From: Timo Sirainen <tss@iki.fi>
Date: Mon, 1 Sep 2008 13:10:27 +0000 (+0300)
Subject: Thread indexes: Crashfix.
X-Git-Tag: 1.2.alpha1~12
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a68752dd4de71537a8f7d120aa299044727f125a;p=thirdparty%2Fdovecot%2Fcore.git

Thread indexes: Crashfix.

--HG--
branch : HEAD
---

diff --git a/src/lib-storage/index/index-thread-links.c b/src/lib-storage/index/index-thread-links.c
index 2e0a5cdd92..58eeca8786 100644
--- a/src/lib-storage/index/index-thread-links.c
+++ b/src/lib-storage/index/index-thread-links.c
@@ -50,8 +50,16 @@ static void thread_link_reference(struct mail_thread_cache *cache,
 
 	i_assert(parent_idx < cache->first_invalid_msgid_str_idx);
 
-	parent = array_idx_modifiable(&cache->thread_nodes, parent_idx);
-	child = array_idx_modifiable(&cache->thread_nodes, child_idx);
+	/* either child_idx or parent_idx may cause thread_nodes array to
+	   grow. in such situation the other pointer may become invalid if
+	   we don't get the pointers in correct order. */
+	if (child_idx < parent_idx) {
+		parent = array_idx_modifiable(&cache->thread_nodes, parent_idx);
+		child = array_idx_modifiable(&cache->thread_nodes, child_idx);
+	} else {
+		child = array_idx_modifiable(&cache->thread_nodes, child_idx);
+		parent = array_idx_modifiable(&cache->thread_nodes, parent_idx);
+	}
 
 	child->parent_link_refcount++;
 	if (thread_node_has_ancestor(cache, parent, child)) {