From: Timo Sirainen <tss@iki.fi>
Date: Thu, 12 Jun 2014 22:11:24 +0000 (+0300)
Subject: fts: Improved doveadm fts dump for corrupted expunge log
X-Git-Tag: 2.2.14.rc1~401
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=739f4f284b4a137c9291a00a23d197b1cd42099d;p=thirdparty%2Fdovecot%2Fcore.git

fts: Improved doveadm fts dump for corrupted expunge log
Although we may still be trying to allocate up to 2 GB of memory, but at
least no more than that now.
Found by Coverity
---

diff --git a/src/plugins/fts/doveadm-dump-fts-expunge-log.c b/src/plugins/fts/doveadm-dump-fts-expunge-log.c
index 8d4a2ae920..1b78769230 100644
--- a/src/plugins/fts/doveadm-dump-fts-expunge-log.c
+++ b/src/plugins/fts/doveadm-dump-fts-expunge-log.c
@@ -36,6 +36,11 @@ static int dump_record(int fd, buffer_t *buf)
 	if (ret != sizeof(rec))
 		i_fatal("rec read() %d != %d", (int)ret, (int)sizeof(rec));
 
+	if (rec.record_size < sizeof(rec) + sizeof(uint32_t) ||
+	    rec.record_size > INT_MAX) {
+		i_fatal("Invalid record_size=%u at offset %"PRIuUOFF_T,
+			rec.record_size, offset);
+	}
 	data_size = rec.record_size - sizeof(rec);
 	buffer_set_used_size(buf, 0);
 	data = buffer_append_space_unsafe(buf, data_size);