From: Timo Sirainen <tss@iki.fi>
Date: Mon, 16 Jun 2014 12:47:12 +0000 (+0300)
Subject: doveadm dump log: Fixed potential crash when log header size was corrupted.
X-Git-Tag: 2.2.14.rc1~372
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bb33d479fddcbfafc5cebdd9cb1974aa83589e9d;p=thirdparty%2Fdovecot%2Fcore.git

doveadm dump log: Fixed potential crash when log header size was corrupted.
---

diff --git a/src/doveadm/doveadm-dump-log.c b/src/doveadm/doveadm-dump-log.c
index e919939b09..af0e406833 100644
--- a/src/doveadm/doveadm-dump-log.c
+++ b/src/doveadm/doveadm-dump-log.c
@@ -497,7 +497,9 @@ static int dump_record(int fd, uint64_t *modseq)
 	}
 	printf("\n");
 
-	if (hdr.size < 1024*1024) {
+	if (hdr.size < sizeof(hdr)) {
+		i_fatal("Invalid header size %u", hdr.size);
+	} else if (hdr.size < 1024*1024) {
 		unsigned char *buf = t_malloc(hdr.size);
 
 		ret = read(fd, buf, hdr.size - sizeof(hdr));