From: Timo Sirainen <tss@iki.fi>
Date: Sun, 12 Aug 2012 21:29:38 +0000 (+0300)
Subject: lib-index: Verify validity of ext-intro records in transaction log.
X-Git-Tag: 2.2.alpha1~346
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cf05507f63b12bd1ee4efffc2f316ebcd9fd7089;p=thirdparty%2Fdovecot%2Fcore.git

lib-index: Verify validity of ext-intro records in transaction log.
---

diff --git a/src/lib-index/mail-transaction-log-view.c b/src/lib-index/mail-transaction-log-view.c
index 14be6f301a..c6514e5ba5 100644
--- a/src/lib-index/mail-transaction-log-view.c
+++ b/src/lib-index/mail-transaction-log-view.c
@@ -586,6 +586,27 @@ log_view_is_record_valid(struct mail_transaction_log_file *file,
 		array_create_from_buffer(&uids, &uid_buf,
 			sizeof(struct mail_transaction_keyword_reset));
 		break;
+	case MAIL_TRANSACTION_EXT_INTRO: {
+		const struct mail_transaction_ext_intro *rec;
+		unsigned int i;
+
+		for (i = 0; i < rec_size; ) {
+			if (i + sizeof(*rec) > rec_size) {
+				/* should be just extra padding */
+				break;
+			}
+
+			rec = CONST_PTR_OFFSET(data, i);
+			if (i + sizeof(*rec) + rec->name_size > rec_size) {
+				mail_transaction_log_file_set_corrupted(file,
+					"ext intro: name_size too large");
+				return FALSE;
+			}
+			i += sizeof(*rec) + rec->name_size;
+			if ((i % 4) != 0)
+				i += 4 - (i % 4);
+		}
+	}
 	default:
 		break;
 	}