From: Aki Tuomi <aki.tuomi@open-xchange.com>
Date: Thu, 20 Aug 2020 07:55:36 +0000 (+0300)
Subject: lib-mail: istream-header-filter - Avoid unsigned overflow in last_offset calculation
X-Git-Tag: 2.3.13~192
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2a82a8a9da8897d2aee10dccc9cc44568e262841;p=thirdparty%2Fdovecot%2Fcore.git

lib-mail: istream-header-filter - Avoid unsigned overflow in last_offset calculation

Unsigned integer overflow occurs when size is 0.
---

diff --git a/src/lib-mail/istream-header-filter.c b/src/lib-mail/istream-header-filter.c
index cc8eef8128..479a4bb219 100644
--- a/src/lib-mail/istream-header-filter.c
+++ b/src/lib-mail/istream-header-filter.c
@@ -393,11 +393,15 @@ handle_end_body_with_lf(struct header_filter_istream *mstream, ssize_t ret)
 {
 	struct istream_private *stream = &mstream->istream;
 	const unsigned char *data;
-	size_t size, last_offset;
+	size_t size;
+	uoff_t last_offset;
 	bool last_lf;
 
 	data = i_stream_get_data(stream->parent, &size);
-	last_offset = stream->parent->v_offset + size-1;
+	if (stream->parent->v_offset + size == 0 && size == 0)
+		last_offset = (uoff_t)-1;
+	else
+		last_offset = stream->parent->v_offset + size - 1;
 
 	if (mstream->last_lf_offset == last_offset)
 		last_lf = TRUE;