mail_index_map_modseq_clone() caused memory corruption.

--HG--
branch : HEAD

diff --git a/src/lib-index/mail-index-modseq.c b/src/lib-index/mail-index-modseq.c
index 12112d484fa5b582a1d46e113efbcda11b66438e..3079befceb7638bed2e51bdcb5f760f52d278a28 100644 (file)
--- a/src/lib-index/mail-index-modseq.c
+++ b/src/lib-index/mail-index-modseq.c
@@ -610,12 +610,24 @@ struct mail_index_map_modseq *
 mail_index_map_modseq_clone(const struct mail_index_map_modseq *mmap)
 {
        struct mail_index_map_modseq *new_mmap;
+       const struct metadata_modseqs *src_metadata;
+       struct metadata_modseqs *dest_metadata;
+       unsigned int i, count;
+
+       src_metadata = array_get(&mmap->metadata_modseqs, &count);
 
        new_mmap = i_new(struct mail_index_map_modseq, 1);
-       i_array_init(&new_mmap->metadata_modseqs,
-                    array_count(&mmap->metadata_modseqs) + 16);
-       array_append_array(&new_mmap->metadata_modseqs,
-                          &mmap->metadata_modseqs);
+       i_array_init(&new_mmap->metadata_modseqs, count + 16);
+
+       for (i = 0; i < count; i++) {
+               dest_metadata = array_append_space(&new_mmap->metadata_modseqs);
+               if (array_is_created(&src_metadata[i].modseqs)) {
+                       i_array_init(&dest_metadata->modseqs,
+                                    array_count(&src_metadata[i].modseqs));
+                       array_append_array(&dest_metadata->modseqs,
+                                          &src_metadata[i].modseqs);
+               }
+       }
        return new_mmap;
 }