lib-storage: Fix potential crash with SEARCH MIMEPART FILENAME ENDS

If the search value was longer than the checked filename, it accessed
memory outside the allocated buffer.

diff --git a/src/lib-storage/index/index-search-mime.c b/src/lib-storage/index/index-search-mime.c
index 95ad0ee6283c06fa6828d4eee6848a1cb2cf7136..ded94a9da4d6411c5420e908e34f861e1fe9b00d 100644 (file)
--- a/src/lib-storage/index/index-search-mime.c
+++ b/src/lib-storage/index/index-search-mime.c
@@ -283,7 +283,8 @@ search_arg_mime_filename_match(struct search_mimepart_context *mpctx,
        case SEARCH_MIME_FILENAME_ENDS:
                vlen = strlen(value);
                alen = strlen(key);
-               return (str_begins_with(value + (vlen - alen), key) ? 1 : 0);
+               return (vlen >= alen &&
+                       str_begins_with(value + (vlen - alen), key) ? 1 : 0);
        default:
                break;
        }