mail_index_update_flags_range(): Fixed out-of-bounds read.

--HG--
branch : HEAD

diff --git a/src/lib-index/mail-index-transaction-update.c b/src/lib-index/mail-index-transaction-update.c
index 526f17497d2f676c638353f2b6cff1ab5b569a2f..0c7d8ecbf6a220219bbaed0a80d1b0fde035965b 100644 (file)
--- a/src/lib-index/mail-index-transaction-update.c
+++ b/src/lib-index/mail-index-transaction-update.c
@@ -523,7 +523,7 @@ mail_index_insert_flag_update(struct mail_index_transaction *t,
        /* merge everything */
        idx = first_idx == 0 ? 0 : first_idx - 1;
        max = I_MIN(t->last_update_idx + 1, count);
-       for (; idx < max; ) {
+       for (; idx+1 < max; ) {
                if (updates[idx].uid2 + 1 == updates[idx+1].uid1 &&
                    updates[idx].add_flags == updates[idx+1].add_flags &&
                    updates[idx].remove_flags == updates[idx+1].remove_flags) {