sdbox: Failing after saved mails' UIDs were already assigned caused unlink()ing garbage

Mainly with dsync when it fails, the transaction is still committed and
mails are given UIDs. If the transaction commit still fails, it attempts to
rollback the saved mails by unlink()ing them, but at that point the path
pointed to an already freed memory. This caused unlink() errors with some
garbage strings as the path (and hopefully no actually valid paths).

The easiest way to reproduce this was to fill up the filesystem with dsync.

diff --git a/src/lib-storage/index/dbox-single/sdbox-file.c b/src/lib-storage/index/dbox-single/sdbox-file.c
index 4f998511b8d6924c24189232614e9bb38184fb0a..4cdaaf2aa794ee8cdadce3e7b19e4b533c8fa1e2 100644 (file)
--- a/src/lib-storage/index/dbox-single/sdbox-file.c
+++ b/src/lib-storage/index/dbox-single/sdbox-file.c
@@ -24,6 +24,7 @@ static void sdbox_file_init_paths(struct sdbox_file *file, const char *fname)
        i_free(file->file.alt_path);
        file->file.primary_path =
                i_strdup_printf("%s/%s", mailbox_get_path(box), fname);
+       file->file.cur_path = file->file.primary_path;
 
        if (mailbox_get_path_to(box, MAILBOX_LIST_PATH_TYPE_ALT_MAILBOX,
                                &alt_path) > 0)