From: Timo Sirainen <tss@iki.fi>
Date: Thu, 19 Aug 2010 17:36:09 +0000 (+0100)
Subject: imap: Don't crash with QRESYNC SELECT specifying sequences larger than mailbox's... 
X-Git-Tag: 2.0.1~31
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=905951e448e0d0f0778f43ce7673d0cac60b9b61;p=thirdparty%2Fdovecot%2Fcore.git

imap: Don't crash with QRESYNC SELECT specifying sequences larger than mailbox's message count.
---

diff --git a/src/imap/imap-fetch.c b/src/imap/imap-fetch.c
index eeb33abceb..f20cd49a94 100644
--- a/src/imap/imap-fetch.c
+++ b/src/imap/imap-fetch.c
@@ -150,6 +150,7 @@ static void
 expunges_drop_known(struct imap_fetch_context *ctx, struct mail *mail,
 		    ARRAY_TYPE(seq_range) *expunged_uids)
 {
+	struct mailbox_status status;
 	const uint32_t *seqs, *uids;
 	unsigned int i, count;
 
@@ -158,8 +159,10 @@ expunges_drop_known(struct imap_fetch_context *ctx, struct mail *mail,
 	i_assert(array_count(ctx->qresync_sample_uidset) == count);
 	i_assert(count > 0);
 
+	mailbox_get_status(ctx->box, STATUS_MESSAGES, &status);
+
 	/* FIXME: we could do removals from the middle as well */
-	for (i = 0; i < count; i++) {
+	for (i = 0; i < count && seqs[i] <= status.messages; i++) {
 		mail_set_seq(mail, seqs[i]);
 		if (uids[i] != mail->uid)
 			break;