str_find_init() allocated too little memory for temporary suffixes buffer.

Found by Diego Liziero.

--HG--
branch : HEAD

diff --git a/src/lib/str-find.c b/src/lib/str-find.c
index 597762d784e03eac336350f4926dd1c50edb7f4e..15f8f10c34d145b353cae9e383d49130e07de8cf 100644 (file)
--- a/src/lib/str-find.c
+++ b/src/lib/str-find.c
@@ -1,5 +1,7 @@
 /* Copyright (c) 2007-2008 Dovecot authors, see the included COPYING file */
 
+/* @UNSAFE: whole file */
+
 #include "lib.h"
 #include "str-find.h"
 
@@ -53,7 +55,7 @@ static void init_goodtab(struct str_find_context *ctx)
        unsigned int j, *suffixes;
        int i;
 
-       suffixes = t_buffer_get(ctx->key_len);
+       suffixes = t_buffer_get(sizeof(*suffixes) * ctx->key_len);
        init_suffixes(ctx, suffixes);
 
        for (i = 0; i < (int)ctx->key_len; i++)
@@ -71,7 +73,7 @@ static void init_goodtab(struct str_find_context *ctx)
        for (i = 0; i <= (int)ctx->key_len - 2; i++)
                ctx->goodtab[len_1 - suffixes[i]] = len_1 - i;
 }
- 
+
 struct str_find_context *str_find_init(pool_t pool, const char *key)
 {
        struct str_find_context *ctx;