From: Timo Sirainen <tss@iki.fi>
Date: Wed, 25 Mar 2009 19:53:39 +0000 (-0400)
Subject: mail_index_map_modseq_clone() caused memory corruption.
X-Git-Tag: 2.0.alpha1~1038^2~9
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=17147c4aa3239efe3fd8fd05e2ca13aebe4dec0b;p=thirdparty%2Fdovecot%2Fcore.git

mail_index_map_modseq_clone() caused memory corruption.

--HG--
branch : HEAD
---

diff --git a/src/lib-index/mail-index-modseq.c b/src/lib-index/mail-index-modseq.c
index 12112d484f..3079befceb 100644
--- a/src/lib-index/mail-index-modseq.c
+++ b/src/lib-index/mail-index-modseq.c
@@ -610,12 +610,24 @@ struct mail_index_map_modseq *
 mail_index_map_modseq_clone(const struct mail_index_map_modseq *mmap)
 {
 	struct mail_index_map_modseq *new_mmap;
+	const struct metadata_modseqs *src_metadata;
+	struct metadata_modseqs *dest_metadata;
+	unsigned int i, count;
+
+	src_metadata = array_get(&mmap->metadata_modseqs, &count);
 
 	new_mmap = i_new(struct mail_index_map_modseq, 1);
-	i_array_init(&new_mmap->metadata_modseqs,
-		     array_count(&mmap->metadata_modseqs) + 16);
-	array_append_array(&new_mmap->metadata_modseqs,
-			   &mmap->metadata_modseqs);
+	i_array_init(&new_mmap->metadata_modseqs, count + 16);
+
+	for (i = 0; i < count; i++) {
+		dest_metadata = array_append_space(&new_mmap->metadata_modseqs);
+		if (array_is_created(&src_metadata[i].modseqs)) {
+			i_array_init(&dest_metadata->modseqs,
+				     array_count(&src_metadata[i].modseqs));
+			array_append_array(&dest_metadata->modseqs,
+					   &src_metadata[i].modseqs);
+		}
+	}
 	return new_mmap;
 }