, field_idx) < 0) {
                        /* parse */